PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

January 29, 2013 // 7:35 pm - Today Spanish PlayStation 3 developer MiralaTijera has shared details on his PS3 CFW 4.31 OtherOS++ WIP (work-in-progress) which contains no spoofing older Custom Firmware versions and includes QAFlag and BD Emu without a controller among the features outlined below.

Download: mod431.rar (67.7 MB) / mod431.rar (Mirror) / mod431.rar (Mirror #2) / multiMAN 4.31 PKG / multiMAN 4.31 PKG (Mirror) by chekcoca

To quote, roughly translated: Hi, basically I stand in the community giving what I made in the dark slowly.. This is my FULL 4.31 4.31 cfw spoof's nothing, it's all ported to the 4.31, and... I give to my multitool also called "core" which is nothing more than a self that load at startup console if this is available in the right usb of your console "/ dev_usb000 /" which among other things dumpea flash console, you enable qa flags (yes in 4.31 directly) and gets you out and gets you the factory mode... I put the specs:

  • CoreOS lv1 hash downgradeadas deactivated for consoles
  • lv1 183/182 undocummented (LV1 peek / poke)
  • lv1 OtherOS++
  • VSH: nas_plugin (all pkgs installable game_ext explore_plugin and plugin to show install package and eliminate epilepsy warning message (though the latter with qa flag leaves only) and for patched vsh rif / rap fakesign) (This last with qa flag leaves only)
  • default.spp: added extra memory for otheros GameOS
  • lv2 peek / poke, syscall 6/7,
  • lv1 lv2 peek / poke (optional syscall 8/9 via core)
  • Hermes Payload with 36 ported sc
  • APPLDR: lv2 memory hashing disabled from appldr (no need to have it at lv1 parcheeis) dev_flash whitelist disabled (load any keyset from dev_flash) and ECDSA Off
  • spu_utoken_processor: ECDSA off (qa flag)

Payload here to include in your C fixes and managers with the hook:

Payload with SC36

[Register or Login to view code]

Lv2 lv1 calls

[Register or Login to view code]

Now the core... is an all-in-one, this cfw to start looking at the dev_usb000 if a and a file called cellftp.self and another called copy_script.txt, enable disable search whoever can do it simply by putting the original sys_init_osd.self 4.31 in dev_flash folder / sys / internal / here and no longer seek more...

Download: PATCHFIX.xdelta (66.6 MB) / cellftp.self (89 Kb) / cellftp.self (89.31 Kb) / cellftp.self (90 Kb) / cellftp[fixed_update2].rar (175 Kb) / core2.70.rar (4.7 MB) / deactivatecore.rar (191 Kb) (via and and and / CORE 2.7.1.rar (4.94 MB)

Update 6: PS1 games now work with Update 6 / CORE 2.7.1 and mM! ReActPSN also works with the latest update. The boot_otheros flag gives me the same issue so Rebug tool box or going into recovery mode is how I get to Red Ribbon. This CFW searches for CORE (cellftp.self) on boot and it can be deactivated with sys_init_osd.self (it fixes some type of issue with "los mandos", and maybe speed up boot time as well).

Update 7: CORE 2.7.2 download and changes are outlined HERE courtesy of DEUSC2D.

2.7.0 Improvements:

  • Cinavia protection disabled
  • ReActPSN enabled (patched act.dat vsh / rif and erasure prevention act.dat)
  • Added new flag = flashnor = flashea nordump file in / dev_usb000 / in the north via software (eye takes as 20 minutes) the file would be dev_usb000 dev_usb000/nordump.bin let the usb.


Put the pack unzipped in the root of a pendrive as it is without flags with their accompanying files in the root also, we put it in the right usb and turn on the console, the core will handle the dirty work, if all went well both. self and. sprx deletes the core once updates, Greetings!

Then developed a homebrew called core which makes everything a little, the self has to go along with pendrive root folder copy_script.txt and flags with flags (functions) as you want to within when starting the console will look and run, leave a log of what was done in the root called core.log are mention the most important and tomorrow I explain a little more.

BD emu flag is for if you have not and do not controller works if you activate this flag npdrm console will behave as if the reader enabled qa, enable you qa flag directly in 4.31:

  • nand dump
  • nor dump
  • lv2 dump
  • full ram dump
  • etc.

The changelog here:

[Register or Login to view code]

Hermes thanks, I used your cosunpkg and cospkg for CoreOS and payload lined with SC36 and more...

Link all this: / mirror thanks to "Palestine"

Function bd emu's I have also built in a 3.55 cfw I'm uploading it is always useful to dump your key root

Edit: Here is = hilo_cfw-3-55-otheros-cex-bdemu-no-controller-integrado_1862166 to make your cfw patcher Open delta, in original file to Appoint the OFW 4.31 here: PS3UPDAT.PUP

CFW 3.55 OtherOS++ CEX, BDemu Without Controller (Integrated)

Hi, as promised here's the integrated version for CEX BDEmulator that has all patches from glevand for OtherOS++ and has the sha1 hash check syscon disabled for consoles for downgrades.

With this CFW because anyone with broken controller (black screen or throwing npdrm update loop etc...) can use the console as controller, you can load is APP_HOME your games from, that's something I have the same function in the CFW 4.31 in this same subforum but got to 3.55 here too integrated for people to use and get their root key inter things... SS unpatched least trophies error

Download: v3modnobd.pup (170.5 MB) / v3modnobd.pup (Mirror) / / CFW 4.31 OtherOS++ By MiralaTijera (MD5: A1781D38DC5F3D54830615ED6B6C3870)

In xdelta patch, the patch obviously apply and give the option to check and keep the original file checksum enabled, you will create another file called * NEW.pup being * the name that you do them to OFW, hashes the PUP should be good:

[Register or Login to view code]

Of course not bricked any console, hidden takes time and has been tested on all systems that can be installed

I give the core src polish it once, honestly I'm embarrassed both comment on the code you enjoy it, just as I will update the post in these 3 days with what I forget, that sure is a lot to this fw has had his job for.. Now comes Rogero and copy

Finally, some feedback on this PS3 4.31 CFW WIP from butnut: So I did a little testing... It installs fine on my slim 2101 and since I had left QA active the last time I was on 3.55 it is now automatically activated (still have to input button combo) The cold boot takes the same amount of time, only you don't see the epilepsy warning... It has normal install pkg files and app_home icons (just like Kmeaw 3.55)

Backup managers do not work yet because they do not have the new payloads implemented yet. I will go back to Rogero 2.04 for now. QA downgrade does not seem to work. Every firmware I try (CFW and OFW) the PS3 says it is corrupt. Luckily Rogero 4.25 to 3.55 DG pup still works.

FOR PEOPLE WITH BLUE SCREEN: I found the cause of the error and was in SPKG's generation, already fixed and I'm uploading the new delta for a new pup (linked above), yes now installable from anywhere EXCEPT ofw 3.56 + the rhythm of my connection in 30 minutes is up and available, while not install the previous advise, not pass anything that fence (only the blue screen is easily removed) if not for the whole upgrade process will be more comfortable.

PUP the resulting hash is:

[Register or Login to view code]

Devil is the size 66.6 MB.

Finally, below is a guide from Nicolas19 as follows: Nicolas's MiralaTijera CFW 4.31 NooB Tutorial

Step 0: Important Notes

  • Use a FAT32 flash memory that has the files needed to install CFW
  • Eject any disk you have in the drive because if there is a disc in the PS3,Your PS3 will be upgraded with Update File That is inside the game disc
  • This CFW is installed only on consoles With OFW 1.00--3.55 and All CFW/MFW 3.55 or CFW +3.55 with spkg sig check patched
  • If you're still using True Blue/JB-King dongle or any DRM dongle, Unplug and Then Put it in Recycle Bin and start Tutorial From Step 1
  • If your console is Spoof to +3.55 Versions ,you do not need to disable it
  • Users With Downgraded PS3 no need to dehash (Qa Flag) PS3 but if you like dehash your PS3, Use Toggle QA
  • Rogero CFW 4.XX must Install Another CFW 4.XX or Downgrade to CFW 3.55.

We Installed This CFW 4.31 on 20 PS3 That were on Rebug CFW 4.30.1 Successfully So in this tutorial we assume that you are on OFW 1.00--3.55 and All CFW/MFW 3.55 or CFW +3.55 with spkg sig check patched except Rogero 4.XX CFW.

Step 1: Download MiralaTijera CFW 4.31

First to start, download MiralaTijera CFW 4.31 (linked above)

MiralaTijera CFW 4.31 MD5: AD09B0CB3C09CFCCAB578E4E85969830
MiralaTijera CFW 4.31 Size: 192 MB (201,511,634 bytes)

Step 2: Installing CFW via XMB

After Download above Package, extract it (PS3 Folder) on a FAT32 Flash memory to: PS3/UPDATE/PS3UPDAT.PUP

Go to XMB > System Setting > System Update and select Update via Storage Media. It's all done.

Step 3: Installing Your Favorite Backup Manager

I create a Package with the name of "Backup Managers For CFW 4.31" That is include Latest Version of two awesome managers multiMAN and Iris manager With Support CFW 4.31

Download: Backup Managers for CFW 4.31

After Download extract The Package and Then:

1- Go in multiMAN folder and copy multiMAN ver 04.19.02 UPD CEX (20130130) into a FAT32 Flash memory and Go to Install Package in XMB and Install that

2- Go in Iris Manager folder and copy irismanager-4-x into a FAT32 Flash memory and Go to Install Package in XMB and Install that

Extra award:

Sure You've heard about the new features in This Custom Firmware. CORE is a great feature in This Custom Firmware. I packed a new CORE Folder that is very better than Original Release.

Download: CORE Folder Packed by Nicolas

Just select your favorite Folder and then Copy all three files (cellftp.self, copy_script.txt, flags folder) within the selected folder into Root of a FAT32 Flash memory. Connect your Flash memory to the nearest port to Blu-ray drive. When your PS3 starts up will search for it and execute it. It will leave a log on root called core.log. Enjoy.

Thanks MiralaTijera for AweSome CFW
Thanks deank for the Best Manager (multiMAN)
Thanks Developers of Iris Manager

PS3 CFW 4.31 OtherOS++ With QAFlag & BD Emu By MiralaTijera WIP

PlayStation Follow us on Twitter, Facebook and join us at our new site WWW.PSXHAX.COM!

#51 - nokkuho - February 27, 2013 // 1:33 am
nokkuho's Avatar
This topic seemed very interesting. It had my hopes up for installing it on OFW 4.31, but it turns out you can't yet still nice work though.

#50 - BOBJONES2013 - February 26, 2013 // 8:40 pm
BOBJONES2013's Avatar
thanks was looking for that answer

#49 - DEUSC2D - February 24, 2013 // 6:33 pm
DEUSC2D's Avatar
You can just disable Core or get nosearch flag working if you are going to be running games via USB.

I currently can not support this CFW as I need to repair my test console from fooling around with DEX (not this CFW related) before I can use this again. I'm also not sure what the dev intends on doing with this CFW and my Spanish is not getting any better.

#48 - accurateguy - February 24, 2013 // 8:45 am
accurateguy's Avatar
Am having issue after i update my core to 2.7.2 my usb games did not appear again on backup managers, please help me out thanks for the support in advance

#47 - DEUSC2D - February 17, 2013 // 6:06 am
DEUSC2D's Avatar
Hi, you must copy all the content from inside of the "Core 2.7.2" folder to the root (E:\root) of your USB device. The folder named "flags" needs to be at the root (E:\flags) of your USB device as well e.g. E:\flags with the boot_otheros flag inside of that folder will boot into otherOS. The PS3 will read it like this ==> /dev_usb000/flags and whatever flag you put in to that folder.

#46 - Doni - February 16, 2013 // 12:19 pm
Doni's Avatar
hi people I have a few questions, yesterday I installed the 4.31v2_CHX cfw.

From the core folder I have the whole folder "Core 2.7.2" in the root of usb copied along with the flags. E:\CORE 2.7.2\flags

Thus, the LED will flash the ps3 in several colors, it also starts the normal cfw, but my problem now..

1. The flags are active now or do I activate?
2. Do I have to enable somewhere bd emu, because i got a broken laser.

Sry for the google english^^
mfg doni

#45 - DEUSC2D - February 10, 2013 // 4:04 pm
DEUSC2D's Avatar
The dev MiralaTijera, is already making update 8. He claims that all games with be payable with no disc. Compiling a .PUP is not necessary for updates 5-7.

Please keep in mind that this is a WIP and if you have any issues just try to be patient.

#44 - abdullahjwz070 - February 10, 2013 // 8:06 am
abdullahjwz070's Avatar
Wow this is nice bro

#43 - okc8200 - February 10, 2013 // 7:07 am
okc8200's Avatar
Hi DEUSC2D. Thanks for the update 4 pup! This update 7 - core 2.7.2 is giving me major problems though. Can you make a pup for me?

#42 - DEUSC2D - February 8, 2013 // 8:59 pm
DEUSC2D's Avatar
To: seeman, this CFW does not need game fixes.

Download: Update 7 / CORE 2.7.2 (15.27 MB) / Core 2.7.2.rar (15.08 MB)

How to install Update 7 / CORE 2.7.2:

  • Connect a pendrive (FAT32 formatted) to PC.
  • Extract the content from "Core 2.7.2" folder to your pendrive.
  • Connect your pendrive to --> /dev_usb000 (closest usb port to bd-drive)
  • Turn on your console, once done CORE 2.7.2 will be installed.

Note: To use flags, copy them from the "All Flags For CORE 2.7.2" folder the flags folder on your pendrive with CORE 2.7.2 (only use the flags you need).

Summarization of flags:

  • Bdemu, If you have the reader controller you have dead or no reader and, therefore, do not npdrm works, enabling this flag, the console will behave as if you had reader. If you do not plan to change your desktop, you can install this flag in the flash through another flag called "installbdemu" not to depend on the pendrive. It has also been rewritten and now has a more accurate and improved.
  • Installbdemu, If your drive controller is dead, use this flag (with the Core Assets) to permanently install the flash BDemu.
  • Enableqa enable QA Flag directly in 4.31.
  • Removeqa, disables QA Flag.
  • Dumpnandflash, makes a full dump of NAND console, which will help us to recover the console of a full brick, with a flasher, of course, because if you have a full brick, CORE will not start.
  • Dumpnor, same function as above, but dedicated to consoles with NOR memories.
  • Dumpdevflash, Dumps the dev_flash (3) in the root of the pendrive.
  • Dumplv2, As stated, makes decrypted LV2 dump.
  • Dumplv1, Same operation as above, but this makes a dump (lv1dump.bin) of LV1 (16 MB).
  • Fullramdump, I think it goes without saying that it serves.
  • Flashnor, If there is a file called "nordump.bin" in the root of the pendrive, the MT will flash the NOR. Beware of this option could be dangerous if you do not know what you do. The flashing process takes around 20 minutes.
  • Anotherlv2, With this flag we can experience with our LV2 modified and tested for correct functioning well without flash this in memory of the console, thus saving many complications and risks of brick. Simply copy the root of pendrive LV2 self from modified and enable this flag, the console will start with the LV2 the pendrive.
  • Clear_bootparam, clean records (Cache and Logs) and "waste" that can leave other flags in use, to have the console as clean as possible. (Thanks for the clarification MrMento ^ ^)
  • Setup_flash_for_otheros, prepare the flash partitions to install OtherOS (Linux).
  • Install_otheros, Use petitboot to install Linux on the console. (Required files contained in the folder "OTHEROSFILES" pack of Update7)
  • Boot_otheros, If you have Linux installed on the console, turning this with this flag in the pendrive, Linux will automatically start at the beginning of the console. CORRECTED small bugs, now runs everything correctly.
  • Nosearch If you want the console boot even faster, besides solving the synchronization of the controls at the beginning of the console, but regardless of the flags in the search for new functions USB enable this flag once and will be installed Standing in the flash. You can restore it by installing the included in the Update7 ResetCore.pkg.

CORE 2.7.2 Changelog (rough translation):

CORE 2.7.2 with major improvements changelog:

  • Deleted and exitfactory enterfactory flag (power + eject works without dongle and you can leave the factory with the 2nd exit Lv2diag always) bone that were useless
  • Added flag "installbdemu" permanently installed bdemu flag causes the bdemu always be loaded without connected or flag setting usb
  • Now the core is automatically installed on the dev_flash to become permanent execution
  • Bdemu completely rewritten, is now more accurate and causes less problems.
  • The core 2.7.2 installs on dev_flash now (is automatic the first time I extort)
  • Added flag "nosearch" permanent flag adds a core to keep you from usb to the console and start the USB core and load without permanent work options with this greatly improves startup time to almost original theme synchronizing the controls
  • Added flag "flashnor" flashes using the normal root file in pendrive nordump.bin / dev_usb000/nordump.bin (you can watch it bricking if you do not know what you do not LOOK this flag)
  • deleted and payloaderdev Payloader flag, (and all managers have their payload to get mine when the managers are more up to date?)
  • Fixed boot_otheros the flag, now loads fine
  • Fixed collision with IRIS MANAGER code no longer asked to restart ..
  • Added flag "dumplv1" creates a file in the root of the pendrive lv1dump.bin with a dump of lv1 16MB

What's Cool:

  • As nocheck flag disables search permanently on usb I created a pkg to reset the permanent flag "nosearch"


  • Put the folder in the flag's flag that querrais start and what you put into the right usb console everything and export
  • Flags are empty files with no extension are created in the folder usb flags
  • From the core of this review is ongoing in flash, the update method is run resetcore pkg (if you have enabled nosearch) and turn off the console, enter the new cellftp.self (assumption 2.7.3) in the folder / updatecore of usb and make magic.


  • The homeless is bdemu reader READER COMPLETE WITHOUT ie no broken lens, if you have broken controller. This is slightly better than the same compatibility APP_HOME games but is better than using a disk.

This update is only, you do not have any other previously installed... and if you had an update not care too.

How to deactivate CORE 2.7.2:

  • Simply extract the contents from "DEACTIVATE CORE 2.7.2" folder to your pendrive.
  • Connect it to /dev_usb000 (closest usb port to bd-drive),
  • Turn on your console, once done CORE 2.7.2 will be deactivated.

Note: To restore CORE 2.7.2, install the ResetCore.pkg from the "TOOLS PKG" folder.

MiralaTijera, CFW 4.31 creator.
Isma_OMG, info/support provided.