PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

December 30, 2013 // 11:55 pm - Following up on the previous updates, PlayStation 3 developers RedDot-3ND7355 and B7U3 C50SS have now released PS3MFW (PS3 Modified Firmware) Builder 1.0.0 Build 2.0.0 followed by v0.2.0.2 and Update 3 dubbed Our MFW 1.0.0 with an Installer followed by v0.2.6.0 with the changes outlined below.

Download: PS3MFW Builder 1.0.0 (Our MFW 1.0.0) Build 2.0.0 (Full) / PS3MFW Builder 1.0.0 (Our MFW 1.0.0) Build 2.0.0 (Update) / GIT / lv2_kernel.self (Hermes stuff inside) by Smhabib / / (Updated) (Fixed it now to work with new routines) by haxxxen / Install Our MFW Builder.exe (Build / Install Our MFW Builder.exe (Update 3) / PS3MFW Builder v1 Installer (Build by RedDot-3ND7355 via B7U3 C50SS / Our MFW 1.0.0.rar (PS3MFW Updated for 4.65) by haz367 / by littlebalup / (PS3MFW Updated for 4.66) / Latest PS3 MFW Builder Update by RedDot-3ND7355 / PS3MFW-master.rar / Playerkp420_4.66_CFW-v1.00_PS3UPDAT.PUP (196 MB - MD5: BD3752C037DB9F786AA445CD862C3675) / Playerkp420_4.70_MFW_PS3UPDAT.PUP (196.41 MB - MD5: 8C21E25AB3F30CA5C3C9E8041ADBDC12) by playerkp420 / PS3MFW Builder v0.2.1 Mod GIT by haxxxen / Install Our MFW Builder.exe / Install Our MFW Builder.exe (Mirrors by B7U3 C50SS) / PS3MFW-Builder-master.rar (v0.2.6.0) by haz367

To quote: Hey Everyone! Its me RedDot and i'm back with my team again to release you this new build of PS3MFW Builder 1.0.0!

We managed to find all the bugs about the repack/unpack/keys/tasks! Just follow them as respected and everything WILL be fine.

This is TRULY stable, and if you patch the right features you will NOT get brick/or whatsoever... I also recommend you have a minimum requirement of knowledge on modding

I hope the video helped A LOT. Credits to all the dev's that made this project possible and finished supposedly. But of course we will maybe continue to add features if new updates are released! So keep an eye on that updater.


Original dev's

Newer Version dev's
->Anonymous Developers
->B7U3 C50SS

All people that helped A LOT!
->RazorX (For sum tasks & updater)
->Haz367 (For pin-pointing problems & many tasks)
->Habib (For allowing us to use his patterns for tasks)
->Naewhert (For his tools)
->toolboy2012 (For sharing his awesome work with us)
->Arachetous (For a special task)
->And all other people that i may had forgotten :P

List of all features for 4.xx

Patch to allow running of unsigned app's
Patch to add ReactPSN online/offline
Patch to allow Debug pkg installation
Patch SysValue's (PS2 Related)
Patch to fix removing act.dat on boot!
Patch for ingame screenshots!
Patch RSOD Bypass!

Patch lv0 ldr's
Patch lv0 CoreOS ECDSA Check&Descrambling of LV1LDR!
Patch lv0 using Rebug/ITA DEX!
Patch lv0 for Cobra Features!
Patch lv1 for many features!
Patch lv1 Mmap out!

Patch lv2 for peek&poke
Patch lv2 for POC! (only 4.50)
Patch lv2 for hermes payload!
Patch lv2 for syscalls!
Patch lv2 for QA Flag!
And many more!

Patch nas_plugin for debug pkg's&installation of retail pkg's
Patch the core_os spu's&spp
Patch default.spp for otheros! (must include otheros of lv1!)
Patch XMB for IPF&APPHOME! (includes xmb plugin mods)
Patch PUP for Cobra files! OMG
And there is a lot more options in the builder

From haz367 comes PS3MFW Builder Incl Cobracrapper 446/453 Task set for 446 Cobra MFW.

Download: Our_MFW_1.0.0.rar

PS: updated oldfart-lv0 task to incl Rebug-ITA/DEX style... and Cobra compatible lv0 patching:

[Register or Login to view code]

Update: From RedDot-3ND7355: It would seem that i forgot to put create_tar2 instead of "create_tar" for the modify_devflash_files2 My bad.. there isn't any problem in the task itself... its in the base!

Now I updated the builder! Build: now out.

From tiefputin2: From ps3dev channel on efnet, if someone can make a tcl:

[Register or Login to view code]

It should make sfo editing for remote play obsolete... and make disc games without sfo-enabled remote play-attribute flag finally work

From toolboy2012: Hi All, OK, fixes are done for the tcl version of the 'patch_file{}' and 'patch_file_multi{}' routines (called by the "patch_elf{}" func) as I was saying before, you can use the modified function as is, if you don't need to mask any bytes/bits off, and the speed will not be changed..if anything the way I fixed it up is a bit faster, as I read the entire file into memory, then do the data searches, as the routine as it was before, read in '1' byte at a time from the file, so the routine was constantly accessing the hard drive non-stop until the function completed....

So when calling 'patch_elf{}' now, you just need to set a local var named 'mask' to either 0 or "" if not using it, as it's a required param to the function. If you need to actually set a mask, then actually set the mask string to the mask value....

As I said, when using the 'mask', the search will be much much slower, not too bad on small files, but for large files like the 'lv2_kernel' (3MB), the search takes 3mins. or more for each pattern match...

So I'm going to show a quick example below, for those may be a bit confused how this works:

1) Going to show an example for the patch "SysCall36 4.xx CFW part 2/3" (as in my scripts, part 2/3 & 3/3 I used the MASK setup)

2) In this example, I'm showing you the IDA disassem. for this section of the 'lv2_kernel' where the part 2/3 & 3/3 patches are,
comparing the disassem. for OFW 3.55, 4.46, & 4.55...

3) at the very bottom of this example, you can see the 3 'search strings', of the op-code patterns corresponding to each OFW version... when you look at them lined up above each other, you can see the op-codes that are identical, and where the differences are...

4) You can then look at the last string which is the 'mask', the "\xFF" byte in the real search will be AND'd with it's corresponding op-code byte, so in other words, if you need to 'ignore' where the differences are, then set those bytes or individual bits, in the mask, to "0"... hopefully this makes sense? if not, I can try to post another example?

(like I said, I'm working on a new 'patchtool.exe' now, hopefull this week it will be done, which should tremendously speed up our binary 'patching' time, makes much more sense to search/patch with a tool, rather than doing all that pattern matching/searching in TCL, as this stuff is where TCL is tremendously slow!)

[Register or Login to view code]

NOTE: When ever you need to USE a MASK, the size of the 'search' and 'mask patterns MUST be exact multiples of 4-bytes (32-bits), in order to make that search as FAST as I could. So you have to count the bytes in any of your search strings where you want to use the mask... if you need to add bytes on to make it an even amount, but don't actually want those added bytes to be 'included in the pattern match, then just make them any value, and set their corresponding values in the MASK to be '\x00'!!

i.e., in the example I showed above, the 'search' and 'mask' strings are 16-bytes in total length (ie 4 total count of '4-byte' chunks).

From haz367: whop, that's a pro way right there... it wasn't a difficult one, the updated 455 sysc36 part3,4 (from Reddot's fork) to find manually this time, it won't beat your way of doing it tho... hmm that IDA is interesting

[Register or Login to view code]

Awesome work toolboy!

From haxxxen: Just another thanks to you guys and toolboy2012, for making builder working again. it really works smoothly though i am using a modified version without cos auto repack and with selfrebuilder. maybe i will get isorebuilder also working next...

If i can recall right, there was already a demand of it, but after this forced latest ofw release i've took the chance and created once again a rebug spoofer update task. it will only update the spoofer for rebug mode and it will work for all versions 3.55.4 - 4.46.1.

Only problem is, it will not work as it is for the updated official ps3mfw builder and gives this "cannot find blabla.self.self" error. with my builder mod and selfrebuilder it works great, so maybe you can take a look at it RedDot-3ND7355 to make it fully working with your updated one and scetool. i have run it on all rebug versions, but only have flashed 4.21.2, so no guarantee for the others, but they also should work fine.

The task itself makes usage of the updated jailbait spoof task from euss, so it will spoof every entry in version.txt/index.dat and it will not update upl.xml. all other notes are remarked in the task, so it is selfexplanatory. it only includes the latest 4.55 version and a fun spoof of mine and can easily be updated.

And here my log for 4.46.1 (debug enabled):

Just a minor note on this, if you modify version.txt file with ps3mfw builder, the encoding changes to dos instead of unix. it works fine this way, but maybe there is a possibility to leave the encoding unchanged? ahh, and please ignore this rebug mode drex version. i have left it and it is only for personal usage...

Found now the problem. seems rebug have confused some things in their latest builds 4.41 and 4.46 some different question, but anybody knows what this secrect On/Off option from sysinfo is? it was medo from cmp who told me about it some time ago, but he also didn't know what it does. to get it, go under settings into system-settings->systeminformation hold L1+L2+R1+R2 and press select. there comes a On/Off message and it is turned off after every reboot.

Update #2: PS3MFW Builder 1.0.0 (Build Official Installer Release!

RedDot-3ND7355 and B7U3 C50SS are back to share the latest update for their PS3MFWBuilder (linked above). For those that don't recall, this tiny GUI allows users to build their own custom firmwares by ticking a few boxes.

As if the creation process wasn't simple enough, that ease now extends to the installation too. Build now includes a well-designed Windows installer to walk new users through the process. The one curious omission not found in this update is the ability to create firmwares with the 4.60 payload.

However, the developers do say that a revision is on the way to solve that shortcoming. Unless you know what you're doing, this is the kind of app to use at your own risk. Even though the building procedure is noob-friendly, any modified firmware installation technically has the potential to brick your system.

Just for fun's sake, the PUPs you make cannot be used for downgrading and do not run on OFW above 3.55.

Update #3: Update 3 of the Install Our MFW Builder.exe (linked above). This time we've updated the PS3MFW Builder have automatic configuration for your data folder which holds the keys and your TEMP folder as well!!

So settings are auto-corrected via install FROM simply installing. This includes your TEMP and data folder as stated before. Happy Building!!

About PS3MFW Builder:


For those that don't recall, this tiny GUI allows users to build their own custom firmwares by ticking a few boxes. As if the creation process wasn't simple enough, that ease now extends to the installation too. Build now includes a well-designed Windows installer to walk new users through the process.

Unless you know what you're doing, this is the kind of app to use at your own risk. Even though the building procedure is noob-friendly, any modified firmware installation technically has the potential to brick your system. The PUPs you make cannot be used for downgrading and do not run on OFW above 3.55.

Our Goal

Make people enjoy a better privacy from Sony, we do not support anti-piracy, tho the ps3 patches included in the tasks are capable of bypassing security to do so. I am truly sorry for that -Endless


[Register or Login to view code]

The Team

KaKaRoto - Founder
Code Monkeys - Founder
RedDot-3ND7355 - Developer
B7U3 C50SS - Developer
PSX Members - Contributors
Habib - Contributor

Update #4: Our team has just released a new update for the installer of PS3MFW Builder v1 which includes the latest build: 2.2.1! This new build has been set to fill your settings automatically for your needs and now installs on your C drive directly to remove errors such as black screen & packing errors!

PS3MFW updated for 4.65

* Default set for 4.65 basic/vanilla fully patched PUP like any Rogero, default HABIB:

11.B !!NEW NOBT/BD PATCH NOT ADDED!! >> Added the LV1 NoBD Patch from Zecoxao, Select from Lv1 tasklist if REQUIRED

[Register or Login to view code]

From littlebalup following the release of PS3 4.66 Firmware comes a 4.66_NO-FSM_patch.bin who states:

For those who need, I made a no-FSM patch 4.66 (linked above) with the details as follows:

  • Made out of OFW4.66 CoreOS with minimum lv0 and spu patchs to allow CFW installation.
  • Tested on NOR consoles (CECHL and 2K).
  • PS3DumpChecker should be updated with this patch as embedded one.

Thanks playerkp420 for PS3MFW tips. Of course, there is new CoreOS in this patch. So, do not update if you want stay jailbroken.

How to add NoBD patches to any CFW

If you don't have a Blu-ray drive, usually you can not play any games or use any apps. If you follow this video, you can add the noBD patches that allow playing apps without a married Blu Ray drive. Also, can add RSOD bypass and/or Remove Bluetooth Firmware.

I was going to list some thanks to users. But I did not want to forget anyone. So I will just say thanks and all credits go to anyone and everyone that has had anything to do with MFW Builder (past & present). Also thanks to all the developers of CFW and homebrew apps. Without you guys, we would be lost.

Update #4: From RedDot-3ND7355: Released Build update for 4.66 support!


  • Fixed the lv2 that was patching 4.65 and not above (now patches 4.66 too).

Report if any error occurs.

Update #5: From playerkp420: The LV2 dump I posted was of 4.70 MFW I made with toolboy2012's MFW Builder here: PS3 CFW Creator (Updated PS3MFW UI and Design)

The 4.70 MFW I made with the MFW Builder from the guide in the first post, REBUG Toolbox and multiman did not dump LV2 correctly. But the one I posted looks to have dumped correctly.

Playerkp420_4.70_MFW: PS3 4.70 Keys / Playerkp420-MFW-LV2-FW4.70.bin / Playerkp420_4.70_MFW_PS3UPDAT.PUP (196.41 MB)

MD5 = 8C21E25AB3F30CA5C3C9E8041ADBDC12

Use at your own risk. Only tested on CECH-2501A.

Update #6: From haxxxen: PS3MFW Builder Mod

Hi there. Due to some disadvantages and some minor issues with tools, i have made a mod of toolboy's ps3mfw builder release.

The major disadvantage of reddot's or toolboy's mfwbuilder, you cannot add, rename, delete files from pup file just as easy as with old original 0.2.1 builder. you have to do some annoying workaround to solve this problem and it was due to the tar re-creation routine he/they have used.

The other thing is, the created pups with their builders behave weird on installation. they work fine, nonetheless.. but if you exactly follow the installation procedure and notice the installation percents, the mfws created with either toolboy's or reddot's builder only go up to about 45 - 50%. this is not the case with original builder, where the pup installation percents go up almost completely.

This is a side effect of pkgtool from toolboy, which results in this behavior.

So i took the chance and made a hybrid of toolboy's mfwbuilder paired with original mfwbuilder. this one uses all of toolboy's tools and routines to extract pup, pkg and tar files, but it uses all the original routines to re-pack the pup files.

So no more problem on adding, removing, renaming files from pup with this builder version and there is also absolutely no permission problem from original builder.

Furthermore, i have changed the way of detecting and differentiating between old 3.xx and new 4.xx firmwares. this means, you can now modify this 3.55 dex downgrader and REBUG 3.55.4 CFW, or you can even create your own 3.55 downgrader, which have spkg support.

I also have modified all of glevand's 3.55 otheros tasks, to make it work with toolboy's patchtool. also i have ported all of his patches and they will work for 4.xx as well.

I have made myself now a 4.21OtherOs++ pup, and i do not have to go down to 3.55 anymore. i can resize with this pup on 4.21 just fine the hdd. for this i have added patches to either select 10gb or 22gb for linux vflash partition, which should be more than enough.

There are 3 folder with tasks, my personalized ones, toolboy's tasks and glevand's 3.55 tasks

Download: ps3mfw-mod.rar (3.9 MB) / ps3mfw-builder-0.2.1-mod (personalized)

Credits go to the original authors and of course reddot and toolboy! i have only modified most of the patches to be more dynamically. oh, and this version is for more advanced users and only at own risk!

Oh, and this version is for more advanced users and only at own risk. Small update: like mentioned, i have added now cinavia task, to patch out cinavia protection based on habib and mysis.

Running FSELF on CEX CFW

Finally, i have found now the missing last piece for running fselfs (fake signed elfs, mostly for debugging purposes signed with sdk tool) on a 4.xx cex cfw. yeeha!

I really have tried hard, to port this old mfwbuilder patch from ps3devwiki (found by mathieulh), but since 4.20 ofw, sony has changed appldr way too much and i couldn't find any corresponding patch address. the only thing i have found was the final branch, but not the function which has to be modified. it seemed to me, they have removed it completely, so no way to make it working again. the last ofw which still had this function intact, was 4.11.

This post made by Joonie on was the origin to my success and had all info already included:

My friend CMX recently shared his old reversing work that would be very useful in near future..

Currently I'm able to enable FSM mode with my old dongle and also can get out of FSM as long as CFW has MLT's lv2mem protection patch / a.k.a dev_flash whitelist patch.

It worked on 4.70 CEX/DEX fine, but I am having hard time installing PUP via old method.. we have a few idea of how we are going to use this.. I'll keep you guys posted if there is any success.

[Register or Login to view code]

Many thanks and credits go out to Joonie, who has posted all needed patches (found by cmx). unluckily there was one patch that has multiple occurrences, so you couldn't determine what has to be patched. it was the one for vsh.self, the most important, cause without it you cannot even start them and it will give that infamous 0x80029519 error straight away.

Probably many of dex users have encountered this error before, when trying to run npdrm_fself on a rebug cfw with dex target id. the problem there was that unsigned app patch from kakaroto, which has destroyed the ability to run npdrm_fselfs. on latest rebug it was circumvented with cobra, which has removed this (awful) patch.

And now i even have found a replacement for this patch on appldr thanks to that JFW 3.56 DH CFW, but i wasn't completely happy about this new patch and i have finally looked into vsh myself and have found that single patch that was missing.

I just have searched for that 0x80029519 error in ida and reversed it to the place where it branched and noticed a matching pattern for that patch that was posted by Joonie (which had about 430 occurrences!) so i could use the pattern from cmx there.

At first i have patched only vsh, to check any changes, and to my surprise it suddenly gave me another error message instead of this damn 0x80029519. so then i have applied all other patches and the result was my final goal. i could run a npdrm_fself signed app or a retail game resigned to fself without any problem or error message and that on a cex kernel with cex target id.

Here are all patches now based on 4.21, allow fself applications 4.21:


About using fselfs, it does not need any key resigning and just a simple cmd line to resign and compress them. on newer cfw there is not really need for it, but on older ones it gives so much more advantages than using retail signed ones.

Though, since 3.60+ ofw you will need the make_fself tools from 3.60+sdk, since there also has changed the signature or alike.

Just forgot to add, with fself you don't even need special fixes for lower 4.xx cfw. for example the game killer is dead also needed special fix for 4.21 to make it work, but if you run fselfs, you can use the unmodified original elf file and just resign to fself and it will run no matter what...

Quick port to latest 4.75 cfw (no guarantee!)

[Register or Login to view code]

I think i will add it to my mfwbuilder github soon, to make it work for every cfw.

I already have included original gameboot ac3 files from a 2.xx ofw, so i don't think it is needed to add the md5 sum here. it will automatically delete theme file from flash and add those two files into correct flash package (each next to matching coldboot file).

Though, to make the animations properly work, you have to modify rco main xml yourself (custom_render) and change values there. the one i am using has quite a fancy looking animation, and it will go straight into screen, and then it will even return a little bit. in the video it is not visible and i haven't catched it.

I was always into this mfwbuilder stuff and loved it from the beginning. to me it is for example, like modifying windows with nlite.

Now that i have mentioned the deletion of theme file, i have to add a check for this file, otherwise the task won't work for rebug cfw.

I have now added fself patch task working for every cfw. i also have added 3.41 and 3.55 old appldr fself patch into it, whereas i have fixed 3.41, cause the one listed on ps3devwiki is bad and points to completely wrong place. please remove it from there !!!

I also have fixed gameboot and patch epilepsy tasks (linked above).

Just a small update, but for now probably the last... i have added appldr patch for unsigned apps on 4.21 and also a small description of tasks.

Oh, and i also have updated my cobra 4.21 rex ports with standard cobra and ps3mapi cobra. it will fully work on windows when psl1ight is installed and configured.

Stupid github does not like bin folders or vsh.self.swp. i had to rename them and reupload... tzzz

From pinky: here are the gameboot audio files for anyone else interested:

Download: gameboot_audio.rar

They were taken from ofw 2.76. I had decrypted the pup quite a while ago while studying the gameboot audio. there's also a coldboot2 audio which are 782 kilobytes which eventually became the normal coldboot's afterwards.

coldboot 1's are 705 kilobytes. I believe the reason both coldboot 1 and the gameboot were removed was due to space. the following update was when the 16MB nor consoles were released. that's just a guess really.

Finally, for v4.75+ Keys and MFW builds see HERE.

I have made a nice update to my mod version. i have added lv2memory protection removal patch based on REBUG (thanks to Joonie)

I also have now added a task to enable gameboot sound and animation back. it was removed since 3.00 ofw, but (found on ps3devwiki, but i think it was) mysis has found now the patch to re-enable it back.

Here a small video i have made to get an idea of it. sorry for low quality and low sound, but you can at least hear it:

Download: APDC0315.MOV

Update #7: Playerkp420 4.75 PS3 MFW / Playerkp420 4.75 DualBoot PS3 MFW / Playerkp420 4.75 v1.01 CFW by playerkp420

PS3MFW Builder 1.0.0 (Our MFW 1.0.0) Build 2.0.0 is Released

PS3MFW Builder 1.0.0 (Our MFW 1.0.0) Build 2.0.0 is Released

PlayStation Follow us on Twitter, Facebook and join us at our new site WWW.PSXHAX.COM!

#42 - misiozol - January 24, 2016 // 8:35 pm
misiozol's Avatar
U make it just to easy , this new generation is just asking no effort what so ever from their side , answer was just couple clicks away from him

Resume discussion in the new ongoing thread here:

#41 - PS4 News - January 24, 2016 // 6:49 pm
PS4 News's Avatar
Quote Originally Posted by Zwei View Post
Who give a download address thank you PS3MFW Builder v1.0.0 (Build ?

Thank you for my special needs.

I merged your post into our ongoing thread, some mirrors from the main article are still working... here is one of them for ya

#40 - misiozol - January 24, 2016 // 12:27 pm
misiozol's Avatar

there you go very easy

#39 - Zwei - January 24, 2016 // 11:33 am
Zwei's Avatar
Who give a download address thank you PS3MFW Builder v1.0.0 (Build ?

Thank you for my special needs.

#38 - imOldSchoolMods - January 19, 2016 // 10:11 am
imOldSchoolMods's Avatar
thanks nice work

#37 - Sarameya23 - December 15, 2015 // 9:00 pm
Sarameya23's Avatar
I will try it! thank you

#36 - ragexmaxima - December 15, 2015 // 2:19 pm
ragexmaxima's Avatar
Thanks, for sharing.

#35 - MsKxModdingXC62 - October 9, 2015 // 5:41 pm
MsKxModdingXC62's Avatar
Oh ! Thank you very much ! ♥
I love you !


#34 - PS4 News - September 24, 2015 // 9:34 am
PS4 News's Avatar
Thanks again B7U3 C50SS, I've updated the v1.0.0 and v2.0.0 articles with the new mirror and +Rep!

PS: I will attach the .exe as a .rar file to this post in case the mirrors go down again as requested.

I also added PS3MFW-Builder-master v0.2.6.0 by haz367 HERE as well for those interested.

#33 - B7U3 C50SS - September 24, 2015 // 9:10 am
B7U3 C50SS's Avatar
Hey! what the heck! my link went dead AGAIN! Here I've re-uploaded it on a brand new account on mega okay? I'm going to check daily for it to go down from now on. if it's down i'll re upload. until there's a more permanent fix.

ACTUALLY can you just @ PS4 News being the forum admin just hotlink the setup file as an Attachment? please it seems that the file keeps getting taken down from my service. somehow.

hmm here's a new link. Install Our MFW Builder.exe

Here's to hoping it STAYS ONLINE!