PS3 XForge PS QRC Tool - Modifying aspects of the XMB is now easier then ever.

We have seen many XMB visual mods published so far in the lifetime of the PS3 but the QRC format (a type of container) has been always problematic, tricky, and very restricted. XForge is intended to solve all this problems once for all, it allows full freedom to rebuild the QRC files and modify all his contents

There are many files inside the QRC containers that are candidates to be modified, XForge is the first tool that allows to modify them in a "noob friendly" way, everything made from a intuitive interface with preview panels

Say goodbye to the previous manual methods that required dealing with zlib compressed files or injecting them with a hex-editor to create a custom wave, to replace XMB main icons, to change background wallpapers, etc... XForge supersedes all that tutorials, manuals methods, and tools, there is a long list of features supported by XForge, for more detailed descriptions see the feature list below​
-@sandungas

XForge logo 722 copy.png

Download: XForge

Feature List_________________________________________________________________________________________
  • All QRC file types supported (QRCC and QRCF)
  • ZLIB compression and decompression transparent management (no user interaction needed)
  • Individual extraction/injection of files of any size
  • Full extraction of all files, using an additional xml control file for rebuilding purposes
  • Full rebuilding from the xml control file, generates QRC files identicals to the originals
  • QRCC to QRCF, and QRCF to QRCC conversions, generates files identicals to the originals
  • Build custom QRC files 100% from scratch, or adding/removing files from the officials
  • Several display panels: FileList (all types), TextViewer (MNU, TXT, INI, PATH), ImageViewer (BMP, JPG, TGA, DDS), HexViewer
  • Compatibility with sce-cgcdisasm.exe (tool not included in XForge releases) to dissassemble FPO and VPO files on the fly
  • Syntax highlighting in the TextViewer for MNU, TXT, INI, PATH (and optionally FPO and VPO)
  • MD5 hash info of QRC files and all his file contents, with identification of official files (initial support)
  • Advanced QRC internal structure file info (for debugging, development or research purposes)
  • Optional custom file extension system icons for QRC.ico and QRCF.ico
  • Optional custom file extension renaming at extraction time
  • Extensive drag and drop features - Drag files into XForge from Windows explorer, and out of XForge to Windows explorer.
  • Ability to open 2 or more XForge instances with different QRC's and drag-and-drop files between them.
  • Double click files on filelist to open them in your preferred editor application that's associated with that file type
  • Compatible with Microsoft Windows XP onwards (requires .Net framework 4.0)

[TABLE STYLE=class:prefix prefixBlue, border-width:0px, width:100%][TR][TD]Screenshots_________________________________________________________________________________________[/TD][/TR][/TABLE]
System icons
eZQziJm.jpg

MNU, TXT, INI, PATH viewer with syntax highlighting
nCbozwi.png

FPO/VPO viewer and dissassembler with syntax highlighting
Huwnszd.png

BMP, JPG, TGA, and DDS imageviewers
phag04T.png

Hexviewer
EIyuGDj.png


Videos________________________________________________________________________________________________

[TABLE STYLE=class:prefix prefixBlue, border-width:0px, width:100%][TR][TD]Tutorials______________________________________________________________________________________________[/TD][/TR][/TABLE]

  • This building method is inspired by rcomage, at extraction time XForge generates a XML control file for rebuilding purposes (located at root of the extraction path). The QRC file is built by loading the XML control file

    1) Open the QRC file with [File]>[Open]
    2) Extract all contents from the QRC file with the option [File]>[Extract All]. This will create a control XML file
    3) At this point you can modify or replace all extracted files
    4) Build the new QRC file by using the control XML file with the option [File]>[Open]

  • This method allows to replace individual files by using the buttons in XForge interface

    1) Open the QRC file with [File]>[Open]
    2) Extract files individually with the button [Extract File]
    3) Replace files individually with the button [Replace File]
    4) Save QRC file with the button [Save QRC File]

  • This is a direct conversion in between QRC and QRCF

    1) Open the QRC/QRCF file with [File]>[Open]
    2) Convert the file with [Tools]>[Convert]>[QRC to QRCF] or [QRCF to QRC]


Credits, History, and Changelog________________________________________________________________

  • First our team
    @pink1 Programming & development, research of the qrc format
    @sandungas For texting, icons/images, research of the qrc format & development consulting
    @DeViL303 For getting the team together with the idea of making the app, researching modding the qrc, texting & development consulting
    @Berion For texting & development consulting
    I can't thank these guys enough for all of the time and energy they put into this.

    We'd like to give credit to all of the other developers and members from over the years who have helped in any way.

  • Working with @sandungas @DeViL303 & @Berion over the past few weeks we have been able to make a few good jumps with the ps3 QRC file(mainly the earth.qrc).
    1. First we were able to replace files the same size or smaller(cool but not really new).
    2. After looking at the wiki for awhile we thought why not try editing the TOC (we know all of the values from the work of the amazing guys that reversed the format). This worked! We were able to expand the size of the files inside of the qrc.
    3. After playing with that we decided to try extracting the qrc to a folder then building a new one from it. To do this we also create a xml file with the a list of the qrc files in the order they are inside the qrc.
    4. This xml is used to build the new qrc. We have two spaces for each file first we have the source file then we have the id(the name in the qrc). By editing this file we can build a custom qrc only needing to extract & then build in the program after editing.
    5. Specific imageviewer preview modes for the special DDS file formats (mimicking the look of PS3 XMB)
    6. Specific textviewer syntax corrections for problematic files (EOL windows to unix conversions, standarization of control characters)

  • Initial release
 
Last edited by a moderator:
Nvidia CG Toolkit > it free on the site under legacy downloads for anyone to download so saying don't ask where is pointless when its allowed to be downloaded by anyone.
I wa talking about some CG tools from the PS3 SDK

If your goal is to create your own VPO and FPO files then the disassembled info is NOT going to be the same as the OG files.

Seriously what is it with you and overcomplicating EVERYTHING....?
You didnt get it, i mean... the dissassembled info generated from the OG file should be identical to the dissassembled info generated from the (compiled) custom source code

Thats a proof that both source codes was identical, when you achieve that it means you found the OG source code
 
That is partially done already and in the zip files I uploaded to @DeViL303 s OG thread on this, on the the functions remain to be turned into source. They are any file with the header file extensions > .h. I have another tool for breaking down the functions to source. So there is a very good base for anyone else to have a go at it.
Btw, in the zip you uploaded there are 3 files for each
Im going to use as example earth.qrc/lib/gaia/SkyBox.vpo (624 bytes)

This are the files you uloaded for it
SkyBox.vpo.txt <--- this is the output generated automatically by sce-cgcdisasm.exe (using default options)
SkyBox.param.h <--- this is the output generated automatically by sce-cgcdisasm.exe (using header option)
SkyBox_header.vpo.txt <--- not sure how you made this one, can you explain it ?

Both "SkyBox.vpo.txt" and "SkyBox.param.h" was generated using this command
Code:
sce-cgcdisasm.exe -header -o SkyBox.vpo.txt SkyBox.vpo
 
Last edited:
Btw, in the zip you uploaded there are 3 files for each
Im going to use as example earth.qrc/lib/gaia/SkyBox.vpo (624 bytes)

This are the files you uloaded for it
SkyBox.vpo.txt <--- this is the output generated automatically by sce-cgcdisasm.exe (using default options)
SkyBox.param.h <--- this is the output generated automatically by sce-cgcdisasm.exe (using header option)
SkyBox_header.vpo.txt <--- not sure how you made this one, can you explain it ?

Both "SkyBox.vpo.txt" and "SkyBox.param.h" was generated using this command
Code:
sce-cgcdisasm.exe -header -o SkyBox.vpo.txt SkyBox.vpo

Clearly didn't read anything I put..... Doesn't matter which tool is used the basic info is the same... The header_vpo.txt is generated by another tool.

. I used no tool from the SDK to dismantle these ... the tools I used have a GUI and more features than the tools in the SDK and are not made by S@ny but are for the PS3 and are made by Nvidia for the RSX and given only to Dev's,

I love how you try to tell someone how things were done... when It was my job to do CG programming in the first place ... so I think I know just little bit more than than you on this subject. So please don't presume to tell me how things are done.

Both "SkyBox.vpo.txt" and "SkyBox.param.h" was generated using this command
Code:
sce-cgcdisasm.exe -header -o SkyBox.vpo.txt SkyBox.vpo

That's true for the tools in the SDK as they are CMD line tools but not for the tools I used as I clearly stated I DID NOT use these tools .. lol ... maybe you should read fully what people put before assuming things. And stop trying to be a smartass ...

EDIT: Clearly there are those that " know more than me ", or think they so anyways so my contribution and skills is clearly not needed with these ... so people can get on with it and learn it for themselves ...
 
Last edited:
The only tool i knew that generates those files is the sce-cgcdisasm.exe
In the nvidia tools you have (given only to devs, and probably composed by many small utilities) there seems to be another tool that does exactly the same, in that case it should be pretty much like the sony one, an small command line utility

The actual XForge version is compatible with sce-cgcdisasm.exe (you just need to copy it inside the "ext" folder) and does the dissassembling of VPO and FPO files "on the fly" (everytime you click in a FPO or VPO file in the filelist), but we are not including sce-cgcdisasm.exe
This is where applyes the "dont ask us where to find it" i mentioned in a previous post, we dont want people asking us where to find it, to upload it, or requesting to include it in the next XForge version... everyone have to find his beans

If you know about a replacement for sce-cgcdisasm.exe that generates the same output please tell, we could try to see if nvidia included it in other public releases, in that case we could add it to the next XForge version
 
Last edited:
Can someone take a look at the MD5's of the 8 QRC files of official firmware 4.86 and publish them here ?
The actual XForge version is able to identify the official QRC files from the latest PS3 firmware by his MD5 (is displayed at bottom in the main XForge screen).... but actually is reporting them as 4.85 max

Incase the QRC files from 4.86 are the same than previous firmwares is needed to update that text strings pink1
 
Last edited:
Can someone take a look at the MD5's of the 8 QRC files of official firmware 4.86 and publish them here ?
canyon.qrc 053da0d0ed6b336e12665d41f0a18387
earth.qrc bedfe56680ed40807c53e61603c76e1d
icons.qrc 97342ffe4e3b427e9c2133c1bb6a3bb4
icontex.qrc 90146d3f374ec92ebed34535e90cd298
lines.qrc 261cd31a2516ef85a6d3b584c9bd02c5
raf.qrc 1fcc497e937fdc6cdad6a1707c9cd187
rhm.qrc 99f008fe3c2bacb937bfc925004e6e99
store.qrc 5e551fe46dca11258a29031128e8d998
 
this is a really great tool. I have been wondering, as @sandungas suggested above, about exploiting these for a while and this tool makes life easier for some of that fun :)

nice work @pink1 and others in this project!
Yes, now is very easy to replace the .elf files inside lines.qrc, are loaded when the PS3 boots, but only for one of the theme styles so we can also enable/disable the loading of that .elf files with an official setting, very convenient :D

Initially i guess applyes the same security than any other .elf of the firmware but im not so sure, im wondering if they added some special protection for them
Also, initially it seems for CFW we can do whatever we want with them, but for HEN im not so sure

If at some point you take a look at them comment something here, any finding could be handy because are directly related with the MNU files
It looks the .elf loads some variables/settings from the MNU files
 
Last edited:
Hmmm, wait, let me review that idea...

The point is if i want to talk about a file in forums, etc... then i need to add some description about it, right ?
With the files inside QRC containers, the better description is if we start telling the name of the QRC container... and after it yeah... subdirectories/levels and filename.ext
And additionally we can add the size just because the XForge code is ready for it

-------------
But now im thinking that another accurate way to describe a file is by his MD5... is just the MD5 alone is not so useful, anyway the actual XForge code is ready to calculate the MD5 of all the files

There is an option for it [Tools]>[Generate MD5 of Filelist]... and in the window that opens click right mouse button and select [Save MD5 list]

By now this MD5 lists allows you to compare QRC files in a more accurate way btw, you know instead of comparing the QRC files you can compare the MD5 lists of his contents, this is going to tell you which files differs in between different official firmware versions, or because someone "customized" them


Anyway, long story short, i would like to have all this options when clicking right mouse button in the filelist (left panel of main XForge window)
"Copy Name"
"Copy Size"
"Copy MD5"
"Copy All"

And the "Copy All" using this format:
Code:
container.qrc/level1/level2/filename.ext (size xxx) MD5:xxxxxxxxxxxxxxxx
 
Last edited:
Initially i guess applyes the same security than any other .elf of the firmware but im not so sure, im wondering if they added some special protection for them
Also, initially it seems for CFW we can do whatever we want with them, but for HEN im not so sure

If at some point you take a look at them comment something here, any finding could be handy because are directly related with the MNU files
It looks the .elf loads some variables/settings from the MNU files
If they are spu elf, which I assume, then HEN and OFW should also allow them to work. I have only tested a small amount of spu elf stuff, but loading any custom compiled valid spu elf works, loading from a signed PPU self, ie from a psn game eboot. I don't see why loading a custom elf from qrc would be different as far as security.

I will post any finding on this though that I feel are useful. I will test some of this over time.
 
If they are spu elf, which I assume, then HEN and OFW should also allow them to work. I have only tested a small amount of spu elf stuff, but loading any custom compiled valid spu elf works, loading from a signed PPU self, ie from a psn game eboot. I don't see why loading a custom elf from qrc would be different as far as security.

I will post any finding on this though that I feel are useful. I will test some of this over time.
Im not sure if are loaded in SPU completly or just partially, but yeah it looks like that because there is a MNU file named lines.qrc/PARTICLES_SPE.mnu, as mentioned before this MNU files seems to be loaded by the .elf's, and that name mentioning SPE seems to indicate that are the settings for some code that is running inside a SPE (or SPU at this low level im not sure about the differences in between SPE or SPU)
 
I had a new idea @pink1
This "Copy All" i suggested is overkill for a description, there is no room for error, and is a nice feature to generate all that file info with a single mouse click ready to copypaste, incase you implement it i think im going to use it a lot to talk about QRC files in the forum :D
...i would like to have all this options when clicking right mouse button in the filelist (left panel of main XForge window)
"Copy Name"
"Copy Size"
"Copy MD5"
"Copy All"

And the "Copy All" using this format:
Code:
container.qrc/level1/level2/filename.ext (size xxx) MD5:xxxxxxxxxxxxxxxx






-------------------------------------------------------------------------
What is written below is a bad idea, we cant asume that a MNU file belongs ONLY to the same firmware version than the QRC we have opened in XForge in that session
The fact is there could be other QRC files with different MD5 from other firmware versions containing the same MNU file

But im thinking in something even more overkill, and XForge code is ready for it, the actual XForge version is doing it and what im going to say is an addition to something that already exists

XForge have an small databasse with the MD5 hashes of the QRC files from the latest official firmware versions, this is used to display an (optional) text info at bottom of main window, as example the latest official versions of lines.qrc displays the additional text (PS3 OFW 460-4.86 lines.qrc)

The point is... when XForge [Open] a QRC file it does the MD5 check of the QRC file and if it matches with the database info you know it belongs to specific firmware versions
After that when you click right mouse button in the filelist panel at left and select the "Copy All" option i was suggesting could happen 2 things

If the QRC doesnt matches with the database info output the format i was suggesting:
Code:
container.qrc/level1/level2/filename.ext (size xxx) MD5:xxxxxxxxxxxxxxxx
But if it matches output the firmware versions too, as example:
Code:
lines.qrc/PARTICLES_SPE.mnu, 147 bytes, MD5:99DFA9C9359239FF9CAEA78BE067FC3E, PS3 OFW 460-4.86
 
Last edited:
Since we can create our own QRC, has someone tried to add new PNG or GIM and invoke them in XML? Maybe that way, we can also get shaders on them from XMB wave and stars? This would open possibility for true skins which could include all icons i.e WebMAN Mod icons.
 
Since we can create our own QRC, has someone tried to add new PNG or GIM and invoke them in XML? Maybe that way, we can also get shaders on them from XMB wave and stars? This would open possibility for true skins which could include all icons i.e WebMAN Mod icons.
In the XMBML files (located in path: /dev_flash/vsh/resource/explore/xmb/) we can load images from dev_hdd0 by using this:
Code:
<Pair key="icon"><String>/dev_hdd0/icon_name.png</String></Pair>
And we can also load images from inside RCO files by doing this:
Code:
<Pair key="icon_rsc"><String>icon_name</String></Pair>
But as far i know there is nothing to load images from inside QRC files
 
The "icon_notation" line seems to control the loading of icons/shaders from the qrcs.

Code:
<Pair key="icon_notation"><String>WNT_XmbItemSavePS12</String></Pair>

Adding/removing that line enables/disables all the effects.
 
The "icon_notation" line seems to control the loading of icons/shaders from the qrcs.

Code:
<Pair key="icon_notation"><String>WNT_XmbItemSavePS12</String></Pair>

Adding/removing that line enables/disables all the effects.
That line actually overrides the "icon" or "icon_rsc" line completely, if "icon_notation" exists, then the other lines are completely ignored.
 
@pink1 everytime i replace a file/image or whatever the program goes to the first item, can you make it to say where it was?

it is kinda annoying needing to scroll down everytime to replace the next file.

Also can we be able to edit directly? or at least when opening the file e.g here when i click in a .MNU file it opens it in my Notepad++ but the edits does not salve in the program, only saving it somewhere and then replacing.
 
Last edited:
That line actually overrides the "icon" or "icon_rsc" line completely, if "icon_notation" exists, then the other lines are completely ignored.

Not all, it depends which icon_notation you use, some seems to have priority others doesn't.

I used it a lot in my movies/music/etc online, at first i used just icons and after i decided to add the notation ones, so some of them were replaced and others doesn't ( i can't remember right now which ones, but for those i need to delete the icon line)

EDIT:

To be honest the ones that replaces the others completely are just a few

as stated in the devwiki

https://www.psdevwiki.com/ps3/XMBML_Coding
 
Last edited:
...can we be able to edit directly? or at least when opening the file e.g here when i click in a .MNU file it opens it in my Notepad++ but the edits does not salve in the program, only saving it somewhere and then replacing.
Is an advanced function not incuded in the actual XForge mostly because we had a lot other things to do, so we decided to implement only "viewers" instead of "editors"
As example, the hexviever right panel for ELF, BIN, DUMP file extensions (instead of a hexeditor), or the MNU viewer (instead of a MNU editor), or the image viewers (instad of image editors, mostly related with advanced edition modes related with earth.qrc)

A hexeditor is a bit pointless, because editing a ELF in a hexeditor is not going to work, and the other DUMP and BIN extensions are unknown
But a MNU editor would be a nice feature :)



Edit:
Also, we was thinking in some advanced MNU edition modes... are tricky to implement ;)
 
Last edited:
Back
Top