Main » 2013 » February » 18 » Create your CFW 4.31 directly from a OFW 4.31
12:37 PM
Create your CFW 4.31 directly from a OFW 4.31

MiralaTijera , spanish developper, has published a very interesting tool which will allow you to make a CFW 4.31  from a OFW 4.31. But that's not everything, you will have then on this CFW l'OtherOS++ with QA Flag menu enabled and BDEMU.

This suite of tools is used with caution and at your own risk. Neither the author nor LS can not be held responsible for any brick of your PS3.

Of course, you'll need to be already on CFW to install your new CFW 4.31 patched. CAN'T BE INSTALLED ON OFW !

Quote from the author:

Now the core... is an all-in-one, this cfw to start looking at the dev_usb000 if a and a file called cellftp.self and another called copy_script.txt, enable disable search whoever can do it simply by putting the original sys_init_osd.self 4.31 in dev_flash folder / sys / internal / here and no longer seek more...

Then developed a homebrew called core which makes everything a little, the self has to go along with pendrive root folder copy_script.txt and flags with flags (functions) as you want to within when starting the console will look and run, leave a log of what was done in the root called core.log are mention the most important and tomorrow I explain a little more.

BD emu flag is for if you have not and do not controller works if you activate this flag npdrm console will behave as if the reader enabled qa, enable you qa flag directly in 4.31:

nand dump
nor dump
lv2 dump
full ram dump

Changelog :

CoreOS lv1 hash downgradeadas deactivated for consoles
lv1 183/182 undocummented (LV1 peek / poke)
lv1 OtherOS++
VSH: nas_plugin (all pkgs installable game_ext explore_plugin and plugin to show install package and eliminate epilepsy warning message (though the latter with qa flag leaves only) and for patched vsh rif / rap fakesign) (This last with qa flag leaves only)
default.spp: added extra memory for otheros GameOS
lv2 peek / poke, syscall 6/7,
lv1 lv2 peek / poke (optional syscall 8/9 via core)
Hermes Payload with 36 ported sc
APPLDR: lv2 memory hashing disabled from appldr (no need to have it at lv1 parcheeis) dev_flash whitelist disabled (load any keyset from dev_flash) and ECDSA Off
spu_utoken_processor: ECDSA off (qa flag)
Core 2.6.5

2.6.5 changelog:

Added flag toggle_recovery MAKES A WIPE OF FAT darling!
Fixed 6 flags
Removed epilepsy warning

Core 2.6.0

2.6.0 changelog:

Added flag to clean debris from otheros's flag (used in cases of trouble entering recovery)

2.5.0 changelog:

Added otheros (minituto end)
dumpnandflash fixeado dumpea bootloader flag now also have a full backup of critical data from the console.


toggle_recovery = MAKES A WIPE OF FAT
clear_bootparam = clean debris flag's use of otheros
custom_boot_nor = boot at dev_usb consoles customboot.self from North
custom_boot_nand = boot at customboot.self from nand consoles dev_usb
boot_otheros = boot at otheros
install_otheros = dtbImage.ps3.bin installed in cell_os_ext_area
prepares setup_flash_for_otheros = nand / nor to be installed otheros
enterfactory = gets you into factory ...
load = payload from payloaderdev dev_usb000/payloads/431cex.bin
load = payload Payloader from core to use Multiman new
active = qa flags enableqa
removeqa = qa flags off
fullramdump = full ram dump
activated bdemu = bd emulator to use the console without controller
dumpdevflash = dumpea dev_flash partitions in the raw
dumplv2 = dumpea lv2
nordump = dumpea the NOR Flash
exitfactory leaves the factory mode =
dumpnandflash = nand flash dumpea fat consoles (including bootloader)


Tutorial OtherOS boot:

Start with only core setup_flash_for_otheros flag, to hear a double beep is that everything went well, if you do not hear looking log
Put this after the dtbImage.ps3.bin that corresponds to your console type dtbImage.ps3.bin.nand dtbImage.ps3.bin.nor is for nand and nor it is for renombrais to dtbImage.ps3.bin and you put it in root of pendrive as appropriate in your case and you put the flag install_otheros, same start and soon will hear 2 beeps sound if you look at the log to and that something is wrong
Once done turn off the console and put the flag boot_otheros, when you start your petitboot will see on the screen

Hermes thanks, I used your cosunpkg and cospkg for CoreOS and payload lined with SC36 and more...

Link all this: / mirror thanks to

Function bd emu's I have also built in a 3.55 cfw I'm uploading it is always useful to dump your key root

Edit: Here is = hilo_cfw-3-55-otheros-cex-bdemu-no-controller-integrado_1862166 to make your cfw patcher Open delta, in original file to Appoint the OFW 4.31 here: PS3UPDAT.PUP

CFW 3.55 OtherOS++ CEX, BDemu Without Controller (Integrated)

Hi, as promised here's the integrated version for CEX BDEmulator that has all patches from glevand for OtherOS++ and has the sha1 hash check syscon disabled for consoles for downgrades.

With this CFW because anyone with broken controller (black screen or throwing npdrm update loop etc...) can use the console as controller, you can load is APP_HOME your games from, that's something I have the same function in the CFW 4.31 in this same subforum but got to 3.55 here too integrated for people to use and get their root key inter things... SS unpatched least trophies error

Download: v3modnobd.pup (170.5 MB) / v3modnobd.pup (Mirror) /

In xdelta patch, the patch obviously apply and give the option to check and keep the original file checksum enabled, you will create another file called * NEW.pup being * the name that you do them to OFW, hashes the PUP should be good:

CRC32: 203E06EC
MD5: AD09B0CB3C09CFCCAB578E4E85969830
SHA-1: 7258E1BB84ED6E8AB0F6325A0199B65F82C7ADEF

Of course not bricked any console, hidden takes time and has been tested on all systems that can be installed

I give the core src polish it once, honestly I'm embarrassed both comment on the code you enjoy it, just as I will update the post in these 3 days with what I forget, that sure is a lot to this fw has had his job for.. Now comes Rogero and copy

Finally, some feedback on this PS3 4.31 CFW WIP from butnut: So I did a little testing... It installs fine on my slim 2101 and since I had left QA active the last time I was on 3.55 it is now automatically activated (still have to input button combo) The cold boot takes the same amount of time, only you don't see the epilepsy warning... It has normal install pkg files and app_home icons (just like Kmeaw 3.55)

Backup managers do not work yet because they do not have the new payloads implemented yet. I will go back to Rogero 2.04 for now. QA downgrade does not seem to work. Every firmware I try (CFW and OFW) the PS3 says it is corrupt. Luckily Rogero 4.25 to 3.55 DG pup still wo

Category: PS3 | Views: 386 | Added by: Kenpachi | Rating: 0.0/0
Total comments: 0
Name *:
Email *:
Code *:
Section categories
Tag Board

Total online: 1
Guests: 1
Users: 0