PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

June 24, 2011 // 3:40 pm - Shortly after the PS3 QA Flag Method was revealed comes the QA Flagging Tools in PKG format alongisde a CFW355-OTHEROS++-SPECIAL.PUP which is confirmed working via QA Auto Flag with Flash, Run, and Reflash to PS3 CFW (Kmeaw, Waninkoko, etc) support coming soon.

Download: PS3 QA Flagging Tools / PS3 QA Flag Reset / PS3 QA Flag Extra (Advanced) / PS3 Get Applicable Version / PS3 Get Token Seed / PS3 CFW355-OTHEROS++-SPECIAL.PUP

For those curious, the PS3 QA Flag Extra (Advanced) has a few other flags / tokens set but it's not for general use.


What we have tested on so far:

  • 3.55
  • 3.41


Set QA Flag to Standard:

  • Run qa_flag.pkg if you hear a beep, it worked. If not dump your debug messages via udp_printf on linux and send to us to fix.
  • Reboot the ps3
  • Go to network settings (Do not enter it) and hit or hold
  • L1+L2+L3+R1+R2+down on the dpad
  • QA auto flagging is now done.

Reset QA Flag to Default:

  • Run reset_qa_flag.pkg
  • If you hear a beep it worked. If not dump your debug messages via udp_printf_client in linux and send it to us.
  • Reboot the ps3
  • QA Flag is now set to default (Off) Your PS3 is now normal again.

Git Repository:


PS3 Downgrade:

Tools Needed:

  • qa_flag_extra.pkg
  • Firmware you want to downgrade to (3.41, 3.15).

Notes: These tools WILL format your PS3. Any and ALL PSN / downloaded data will be erased! The lowest firmware you can go to is what was originally on your PS3 originally!

If your ps3 came with 3.41 then that's the lowest it can go. If it came with 3.15 again thats as low as it can officially go! be warned if you go lower, you WILL brick!

Installation Process:

1. Install CFW355-OTHEROS++-SPECIAL.pup (Doesn't matter what version you are 3.41, 3.50 etc etc)
2. Install qa_flag_extra.pkg
3. Run qa_flag (It will show up as this, that is fine)
4. If you hear the beeps, continue. If you don't hear the beeps go to step 10
5. Reboot
6. Go into recovery menu and Update your ps3 with the firmware that you want (3.15, 3.41 etc)
7. Have it install and now you're done. You just successfully downgraded your PS3.

They have also stated via Twitter that they are working on a 3.56+ PS3 Firmware exploit, to quote:

Currently our main developers are working on 3.55 and below, I am working on a exploit for 3.56+ however. Anything key related and 3.56+ is currently not going to be answered. News will be released as we figure it out, If it works we will say so. It's still going to be rough to do anything though. We might save it for the new 3000 series of the ps3 though.

Finally, in related news varaques has made available what he calls Varaques 3.55 PS3 CFW based on PS3MFW Builder which features the following:

  • Other+OS Support
  • Q&A Flag Support
  • Custom Boot Logo
  • Custom Theme
  • 3.66 Spoofed
  • LV1 & LV2 Patched
  • Run Unsigned PKG's & More

Shortly following, he made available Kmeaw CFW with Other+OS and QA Flag Support via MFW Builder. Simply put it in the root of your PS3 storage device as follows : PS3/UPDATE/PS3UPDAT.PUP

PS3 QA Flagging Tools and CFW 3.55 OtherOS++ Special PUP

PS3 QA Flagging Tools and CFW 3.55 OtherOS++ Special PUP

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew.

#45 - lolwaow - May 29, 2011 // 5:25 am
lolwaow's Avatar
I bring you (what I think) are the keys. I found these from a user named Slynk:

[Register or Login to view code]

*runs away before the lawsuits come flooding in*

hmac to make the 20 byte digest at the end of the token and erk/iv to decrypt/encrypt it with aes256cbc.

2 more steps to go. Need the button combo and what to change in the dummy token.

Also in the spirit of sharing, the dummy token decrypts to:

00 00 00 01
... (all 00)
20 bytes of digest

It's 80 bytes long.

More about the key from that user Slynk, apparently this is the new dummy code, anyone care to verify?
EDIT: There's no ecdsa so there's no public private. The other key is the hmac. Man must I be tired >.<

Already decrypted it. And I know the token has 20 bytes of hmac-sha1 at the end before encryption. ^^

But I still need: "What to change to make an "advanced" token" and "The button combo to test it out". ^^

EDIT: btw it's aes256cbc, sames as self crypto for the curious. Yes, it's the hmac key.

The encryption is straight forward, very easy to figure out, and obviously not the hard part.

As to the dummy token, it's nothing more than the first few bytes of the EID0 followed by 00s (which I call flags array) and a hmac-sha1 of the actual token.

The hard part is knowing what values to change, and what to.

#44 - NTA - May 17, 2011 // 3:03 am
NTA's Avatar
lol that guy... leaving... LOL!

Fake Free Space- Hilarious

#43 - syphonlord - May 16, 2011 // 6:36 pm
syphonlord's Avatar
Yeah until some one else releases the keys then he will reappear back on the scene to try and take all the glory.

#42 - PS4 News - May 16, 2011 // 12:40 am
PS4 News's Avatar
Quote Originally Posted by alwayshungry View Post
I wonder if we got to him this time! It seems he opened this ears!

I'd say common sense more than anything else got the best of him... if he's 26 years old and sitting on the Internet playing "Sony hacker" for attention it's quite sad indeed, perhaps he realized the only thing he can gain from that is being hit with a lawsuit these days.

From IRC:

but I stopped doing ps3 stuffs anyway
starting today
I anounced it on twitter
you won't be comin' back to PS3?
ps3 is boring
what would I be comming back for ?

#41 - alwayshungry - May 15, 2011 // 11:19 pm
alwayshungry's Avatar
Mathieulh: Message to everyone following me, I am done twitting about Sony related stuff, for good this time. That's a personal decision.
3 hours ago

I wonder if we got to him this time! It seems he opened this ears! HAHAHHAHAHAH

#40 - elser1 - May 14, 2011 // 8:25 pm
elser1's Avatar
my 40 gig is the metal gear solid limited edition console also so i guess its QA flagged.. if this helps anyone pm me... because i sure don't know what to do with it.. LOL.

#39 - Preceptor - May 14, 2011 // 5:18 pm
Preceptor's Avatar
Here goes another holy grail quest... I'm not putting my hopes up for this. Math won't release, the people who know enough to release it won't due to either moral concepts or fear of Sony.

So IMHO we're out of luck and just back to the pre psjb days if we keep babbling nonsense ideas on how to do this.

#38 - momipopi - May 14, 2011 // 3:59 pm
momipopi's Avatar
i hope it will leaked to the net soon...

#37 - almoront - May 14, 2011 // 1:36 pm
almoront's Avatar
Even if he never releases anyting ever again and disappears there is still what to gain from his findings. He has informed us of an existing hole or flaw which gives hope and a reason for those with knowledge to poke further instead of giving up or looking in the wrong places.

it's like when you're starving and someone tells you food exists somewhere inside of a house you may have given up but now knowing it is there will make you go and search for it.. any information is always welcome.

#36 - uklee - May 14, 2011 // 12:20 pm
uklee's Avatar
same old same with this guy, won't put it past me he works for them why he won't share out and he get to no stuff before everyone.

p.s love this commnet didn't take nostradamus to see that coming...