the payload is inside the psfree hack. to start it you would need to copy the psfree files over to andboot and run it afterwards.
in xandroid you start this program found in dev-tools called terminal emulator.
in this terminal emulator you can "cd" to /sdcard/andboot and the psfree mod is there. its called psfreemod.ko
here is to apply it :
HTC Dream (G1) & HTC Magic 32B (Sapphire):
1.Install Cyanogen Mod 6.
2.Extract the PSFreedom HTC Dream archive and copy Enable PSFreedom G1 & Disable PSFreedom G1 to your SD card.
3.Boot to recovery mode.
4.Perform a Nandroid backup.
6.Reboot phone, hack your PS3.
7.To disable and return your phone to normal, flash Disable PSFreedom G1 from recovery
after that, when it runs, a directory will appear /proc/psfreedom/. You need to copy the desired payload into /proc/psfreedom/payload before running the exploit, and that's it!
example: cat payload_bdemu.bin > /proc/psfreedom/payload