PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

November 14, 2011 // 3:37 pm - Today Spanish PlayStation 3 developer DemonHades has released the first version of their JFW DH MA-1 3.56 PS3 Custom Firmware alongside a video of it in action below.

Note: Before installing, barrybarryk warns users who install JFW DH MA-1 3.56 PS3 CFW they will not be able to downgrade without a hardware flasher... so be aware it's primarily intended for those stuck on a 3.56 base.

Download: JFW DH MA-1 3.56 PS3 Custom Firmware / JFW DH MA-1 3.56 PS3 Custom Firmware (Full) by Maara

To quote, roughly translated: PS3 MA-1 3.56 is the first PS3 Custom Firmware version 3.56. This custom (its most basic) was ready for about 7 or 8 months, but it was not until now when I decided to publish it.

It has nothing to do with the recently published exploit the metldr, although the appearance is imminent futures higher firmwares, for which he wants to try, here it is.

First of all thanks:

  • Graf_Chokolo, for their great work.
  • A Demonhades, for its testing, its great strength.
  • A JaiCrab, for their help.
  • A Lara, for making me laugh a day.
  • People who have tested this 3.56 MA-1, thank you very much.
  • To all that s @ s who donated for a flasher, no firmware ell @ s this far along would not exist as such.
  • A Varicella by their selfless help.
  • A B.E
  • A M.E.M, do not forget and forgive.
  • Tod @ s @ s that I forget that by mistake, apologize.

As the first version, it only takes the most basic functions of a custom firmware, now I'll explain. Also explain the changes performed in the 3.56 Sony, and as in its release notes, which argued as a simple patch was not just a patch.


  • Support PEEK / POKE lv2, using the typical SYSCALL 6 and 7 for compatibility with existing homebrew.
  • Support PEEK / POKE lv1 native SYSCALL using 10 and 11 respectively. These are used as SYSCALL
    than the lv2, the devs just have to use them as you would those of lv1 lv2 but affecting.
  • Load unsigned applications, FSELF format natively. That is, a normal application or npdrm
    FSELF valid format worked directly. (No touch-memory copy in the lv2).
  • Load logically signed applications, both official and unofficial signature valid.
  • Support for applications up to version 3.56.
  • Use of all SYSCALL system, provided that the product no later verify mode, QA, etc.
  • No need to modify the PARAM.SFO in the event that hypothetically would use a application that requests
    a version higher than 3.56 in either npdrm / normal application / or application running from the bdemu.
  • Installation of Retail and Debug PKG since the PKG Install option.
  • System settings in the XMB QA hacked. Now you can open the options using the normal combo without
    QA flag is active or a valid token or existing on your machine. Any options changed is maintained
    in the system registry settings.

This QA system hack allows any SPRX to call the XMB to check this information hacked receive information, such as the nas_plugin.sprx, which in the case of DEX would permit installed without any patch of PKG Retail. As always be careful you do with those options, this is the safest way to have the QA without be QA, and not have to modify the EEPROM in any recalculated appearance or tokens of any kind. Here I have to thank Sony for making the security of your token only be in one byte and not in those
should be.


  • FIX: Patch to allow loading of applications for (avoids errors 0x80010009)
  • FIX: Patch to avoid checking the firmware version of the application against the version of firmware stored in the memory of lv2 (avoid the error 0x80010019)
  • FIX: Patch to avoid the error 0x8001003C (allows loading of applications that request more internally than the current version)
  • FIX: Patch to avoid the error 0x8001003D
  • FIX: Patch to avoid the error 0x8001003E (using hdd patch and have no disc inserted)
  • FIX: Enables the use of all SYSCALL, avoiding generic error 0x80010003.


  • FIX: Patching a new security check that prevents updater mode, it could launch an application unsigned with the minimum key 0xD (3.56), avoiding the error 0x80010009. NOTE: See NOTE AT THE END OF THIS README
  • FIX: otherwise is used to integrate the new SYSCALL 6, 7, 10, 11 at lv2.


  • Added support for PEEK / POKE NATIVE at lv1. The method used to integrate these new hypercalls not use hypercall existing one, but really any hypercall not used in the system is a peek or poke depending on the case. To interact with PEEK / POKE, lv2 use SYSCALL of 10 and 11 respectively.
  • Changes in the hypercall mmap (114). In the 3.56 Sony made significant changes in this hypercall to avoid the use that was being given to the lv1 to lv2 mapping. Now this hypercall checks that the key argument has not been modified, are checked mapping ranges
    (Someone who understands this will realize how dangerous it is that you map the critical thing, and do not speak of lv1) the hypercall code is divided into sub-functions into chunks for rolling the analysis. 3.56 In this version of this hypercall MA has not been touched, but having the support of PEEK / POKE in lv1 mapping is no longer necessary. In a later version is not ruled out such a check hypercall it's not complicated really, just it was not necessary for this version.
  • Changes in the hypercall unmap (115), similar to mmap, its code shared between subfunctions.
  • FIX: Added some patches to avoid integrity checks lv1 / LV0.
  • FIX: Added patches in the SPM and the DM to enable the use of any service. The patch is different, smaller, the SS patch exists (this is no longer compatible with 3.56), in my testings my patch does not produce any kind of problem with trophies, or saved games, etc..
  • TODO: Delete the problem of not being able to downgrade to a version lower than 3.56. Currently not possible down from 3.56 after upgrading to the.


  • FIX: Patch to override the check ECDSA digital signature. Now an application with an invalid signature signed will be considered valid.
    For example, "sign" an application without having the proper private key to generate a proper signature.
  • FIX: Patch that removes the hash check of the application segments. A hash will be considered invalid
  • FIX: Patch to override that you can not use FSELF retail consoles. This patch is different from that in ps3devwiki, the patch is on that page about this subject brickea machines has a problem metadata to decrypt the encrypted executables retail.
  • FIX: Patch to override the protection added in 3.55 (in the case of applications npdrm / normal, previously only was in charge of the RVK) which prevents applications can be used above the indicated version in the firmware today. That is, in a hypothetical case, a game trying to throw in a 3.60 3.56.
  • FIX: Patch to override the protection auth check the applications (added in 3.56), this check detects programs created public tools as they always put the same auth, auth superior one.
  • FIX: Patch to remove the protection from the white list of authorized programs, added in 3.56. Now you can use all applications as 3.55 and below.


  • The lv2 is protected by a hash in lv1, in case you want to play an offset that encompassed in the range of protection, this would produce a panic check off the system. To avoid this problem, use the tool that is attached to this package before using poke modify lv2. Why not to implement this patch directly is because not everyone is dev, and that can not be touched lv2 is safe for the user.
    Of course the source code of this program is included, so a dev can see how using the POKE lv1 patched the problem.
  • You can now enter service mode, and use the lv2diag as before, but this has a potential danger. The 3.56 now makes it impossible to make a downgrade to less than 3.56, meaning that if you are in the 3.56 in him are, if you have time you tried to cancel out a version that checks the update manager. The problem is a programming error that allows updating Lv2Diag.self, the failure is that No checks that the update is in the usb or to verify that this is valid, the program formats the flash 1.2 and 3. That is, if then fails, your system would not have died partially flashes, still work ROS can use a lv2diag active again, but who Forewarned is forearmed. Lv2diag Beware!
  • Attached to this package is an updated application to extract the nodes of a dump of lv1 is an update of the application made by Graf Chokolo, now has support for versions 3.15, 3.41, 3.55 and 3.56 in one program. Useful to display the nodes extracted from your dump.
  • The firmware finished graphic will be added when finished JFW 3.41 itself.
  • In the package adds an application, I do not think there publicly, to put the product model directly from the XMB, acts as a toggle, in the event that you can use the product as simply so I removed the product.

As a final note to remember that this is the first version of the firmware, so constructive criticism are welcome. As I suppose that due to this publication where patches are appldr, many variants will come out of it, just remember that the first publication was this.

Do not bite the hand that feeds you, today is like tomorrow is a 3.56 higher, or maybe not.

3.56 MA-1 Installation Instructions

Assuming you want to upgrade to this version from 3.55 and below, the following steps.

1. Download the CEX 3.56 VERSION 2 from somewhere.
2. Apply the patch with included xdelta to patch on the official PUP VERSION 3.56 2.
3. Install the product using PUP by lv2diag mode, or through the XMB.

In the future, take a version for people stuck in the 3.56 flasher.

1.xdelta 356MA-MD5: d6ead544a81564331851b4e8b8d96c6d
DeltaPatcherLite.exe MD5: 05f144ebff7043c09107352315278ada
xdelta.exe MD5: 1c6b3a6e1e9df2c8313bcf98aabfc8e1
ProductModeXMB MD5: 6a4d8a189a202a988bc1f5425446b190
RepoMaster.exe MD5: 741e08ed4dd51d0cefa8faa1d043e766

ORIGINAL VERSION 2 3.56 MD5 CEX (for reference): 2a52196399a4b96ea568aafa65d1a27e
MA-1 3.56 PUP MD5 (for reference): efe066e4836393c8bf60a5cc6804ddc3

JFW DH MA-1 3.56 PS3 Custom Firmware is Now Available

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew PS4 Downloads.

#875 - PS4 News - June 17, 2012 // 9:49 pm
PS4 News's Avatar
This weekend the Spanish PlayStation 3 developers at DemonHades have announced that JBM 3.55 PS3 CFW is now in development, which will offer the best of JFW DH 3.56 MA in a new Custom Firmware.

To quote, roughly translated: Making decisions for the future of JFW-DH

Hello friends first of all like demons to thank you for trusting in JFW356MA as custom of your PS3, as you well know the PS3 scene is going through difficult times because of the dominance of DRM dongles, these dongles are set to 355, for structure and kernel.

As you know many of you in MA you have had problems when running certain applications mainly due to this reason which we have all we can to resolve, but we are aware that this balance in trying to adapt all our MA giving us more work to realization of new and abundant applications for JFW.

We have been thinking about these obstacles in which we double slaughter, we play in making new things and other things that appear in portage other devs submitting to more pressure and therefore more cramped.

As happened a few days with the PSN and spoof, had it not been for that we have been watching Black ubiesemos us as if other custom could, and I as a responsible community dh I can not want it to happen.

Yesterday was published the USERCHEAT, which only works on FW 355 canceled leaving us because we have to be 2 things again, and which work for portearlo takes time and patience ... and that is not profitable.

PUP reinstall either, nor recasar readers etc... making a calculation are more impediments to improvements in the 356.

And I freaking have to be me who has to say this, but in statistical framework and the 356 gives us more problems when it comes to offer diversity in short-term progress.

So the thing is so, it will create the JBM355 with all the best with the 356MA, thegrid, preloader, service packs, plugins, etc. and so and you will not be canceled and which will stay at ease and can focus solely on the accomplishment of tasks for JFW and no more ports.

If the TB, COBRA or other drops will be the first to have the 355 and that does not forgive me dejandos without the possibility of having the same or more.

So the thing is so, we will make a collective downgrade JBM355 cease to provide support to 356MA, waiting for so more people can know our fantastic custom and is much easier to return to another 355 by a pup.

I know this is not going to like some people, but if you read carefully will know the reason for this decision, because it is better to change the direction that never crash and demons

But I want to thank everyone who every day have been helping and giving their PS3, as kike, kiki, maki, Cheko, alvaro and of course the devs that created without rokiski MA, JaiCraB, blipi, and I blackdeath what little they could do but at heart would not be possible to have everything we have in MA, so I want to thank you.

1saludo and look forward to all your support for me and the team that formed the JFW we will continue to bring you many new things cane but this time in the JBM355


The time will put everyone on your site ... and while attentive to the site.

More PlayStation 3 News...

#874 - technodon - June 9, 2012 // 10:25 am
technodon's Avatar
could someone explain in english how to run the plugin that dumps 256MB of ram on DemonHades 3.56 to USB please. been trying to get this to work all day! lol.

#873 - Adriansfc92 - June 8, 2012 // 8:17 am
Adriansfc92's Avatar
Following up on their previous updates, today the Spanish PlayStation 3 developers at DemonHades have made available the first plugins for TheGrid dubbed Dumper RAM and NoBD for PS3 JFW DH 3.56 MA Custom Firmware.

To quote, roughly translated:

First TheGrid plugins - Dumper RAM and NoBD

Hello again demons, as we all know when it was announced the JFW one of the first features was the ability to run plugins in the background, options such as having music while playing games, ftp in the background, and so endless possibilities in which only limits us one thing, the imagination of the devs to create plugins...

I come today to present the first 2 plugins for our revered JFW3.56MA functional, we begin with the dumper.ram
a plugin ideal for researchers and curious, originally created by JaiCraB for JFW 3.41 and worn by our great friend blackdeath for JFW3.56 MA.


This is a plugin that allows us to dump the 256MB of ram at any time, the instructions are simple prior to everything, the first is to install 2.0.

The plugin support makes use of the following: When starting the look the boot.cfg in / dev_flash / TheGrid or / dev_usb000 (Bone in the root of the usb port closest to the reader) this boot.cfg consists of the following a simple text file that tell the path to the plugin to load.

[Register or Login to view code]

As you see first is the 1 that could also be a zero (1 - active | 0 - off) always go after the separator, a semicolon to go to the route after the plugin to load and then close the line with a point semicolon, then the line is successfully completed the plugin. Always be called boot.cfg will be recognized this is how ...

I give you an example as shown in the top line of boot.cfg, active with 1 plugin and take the root of the usb as a route to connect the pen to read the USB00 (if on the right) and turn on my PS3, well when we are in the JMB / XMB TheGrid is ready for the implementation of dumper.self (our plugin) plugin that is activated by a flag in this case his name is activated dumper.ram putting the pen in the flag dumper USB00.ram at the root, when you connect the led on our PS3 started blinking green when finished dump that we realize when we see that our PS3 hdd stops read / write so intensely open a filemanager or FTP and we will have our dumpeo in dev_hdd00 ready for review.

The most important of all, no matter when we activate the plugin, you can be in full play in full BD movie using the browser etc etc ... as I said before, great to learn more about assemblies such minis games, ps2, psx ... plugin download link boot.cfg dumper.ram + activation + flag

NOTE: boot.cfg open with notepad for configuration
NOTE-2: If we leave the dev_flash boot.cfg create the folder on the pendrive GRID_UPDATER we put in and start the ps3 (USB00)
NOTE-3: Remember to activate the ninth TheGrid.cfg patch is to enable the use plugins

Plugin NoBD

Plugin NoBD, another plugin created by JaiCraB, and carried by blackdeath, in NoBD we can set aside for loading backups managers in our PS3, currently only able to launch games on the PS3 JFW3.56MA, but could launch PSX games movies BD, and PS2 games (retro consoles) for retro would not find a way the game PS2 PS3 detected as when we are in service mode... instructions: start the PS3 with the pen drive plugged into the USB00, and at the root we have the following ..

[Register or Login to view code]

Turn on the PS3 with everything prepared and inserted an original game PS3, go to XMB and see that the title of the game is not the original if not the backup, we launched and we will give an error, this error is due to refresh BD ignore it, take us back to jmb / xmb and launch the game again, now you can play it 100% without the use of any manager... plugin download link boot.cfg NoBD + activation + flag

NOTE: currently only have 1 backup can be mounted but we could have till about 16 in future revisions
NOTE-2: If we leave the dev_flash boot.cfg create the folder on the pendrive GRID_UPDATER we put in and start the PS3 (USB00)
NOTE-3: Remember to activate the ninth TheGrid.cfg patch is to enable the use plugins


  • MA Rokiski to create and enable TheGrid is compatible with
  • JaiCraB by TheGrid for plugins, and all their hard work
  • Blackdeath to make bigger every day this cfw
  • DemonHades of testings at night till the thousand...
  • And even server, I hope you enjoy greetings...

TheGrid Update 2.0, Plugins activation and other improvements (via

Good hello, here we bring you another update from TheGrid, this time you have already activated the plugin system in the background, ready for the shift that they said it was not possible to have multitasking PPU "This is going to turn mathieuth the learned "

Among the supported plugins you have for the time and Full NOdisk DUMPER RAM. These plugins are loaded in the background and are activated only by setting the activation flag in correct path (root usb).

ExterMAl dev_flash

Also you have flags as ExterMAl dev_flash, where you only have to remove a pup of the FW that you please lower or similar to 356 (do not care debug or retail) and place the 7 folders dev_flash forming at the root of the pendrive

  • VSH
  • SYS
  • bdplayer
  • ps1emu
  • ps2emu
  • pspemu
  • data

And flash.external flag (if this flag is to start the console with the PEN, I always start the external dev_flash) The rest of the boot flags are:

  • factory.mode: Lets put the console in service mode without a dongle just to insert a usb with that flag.
  • hv.debug: Enables debugging of all services of the HV, with a ram dump you can see all debug messages.

TheGrid details:

  • Improved dynamic patching (Fully functional).
  • On the plugin support (Multitasking) in the background.
  • Various optimizations.

  • First patch (first number in the 64): this corresponds to MatherOS Patch to disable or enable the use of Linux on the console.
  • Second patch (second number in the 64): Corresponds to load the syscall PL3 Payload 35 in the console.
  • Third patch (third number in the 64): Corresponds to load Payload Supports sc MAS 36 and 8 on the console.
  • Fourth patch (fourth number in the 64): Corresponds to load BD region Free bone patch overrides the restriction on the region bds ignoring methods such as changing the console region (Annoyed if you have to do all the time) .
  • Fifth patch (fifth in number 64): Corresponds to the patch that disables the PS1 disk check on the console.
  • Sixth patch (sixth in number 64): Enables or disables dynamic patch the FW by loading a patch that makes bone PatchUser.bin the same user or future updates that we will be taking to thegrid will come in the form of a file "PatchUser.bin" that will contain the updates.
  • Seventh patch (Seventh in the number 64): Enables or disables support for LV2 Dynarec in order to use dynamic recompilation of the emulators and performance improvements in them (For use with emulators suits the users and devs who want the best performance).
  • Eighth patch (eighth number in the 64): Enables or disables the SET FAN 100% to revolutionize cooler fan speed to the limit.
  • Ninth patch (Nine in number 64): Enables or disables support plugins (*) ...

Confeditor prepared for this version with the changes in TheGrid:

If you have questions visit the wikiMA:

The plugin support makes use of the following: When starting the look the boot.cfg in / dev_flash / TheGrid or / dev_usb000 (Bone in the root of the usb port closest to the reader) this boot.cfg consists of the following a simple text file that tell the path to the plugin to load.

[Register or Login to view code]

As you see first is the 1 that could also be a zero (1 - active | 0 - off) always go after the separator, a semicolon to go to the route after the plugin to load and then close the line with a point semicolon, then the line is successfully completed the plugin. Always be called boot.cfg will be recognized this is how ...

Here you can download TheGrid ( 2.0 update, remember that this is not the SP1.4 and the plugins will be published in the next few days

TUTORIAL PATCHUSER.BIN by blackdeath (via

With this new version of TheGrid you can avail of dynamic patching capacity at its maximum splendor, as you do this is more dedicated to developers who want to learn new things and new ways of working that is why I teach that is the dynamic patch for user.

The dynamic patching is patching or modification of any file of fw (modules selves - sprx) in memory is something that is dynamic in the time it is loaded will be patched is a new way to modify the firmware without having to touch the dev_flash modules and obtaining the best results since being tested is no longer needed for any damage fw test.

To enable you ought to select the config "PatchUser.bin Support (User Patches)" on TheGrid.cfg.

The PatchUser.bin (You must write so as I write!) Should be placed in "/ dev_usb000/GRID_UPDATER/PatchUser.bin" (This is not to count him to keep the dev_flash and so will not need to change your patch provided automatically by if you play a bad thing not to be always starting tengais wrong) you can clear this also put in "/ dev_flash / TheGrid / PatchUser.bin" but I recommend that you leave this path when coding sure your patch is safe and you are aware of wanting to load times.

See it like this:

  • Dev_flash (East end where to stay and work completed and improved)
  • Dev_usb (test medium only load it when you find the USB so if you have not placed the usb (usb000) not obviously you will carry
  • Your patches since they are in the usb is why I see it more secure when we have something we test and end and that failure is not
  • Simply insert the USB or simply delete or correct PatchUser.bin usb in pc).

[Register or Login to view code]

As you can see is the same as I explained in the structure... Well I hope that many developers and interested in learning can prove it ...


Thanks to Rokiski, JaiCraB, blackdeath, Cheko Vakaloka and all that happened , and we recommend that all users install the MA to provide support to everything that is posted

Update: From haxxxen: Appldr research: unsigned apps patch (based on JFW DH 3.56)

Finally i have found a remedy for this (stupid) vsh.self unsigned app patch (pl3 based on kakaroto) for cex cfw/target.

due to disadvantages to this pl3 patch on dex i had removed it long time ago now, but never realized that there is a reason why this patch was there and found. @Joonie now has told me the problems that occur if you remove this patch, or you don't apply it. the symptoms are shutdowns on almost all apps when exiting or blackscreens.

well, even cobra does not work without this patch and will softbrick your ps3 on cex cfw (which was btw never mentioned by its cobra developer in readme)

now that i am a dex user, i have found this patch making problems with dex cfws, which is a nogo to me. it will break npdrm_fself signed apps and you cannot run them.

i then tried porting those appldr patches made by demonhades and guess what, the result is that i can run apps on cex again without any shutdowns or blackscreen. so this will make that vsh.self patch finally obsolete, at least to me and i am very happy

these are the patches i have found, but i need a helping hand there to determine which are needed and which not. fyi habib and Joonie, 4.21 appldr unsigned apps patches:

[Register or Login to view code]

Finally, from Joonie: this is off topic but I just wanted to let you know.

I found the working pattern that can be hard-coded in to lv1.elf for lv2 memory protection patch though not really needed on these days but wanted to let you know this patch worked on 4.46 and 4.75 at least.

I've been testing lv1 patches all day long and noticed the difference between 3.55, 4.21 , 4.30+ from cyber's toolbox.

for 4.21 he used:

[Register or Login to view code]

this pattern, and I was able to confirm this patch did work with prx loader 1.04, [without this, prx loader shutsdown]
however, I didn't test if this could be hard-coded since you said you had a brick before.

and for 4.30, 4.41, 4.46 cyber started using this pattern

[Register or Login to view code]

I also tested this patch with prxloader 1.03 [the one without lv2 mem protection patch, user included the patch since 1.04 for 4.46]

and I tried this patch hard-coded with lv1.self from 4,46 and 4.75, and it turned out worked without any problem.

Maybe you could try this one with your 4.21 and it could be good to add one of your tcl task collections.

I'll try to work on that appldr patch as soon as I'm done with my own stuff.. keep up with your good work.

ah also another thing, currently there isn't any working toggle recovery tool for NAND ps3s. [Condor updater 3.xx , REBUG TOOLBOX, vshmenu, glevend's recovery toggle, and yours]

I think that the offset of "FF" flag to enable recovery mode on eeprom doesn't seem to do anything on NAND PS3.

[Register or Login to view code]

I was able to get eeprom dump from ps3 dev wiki, the ones dumped by HW method, but I don't seem to find any clue about how to enable Recovery mode on NAND ps3s.

the original source code is available via zecoxao 's github.

More PlayStation 3 News...

#872 - HeyManHRU - May 16, 2012 // 4:18 pm
HeyManHRU's Avatar
Thanks for the posts Adriansfc92.

#871 - NTA - May 16, 2012 // 1:44 pm
NTA's Avatar
Oh I see. That's a bit unfortunate lol.

#870 - Adriansfc92 - May 16, 2012 // 1:32 pm
Adriansfc92's Avatar
Because in 3.55 no haven't dynarec and our team is focused on only JFW 3.56.

#869 - NTA - May 16, 2012 // 1:24 pm
NTA's Avatar
Why only support for 3.56? The other firmwares might feel a bit lonely without a decent psx emulator

#868 - Adriansfc92 - May 16, 2012 // 1:15 pm
Adriansfc92's Avatar
This only work in JFW 3.56.

#867 - NTA - May 16, 2012 // 12:44 pm
NTA's Avatar
What firmwares are supported by this PSX emulator? Only 3.56? What about 3.41/3.55?

#866 - Adriansfc92 - May 16, 2012 // 11:31 am
Adriansfc92's Avatar
The compatibility is not very high keep in mind this is a beta will be improved.

Try games and comment thanks!

Sorry for my bad english