Quote:pspbtcnf.bin 3.51 :
Doc by Ac_K ...
===================
*******************

Header : 0x0 to 0xff
====================

0x18 : 60 27 (Invert this for had the offset of PRX List 0x2760)
0x1C : BIN Filesize in bytes

0x4E : +0x01 byte by Path add
0x6C : +0x01 byte by Path add
0x8C : +0x01 byte by Path add
0xAC : +0x01 byte by Path add
0xCC : +0x01 byte by Path add
0xEC : +0x01 byte by Path add

PRX Lines :
==========

Example :
Offset 0x100 for the first path.
Two lines aligned in 16 bytes.

01 00 01 80 01 00 00 00 00 00 00 00 00 00 00 00
BF 33 56 F5 E3 A2 8C 3A 43 5D BE F7 70 F0 66 64

First line : Type PRX , Path PRX line.
Second line : Hash of the PRX. (You could NOP this line, the hash isn't check !)

1) 6 Type (First byte / in First line) :
----------------------------------------

0x01 : VSH
0x02 : GAME
0x04 : UPDATER
0x08 : POPS
0x10 : LICENSE GAME
0x40 : APP

2) Attributes (Three bytes / in First line) :
-----------------------------------------

0x00 0x01 0x80 : same every time !

3) Adress PRX Line :
--------------------

In the original pspbtcnf.bin the offset of the first path is 0x2760.
For the "/kd/sysmem.prx" the offset is 0x2761.
The fifth byte in the first path is 0x01.
0x2760 + 0x01 = 0x2761.

For the second path (Offset : 0x120), the fifth byte is 0x10.
For "/kd/loadcore.prx", 0x2760 + 0x10 = 0x2770.

The fifth byte it's length (in hexadecimal) of the last PRX path string.

4) 11 last bytes it's every time 0x00...

Thanks :
- _main("JL") - http://forums.maxconsole.net/showpost.ph...stcount=14
- BStronga - The first modify pspbtcnf.bin !
- M33 - Custom Firmware 3.51 !