Meta 
Meta



PS3 developer Evilnat has made a new update of his CFW 4.92 Evilnat Cobra 8.5 with these features:

  • Made out of 4.92 OFW (CEX)
  • Ported Kernel and some modules from OFW 4.84 DEX
  • Made manually without automatic tools
  • PSN/SEN enabled
  • Fixed layouts 272/480 from OFW 4.92
  • Disabled deletion of unsigned act.dat and .rif files
  • Allowed unsigned act.dat and .rif files
  • Allowed running of unsigned applications
  • Compatibility with FSELF
  • C00 demo unlocker
  • Disabled LIC.EDAT license check
  • Can be installed over 3.55 OFW
  • Can be installed over +3.56 OFW (bguerville Toolset)
  • Can be installed over any CFW CEX
  • Cobra 8.5 added and enabled as default
  • Full PS2 Games Compatibility
  • Possibility of Downgrade from any CFW with active QA Flags
  • QA Flags active if previously enabled
  • Disabled Epilepsy Message on Boot
  • Compatibility with PSX/PSP/PS2 games in ISO
  • Compatibility with PS3 games in ISO/JB folder format
  • Compatibility with ReactPSN
  • Display of Temperatures in XMB In-Game on PS2 Games
  • RSOD Screen Bypass
  • BSOD Screen Bypass
  • PS3_GAME/app_home
  • XMB In-Game Screenshot
  • Added Package Manager
  • DEX Kernel patched to prevent ambulance Brick (DEX kernel loaded with CEX TargetID)
  • CoreOS Hash Check patched to prevent Brick on non-dehashed Downgradate consoles
  • PS2CLASSICs work on CEX and DEX
  • Patched to remove LV2 Protection
  • Peek and Poke (LV2)
  • Peek and Poke (LV1)
  • CINAVIA protection disabled
  • Option to sort games by name and date
  • Allow to use 3rd party controller in Recovery Menu
  • Compatibility with OtherOS
  • Disabled update from OFW PUP in Recovery Mode
  • Dualboot compatible
  • Allowed installing of retail PKG on DEX
  • Allowed installing pseudo-retail PKG
  • Enabled [★Unlock], [★Lock], and [★Delete] options in Trophies
  • Compatibility with Remote Play
  • Added gameboot_multi.ac3
  • Deleted gameboot_stereo.ac3 and coldboot_stereo.ac3
  • Replace “Unlink” with “Delete Folder” in XMB
  • Bypassed PAL broadcast error on BD/DVD movies
  • Bypassed all error codes on BD/DVD movies
  • Enabled Debug menu in PS2 games (ps2_netemu.self)
  • Patched CBOMB issue
  • Target Manager patched to show version 4.9.2

Cobra 8.5

  • Failsafe Cobra stage2 (by bguerville/aldo)
  • Restore CFW Syscalls without reboot just entering to ‘Settings > System Update’ on XMB (by aldo)
  • Integrated Dynamic Control FAN (to control fan when webMAN is unloaded) (by aldo/Evilnat)
  • Support Photo GUI integration with webMAN MOD (mount games from ‘Photo’ column) (by aldo/DeViL303)
  • Get/Set FAN speed (by aldo)
  • Enable/disable features: Photo GUI, Restore Syscalls (by aldo)
  • Opcode to create CFW Syscalls (6, 7, 8, 9, 10, 11, 15, 35) (by aldo)
  • Opcode to create license (RIF) (by Evilnat)
  • Updated ps3mapi_load_process_modules to load custom modules and system modules (by haxxxen)
  • Added ps3mapi_get_process_module_info
  • Increased from 24 to 32 the max number of map paths (by aldo)
  • Added sm_get_temperature patch in kernel (by Evilnat)
  • Added sm_get_fan_policy patch in kernel (by Evilnat)
  • Added sm_set_fan_policy patch in kernel (by Evilnat)
  • Added support for REDUMP ISOs decryption on-the-fly (by Evilnat)
  • Opcode to toggle coldboot animation (by Evilnat)
  • Opcode to toggle epilepsy warning (by Evilnat)
  • Opcode to toggle gameboot animation and sound (by Evilnat)
  • Opcode to toggle hidden trophy info (by Evilnat)
  • Target Manager fix for DEX (By haxxxen)
  • Fixed Control FAN payload, avoids loading previous mode (by Evilnat)
  • Disable stage2.bin while Recovery Menu is loaded (by haxxxen)
  • Fixed max FAN speed after shutdown (by Evilnat)
  • Fixed black screen in CFW2OFW converted games (by Evilnat)
  • Added sm_ring_buzzer with single_beep, double_beep and triple_beep (by Evilnat)
  • Skip license creation (rif) if it already exists (by aldo)
  • Opcode to toggle PS2 icon (ISOs/BIN.ENC) in XMB (by Evilnat)
  • Added cellFsMkdir symbol (by Evilnat)
  • Added constant FAN Speed while a PS2 ISO is launched (by Evilnat)
  • Creation of fake act.dat while launching a PSN game (by Evilnat)
  • Block Log In on PSN/SEN when CFW syscalls are enabled (by DeViL303)
  • Toggle OFW Mode on Boot (by aldostools and Evilnat)
  • Block of PSP Launchers if a PSPISO has not been mounted (by aldostools)
  • Small optimizations (By aldostools)
  • Removed “unnecessary” code (By aldostools)
  • Opcode to toggle gameboot (By Evilnat)
  • Opcode to toggle coldboot and sound (By Evilnat)
  • Opcode to toggle epilepsy warning (By Evilnat)
  • Added cellUsb000_mount_symbol (By haxxxen)
  • Added usb_flag and no_cobra flags (By aldostools and Evilnat)

Official release post by Evilnat: PSX-PLACE

Download: MEDIAFIRE FOLDER WITH CFW OF EVILNAT 4.92 (MARCH 9TH, 2025)

  • CFW 4.92 Evilnat Cobra 8.5 [CEX]
  • CFW 4.92 Evilnat Cobra 8.5 [DEX]
  • CFW 4.92 Evilnat Cobra 8.5 [PEX]
  • CFW 4.92 Evilnat Cobra 8.5 [D-PEX]

  • PEX = Custom Firmware CEX with DEX modules ported from 4.84 to 4.92. It’s like Rebug REX.
    D-PEX = Custom Firmware DEX with DEX modules ported from 4.84 to 4.92. It’s like Rebug D-REX.
    noBD = Modified CFW for use with consoles with a broken or missing Blu-Ray logic board.
    noBT = Modified CFW for use with consoles with a broken or missing Bluetooth chip.
    OC = OverClocked 600/750 Mhz. It has 100Mhz increased to the default 500 Mhz RSX / 650 Mhz GDDR3 RAM Clock speeds.


    If your console is already on any version of custom firmware CEX, REX or PEX just install CFW Evilnat 4.92 over your current version from XMB or recovery menu.


    Download: Littlebalup’s 4.92 Dual Boot firmware – OFW that lets reinstall CFW. Only for PS3 already on CFW.
    PUP MD5: A4BD118B52A8AC04E2E802B66AAD72FD

    Download: Littlebalup’s 4.92 Dual Boot & Hybrid firmware – HFW that lets reinstall CFW. Only for PS3 on CFW.
    PUP MD5: 3C14A062FC7C60B8C195FA632BA6522A

  • Use BGToolset 1.2.100 to your jailbreak PS3 currently on HFW/OFW 4.75 up to 4.92.
  • For self hosted jaillbreak, if the PS3 is on OFW 4.91 or lower you can use PS3Xploit Flasher Writer 4.90 or PS3Xploit Flasher Writer 4.91.
  • Posted in PS3 | 1 Comment » Tags: , , ,

    true blue and cobra dongle

    I (aka shadoxi) figured out where is located the payload of Trueblue and cobra dongle. You can find it at offset @360000 in lv2_kernel and 7f0000 in ps3 memory.

    First of all you need to edit the header of lv2_kernel.self (from cfw trueblue) at offset 0×1D, replace 36 1A 00 by 4C FC F0. And decrypt it with unself tool from fail0verFlow. Open lv2_kernel.elf with Ida pro (in binary file mode), go to offset 360000 and press “C” to convert to asm code.

    TrueBlue use some HVCALL:
    lv1_insert_htab_entry
    lv1_undocumented_function_114
    lv1_undocumented_function_115
    lv1_allocate_device_dma_region
    lv1_map_device_dma_region
    lv1_net_start_tx_dma
    lv1_net_control
    lv1_panic (shutdown ps3 when TB is unplugged)

    This payload do some hvcall:
    lv1_insert_htab_entry (map lv1)
    lv1_allocate_device_dma_region (?)
    lv1_map_device_dma_region (?)
    lv1_net_start_tx_dma (?)
    lv1_net_control (?)
    lv1_panic (shutdown ps3 when TrueBlue Dongle is unplugged)
    lv1_undocumented_function_114 (map lv1)
    lv1_undocumented_function_115 (unmap lv1)

    We need now to dump lv2 and lv1 memory when TrueBlue is plugged. So I create a modified TrueBlue Cfw with peek and poke syscall. It work fine !

    Download: Payload.zip

    Posted in Brewology, PS3 | 4 Comments » Tags: , , ,