It took months, but in the end the developer Nathan Martin kept his word by publishing the third and last version of the Evilnat 4.89.3 PEX/D-PEX custom firmware with Cobra 8.3 patch.

The PEX/D-PEX custom firmware derives from the porting of the DEX kernel and some modules present on the Rebug 4.84 custom firmware. A titanic work that today allows us to replicate the same characteristics.

This custom firmware also allows access to both kernels in the LV2, both CEX and DEX through the plugin xai_plugin.sprx, and without the need to use external applications such as the Rebug Toolbox .

From the custom firmware you will also have access to the ProDG Target Manager , the official tool used by developers to debug software using the Target Manager API (TMAPI).

The tool can be used to view and change the values of variables on programs running on the console, for real-time modding (RTM), and for basic debugging.

Installation Guide

Spoiler: Setup Guide	Select Show

Characteristics

Made in 4.89 OFW (CEX).
Ported kernel and some modules from OFW 4.84 DEX.
Made manually without automatic tools.
PSN/SEN enabled.
Fixed 272/480 layouts from OFW 4.89.
Disabled deletion of unsigned act.dat and .rif files.
Unsigned act.dat and .rif files allowed.
Allowed to run unsigned applications.
Compatibility with FSELF.
Demo unlock C00.
License check LIC.EDAT disabled.
Can be installed over 3.55 OFW.
Can be installed beyond +3.56 OFW (bguerville Toolset).
It can be installed on any CFW CEX.
COBRA 8.3 added and enabled by default.
Full compatibility with PS2 games.
Possibility of Downgrading from any CFW with active QA Flags.
QA Flags active if previously enabled.
Epilepsy message disabled on startup.
Compatibility with PSX/PSP/PS2 games in ISO.
Compatibility with PS3 games in ISO/JB folder format.
Compatibility with ReactPSN.
Viewing temperatures in XMB In-Game on PS2 games.
RSOD screen bypass.
BSOD screen bypass.
PS3_GAME/app_home.
XMB game screen.
Added Package Manager.
Corrected CoreOS Hash Check to prevent Brick on downgrade consoles without dehashing.
Patched to remove LV2 protection.
Peek and Poke (LV2).
Peek and Poke (LV1).
CINAVIA protection disabled.
Option to sort games by name and date.
Allow using third party controllers in recovery menu.
Compatibility with other operating systems.
Update disabled by OFW PUP in recovery mode.
Dual boot compatible.
Allowed installation of retail PKG on DEX.
Allowed to install pseudo-retail PKGs.
Enable the [★Unlock], [★Block] and [★Delete] options in Trophies.
Compatibility with Remote Play.

Cobra 8.4

Failsafe Cobra stage2 (by bguerville/aldo).
Reset Syscall CFW without restarting by simply going to ‘Settings > System Update’ on XMB (by aldo).
Integrated Dynamic Control FAN (to control the fan when webMAN is unloaded) (by aldo/Evilnat).
Support photo GUI integration with webMAN MOD (mount games from “Photo” column) (by aldo/DeViL303).
Get/Set FAN Speed (by aldo).
Enable/disable features: Photo GUI, Restore Syscalls (by aldo).
Opcode to create Syscall CFW (6, 7, 8, 9, 10, 11, 15, 35) (by aldo).
Operation code to create license (RIF) (by Evilnat).
Updated ps3mapi_load_process_modules to load custom modules and system modules (by haxxxen).
Added ps3mapi_get_process_module_info.
Increased the maximum number of map routes from 24 to 32 (by aldo).
Added sm_get_temperature patch in kernel (by Evilnat).
Added sm_get_fan_policy patch in kernel (by Evilnat).
Added sm_set_fan_policy patch in kernel (by Evilnat).
Fixed control FAN payload, avoid loading previous mode (by Evilnat).
Disable stage2.bin when loading recovery menu (from haxxxen).
Fixed maximum FAN speed after crash (by Evilnat).
Fixed black screen in games ported by CFW2OFW (by Evilnat).
Added sm_ring_buzzer with single_beep, double_beep and triple_beep (by Evilnat).
Skip creating license (ref) if it already exists (by aldo).
Added cellFsMkdir symbol (by Evilnat).
Added constant FAN speed while a PS2 ISO is being launched (by Evilnat).
Creating a fake act.dat when launching a PSN game (by Evilnat).
Block access on PSN/SEN when CFW system calls are enabled (by DeViL303).

xai plugin improvements

These options are found on the Network tab of XMB under the [★ Custom Firmware Tools] option

1 of 12

Shutdown options

Soft Restart : Restart the PS3 (Soft).
Hardware Restart: Restart the PS3 (Completely).
LV2 Restart: Restart the LV2.
Shut Down: Turn off the PS3.

File Manager

Active Devices: Manage all active partitions.
Internal Hardisk 0: Manage PS3 files in /dev_hdd0.
Internal Hardisk 1: Manage PS3 cached files in /dev_hdd1.
USB Mass Storage Devices: Manage files on your USB devices.
Memory Card: Manage memory cards.
Optical Disc: Manage optical discs.
Internal Flash Memory: Manage PS3 internal flash files.

Basic tools

Show Total PS3 Usage: Shows the total days the PS3 has been turned on, the number of times it has been turned on and off.
Fan Speed: Shows the current fan speed.
PS3 Temperature (Celsius): Shows the current temperature of the CPU and RSX in Celsius.
PS3 Temperature (Fahrenheit): Shows the current temperature of the CPU and RSX in Fahrenheit.
Check GPU/VRAM Clock Speed: Check the current GPU/VRAM clock speed.
Show IDPS: Show the current IDPS.
Show PSID: Show the current PSID.
Show IP: Show the current IP if it exists.
Change Coldboot: Toggle between custom/original coldboot.raf.

Basic Tools > xRegistry Tools

Backup xRegistry.sys: Create a backup of xRegistry.sys in /dev_usb or /dev_hdd0.
Assign Keys: Toggle the and buttons .

Basic Tools > Led Tools

Disabled: Turn off the PS3 power LED.
Red (Static): Sets the PS3 power LED to solid red
Green (Static): Sets the PS3 power LED to solid green.
Yellow (Static): Sets the PS3 power LED to solid yellow.
Red (Slow Blink): Sets the PS3’s power LED to blink red slowly.
Green (Slow Blink): Sets the PS3’s power LED to blink green slowly.
Amber (Slow Blink): Sets the PS3’s power LED to blink amber slowly.
Red (Fast Flash): Sets the PS3’s power LED to flash red quickly.
Green (Fast Flash): Sets the PS3’s power LED to flash green quickly.
Yellow (Fast Flash): Sets the PS3’s power LED to flash yellow quickly.
Yellow + Green (Fast Flash): Sets the PS3’s power LED to fast yellow + green flash.
Yellow + Red (Fast Flash): Sets the PS3’s power LED to fast flash yellow + red.
Yellow + Green (Slow Blink): Sets the PS3’s power LED to a yellow + green slow blink.
Yellow + Red (Slow Blink): Sets the PS3’s power LED to a yellow + red slow blink.
Rainbow Mode: Set the PS3 power LED to rainbow mode.
Special Mode 1: Sets the PS3 power LED to special mode 1.
Special Mode 2: Sets the PS3 power LED to special mode 2.

Basic Tools > Buzzer Tools

Single Beep: Generates a single beep with the internal buzzer.
Double Beeps: Generates a double beep with the internal buzzer.
Triple Beeps: Generates a triple beep with the internal buzzer.
Continuous Acoustic Signal: Generates a continuous beep with the internal buzzer.

Fan tools

Fan Control Mode: OFF: Disables Cobra’s Control FAN.
Fan Control Mode: SYSCON: Enables the PS3’s SYSCONs to control the fan speed.
Fan Control Mode: MAX: Sets Cobra FAN speed to 0xFF.

Fan Tools > Dynamic Fan Control

Maximum Temperature: 60°C: Dynamically sets the fan speed to keep the system at a maximum temperature of 60°C.
Maximum Temperature: 65°C: Sets the fan speed dynamically to keep the system at a maximum temperature of 65°C.
Maximum Temperature: 70°C: Sets the fan speed dynamically to keep the system at a maximum temperature of 70°C.
Maximum Temperature: 75°C: Sets the fan speed dynamically to keep the system at a maximum temperature of 75°C.

WARNING: Some PS3 cannot reach/maintain some optional temperatures, use with caution.

Fan Tools > Manual Fan Control

Manual Speed: 40%: Set the fan speed statically to 40% (0x67).
Manual Speed: 45%: Set the fan speed statically to 45% (0x75).
Manual Speed: 50%: Set the fan speed statically to 50% (0x80).
Manual Speed: 55%: Set the fan speed statically to 55% (0x8E).
Manual Speed: 60%: Set the fan speed statically to 60% (0x9B).
Manual Speed: 65%: Set the fan speed statically to 65% (0xA8).
Manual Speed: 70%: Set the fan speed statically to 70% (0xB5).
Manual Speed: 75%: Set the fan speed statically to 75% (0xC0).
Manual Speed: 80%: Set the fan speed statically to 80% (0xCE).
Manual Speed: 85%: Set the fan speed statically to 85% (0xDA).
Manual Speed: 90%: Set the fan speed statically to 90% (0xE7).
Manual Speed: 95%: Set the fan speed statically to 95% (0xF4).

ATTENTION: The chosen speed will be static, it will not be changed automatically at any time.

Fan Tools > PS2 Fan

PS2 Fan Mode: OFF: Disable fan control on PS2 games.
PS2 Fan Mode: SYSCON: Enables the PS3 SYSCONs to control the fan speed on PS2 games.
PS2 Fan Mode: 40%: Set fan speed to 0x66 on PS2 games.
PS2 Fan Mode: 50%: Set the fan speed to 0x80 on PS2 games.
PS2 Fan Mode: 60%: Set the fan speed to 0x9A on PS2 games.
PS2 Fan Mode: 70%: Set the fan speed to 0xB4 on PS2 games.
PS2 Fan Mode: 80%: Set the fan speed to 0xCE on PS2 games.
PS2 Fan Mode: 90%: Set the fan speed to 0xE8 on PS2 games.

ATTENTION: There is no Control FAN in a PS2 game, please select with caution.

QA Tools

Check QA Flags: Check if QA flags are enabled or disabled.
Enable QA Flags: Enable QA flags.
Disable QA Flags: Disable QA flags.

Cobra tools

Cobra Information: Shows the current Cobra information.
Check Syscall 8: Check the Syscall 8 status of Cobra.
Create Syscalls: Create system calls 6, 7, 8, 9, 10, 11, 15 and 35
Enable PSN Security: Block PSN access when system calls are enabled.
Disable PSN Security: Enable PSN login when system calls are enabled.
Enable FTP: Enable FTP connection in port 21.
Disable FTP: Disable FTP connection.
Enable Re-enable Syscalls: Allows system calls to be restored via “System Update”.
Skip license creation: Skip overwriting the license file (RIF) if it already exists
Create License File: Create RIF licenses from RAP files from “x:\exdata”.
Enable/Disable Plugins: Enable/Disable Cobra plugins from /dev_hdd0/boot_plugins.txt.
Switch Cobra Version: Switch between release and debug version (reboot required).
Enable/Disable Cobra Mode: Enable or disable Cobra (reboot required).

PSN tools

Disable Syscalls: Disable system calls and remove history files.
Target ID Spoof: Spoofs the current TargetID in LV2 with the TargetID of EID5.
IDPS Spoofing: Spoof IDPS in LV2 with a valid IDPS from “/dev_usb/IDPS.txt”.
Spoofed PSID: Spoof PSID in LV2 with a valid PSID from “/dev_usb/PSID.txt”.
Show accountID: Show the account ID of the current user.
Create accountID: Create a fake accountID for the current user in xRegistry.
Override accountID: Overrides the current user’s account ID with a fake one in xRegistry.
Remove accountID: Removes the user’s accountID in xRegistry.
Account Activation: Create the act.dat file in the current local account.
Activation file backup: Create a backup of act.dat in /dev_usb or /dev_hdd0.
Account Deactivation: Permanently delete the current user’s act.dat activation file.
Convert Saves: Converts save data from “/dev_usbXXX/PS3/SAVEDATA” to your own save data.

Dump tools

View Log: http://localhost/dev_hdd0/tmp/cfw_settings.log (webMAN MOD is required for this function).
Clean Log File: Reset the /dev_hdd0/tmp/cfw_settings.log file.
Save IDPS Dump: Save IDPS to log file.
Save Dump PSID: Save PSID to log file.
Dump LV2: Dump LV2 to /dev_usb or /dev_hdd0/tmp.
Dump LV1: Dump LV1 to /dev_usb or /dev_hdd0/tmp.
Download Flash: Download NOR/NAND Flash to dev_hdd0/tmp or /dev_usb.
Dump RAM: Dump RAM to /dev_usb or /dev_hdd0/tmp.
Download SYSROM: Download SYSROM to /dev_usb or /dev_hdd0/tmp.
Dump EEPROM: Dumps 256 bytes of EEPROM data from offsets 0x2F00, 0x3000, 0x48000, 0x48800, 0x48C00 and 0x48D00 to /dev_usb or /dev_hdd0/tmp.
Dump ERK: Dump the eid_root_key into /dev_usb or /dev_hdd0/tmp.
Dump error log SYSCON: Dumps the current SYSCON error log to /dev_usb or /dev_hdd0/tmp.
Download Token Seed: Download the current token seed to /dev_usb or /dev_hdd0/tmp.
Log KLicense Usage: Save the file name and klicensee in the log file.
Log Secure File ID usage: Writes the save data name and key ID file to the log file.
Save Disc Hash Key Dump (Hash Key): Retrieves the disc hash key from an ORIGINAL game disc.

OtherOS tools

Resize VFLASH/NAND regions: Resize VFLASH/NAND regions 5 to allow for OtherOS.
Install Petitboot: Install Petitboot to VFLASH/NAND regions 5 from USB device.
Set OtherOS boot flag: Restart the PS3 and boot OtherOS.
Set GameOS startup flag: Fix problems loading PS2 games when OtherOS startup flag is set.

CEX2DEX tools

Convert to CEX: Convert PS3 to CEX/RETAIL with eid_root_key from /dev_usb or /dev_hdd0.
Convert to DEX: Convert PS3 to DEX/DEBUG with eid_root_key from /dev_usb or /dev_hdd0.
Swap Kernel: Swap between CEX and DEX kernels.
Check TargetID: Check the current TargetID from EID0 and EID5.
Toggle host info on XMB: Enable/disable host info on XMB.
Toggle XMB Mode: Switch between CEX and DEX XMB.
Toggle Debug Settings: Switch between CEX and DEX debug settings.
Show PS3 Info: Shows the current firmware, kernel, TargetID, VSH, XMB host and debug settings.

Service tools

View Native Firmware: View the minimum downgrade version.
File System Checker: Restarts and allows you to check and repair the file system.
Rebuild Database: Restarts with the database rebuild flag set.
Recovery Mode: Reboot into recovery mode (not supported on NAND models!).

Service Tools > Advanced Service Tools

Fix RSOD: Re-initialize VTRM-Region to attempt to fix RSOD.
Enable Factory Service Mode: Enter/Exit Factory Service Mode (DO NOT INSTALL CFW ON FSM).
Blu-ray Drive Remarry: Requires: Log into FSM and copy the “eid_root_key” to /dev_usb.
Toggle Hard Drive Space: Unlock/Restore 8% more total internal HDD space of PS3.
Show ROS Bank: Shows the active ROS bank.
Check 8th SPE: Checks if the 8th SPE is currently enabled or disabled.
Enable/Disable 8th SPE: Enable/Disable the 8th SPE.
Enable VSH Debugging: Enable debugging of vsh.self.
Load LV2 kernel: Load the lv2_kernel.self file from /dev_usb000 or /dev_flash.
Update xai_plugin: Update xai_plugin by downloading and installing a PKG from Evilnat’s xai_plugin repository.

Basically there are 4 different Custom Firmware together with 4 variants

CFW PEX (port DEX modules and kernel from OFW DEX 4.84, CEX kernel by default).
CFW D-PEX (port DEX modules and kernel from OFW DEX 4.84, DEX kernel by default).
CFW CEX (Default CFW CEX without DEX and DEX Kernel modules).
CFW DEX (Default CFW DEX with some DEX and DEX Kernel modules).

Variants (for all CFW bases)

noBD (for PS3 with or without a damaged BD Drive).
noBD + noBT (for PS3 without or with BD Drive and Bluetooth).
noBT (for PS3 without or with damaged Bluetooth).
Overclocked (GPU and VRAM overclocked to 600MHz/750MHz).

Save conversion tutorial

WARNING: This option will overwrite existing save data in dev_usbXXX, use with caution.

Download the save from another console or account for your favorite game.
Load the save data onto a USB device in X:\PS3\SAVEDATA(device must be formatted in FAT32).
Connect the device to the USB port of the PS3 console.
Select Network tab > [★ Custom Firmware Tools] > PSN Tools > Convert Savedata.
Please wait until the conversion is finished.
Once done, copy the converted save data via XMB “Saved Data Utility (PS3)”.
Start the game and load the new save data.

Tutorial for creating the act.dat file

WARNING: The accountID is linked to the save data and trophies, so if the current user already has a valid accountID and you override it, you will not be able to use the trophies and save data on that account until the original accountID in xRegistry.sys is restored. It is recommended to use an empty account without any trophies and save data or an account without an accountID.

To create a fake act.dat, you need to enable Cobra 8.3 patches while the console must have at least one account with a valid accountID and run a game that requires a RIF/RAP license file.

Cobra will look for a valid accountID in all existing accounts and create the file act.datwhile the game is launched via XMB. If no accountID is found, the file act.datwill not be created.

If you wish you can manually create a fake accountID (like reactPSN), to do it go to Network > ★ Custom Firmware Tools > PSN Tools and choose between “Create accountID” or “Overwrite accountID” (be careful with the last option because if you already have a fake/real account ID, this will be overwritten).

It is recommended to use these options in an account that does not have an ID. The PS3 will restart if all went well.

The tutorial would be as follows:

Download the PSN game purchased from PS Store.
Put the game RAP file in X:\exdataor /dev_hdd0/exdata.
Launch the purchased PSN game.
Cobra will check if any of your PS3 accounts have an accountID.
The fake file act.datwill be created during game launch.

Now you have a fake act.datand your local account is activated. The file act.datworks for every local account, only one file is needed for all accounts.

Block access to PSN

This method was developed by DeViL303, it will work only with Cobra enabled, Cobra will block access on PSN/SEN while CFW syscalls are enabled, to enable it again you need to disable cfw syscalls completely (you can do it with webMAN MOD, psnpatch, SEN Enabler, etc…).

If you intend to disable this feature, simply use the Cobra Tools > Disable PSN Protection option and you will be able to log in with system calls enabled. To enable it again use the Cobra Tools > Enable PSN Protection option.

Warnings

The account ID is directly linked to the save data and trophy data. If you have any trophies or save data in your current local account, IT WILL BE CORRUPTED after setting a FALSE accountID. To fix this, copy the save data to the root of a USB device, convert it and copy it back via XMB in the “Game” tab. To fix the corruption in trophies you need to delete them. It is highly recommended to do this on a local account with no trophies/save data.
The FAN speed is constant in a PS2 game, BE CAREFUL when selecting modes as it will not change after the PS2 game is loaded, it is also static when choosing a mode in the “Manual Speed” option. All running speeds in xai_plugin must maintain correct temperature in CPU and RSX.
Don’t manually rename the file vsh.selfand ALWAYS use the option for it in xai_plugin, it can cause PS3 can’t load XMB menu when you have full version of webMAN MOD, DEX Kernel and CEX vsh.self. The CFW has a protection to avoid this.
The Target Manager will show SDK 4.8.4 while the PS3 is in DEX, this is normal and is because I ported the modules from OFW 4.84 DEX to 4.89, fixed them to work on 4.89 but not to show the 4.8.9 version.
If you want to install OtherOS on PS3 internal HDD, you need to go to the recovery menu first and select [Reset PS3 System], this will format the HDD and create a partition for OtherOS. Remember to backup all your data first.
DO NOT TRY TO SWAP THE KERNEL WHEN LOADING AN EXTERNAL KERNEL FROM USB/FLASH!! This may cause freezes and a hardware flasher may be required to fix the PS3.
You can always download Cobra/plugins if you have any problems using them, for this just go to the recovery menu and then restart your PS3, this will disable both.
It is advisable to ALWAYS activate the QA Flags, it is very important, it allows you to install CFW from previous versions to the one installed and also avoids problems.
If you are unable to download or create a game disc ISO in multiMAN, go to the mmCM tab and select [Switch to multiMAN mode], this will restart multiMAN and you will be able to download/create a disc ISO.
OtherOS on PS3 with NAND is very dangerous if you don’t know what you are doing (e.g. using the wrong image to install petitboot), it can cause bricking and the only way to fix it is with a hardware flasher. PLEASE USE IT CAREFULLY!
Make sure you install the correct image for OtherOS. xai_plugin also tells you which image should be installed. For NAND it is necessary dtbImage.ps3.bin.minimaland for NOR dtbImage.ps3.bin. If the wrong image is installed, it can hang on NAND, needing a hardware flasher to fix it, in NOR you can fix it by formatting the hard drive.
If your PS3 console has a noBD CFW (in any of its variants) and the latest version of webMAN MOD (1.47.42 at the time of writing this guide), it is possible that your PS3 cannot read an external device ( /dev_usb000, /dev_usb001, …) in the next two minutes. To fix this, go to WebMAN Setup page , click webMAN MOD Setup and check the noBD patch and restart your PS3, now it could read external devices.
Enable FTP and Disable FTP can randomly fail, if you want to use one please wait a few seconds before using it again. It also happens with the Check GPU/VRAM clock speed option , these values are stored in LV1 and sometimes the PS3 doesn’t store them and can fail. If this happens, restart the PS3 until these values are present in LV1.
In the PEX and D-PEX version some of the debug options by pressing the triangle are missing because one/some file hasn’t been ported yet (requires a lot of searching with XMB layouts, I fixed some but some not, for example, trophies entries are messed up), these options are (maybe more):
- ★ Check.
- ★Owner Information.
- ★Cancel Purchase.
- ★ Performance Bars.
- ★No memory limit.
The CFW is meticulously tested and no bugs have been found, but that doesn’t mean it’s error free. If this happens, please contact me as soon as possible so I can fix it.

The source code of the Cobra 8.3 patches and the xai_plugin module can be found in the Github repositories: