This is a hardware modchip for Sony PlayStation 3. By using Raspberry Pi Pico (RP2040), It is possible for non-CFW compatible models to boot qCFW.

If you like my work, please consider support me at Ko-fi!

All 25xx series

All 30xx series

All 4xxx series with NOR flash

All 4xxx series with eMMC flash

You still can't install CFW PUP, so new variant of CFW must be made. This is called quasi-CFW.

It is heavily based on Evilnat PEX CFW. And will support every feature except: Dumping eid_root_key.

HDD Decryption is possible without root key. See Dumping HDD Key section

Cobra must be active at all times or some feature will not work properly.

For some unknown reason, When you turn on the console using wireless controller it won't sync.

Workaround has been implemented. If you turn the console on using wireless, it will always power cycle once before fully boot.

But controller sync will work fine.

DEX mode is fully supported. But any kind of firmware installation or update is not possible while in this mode.

This means if you somehow need to reinstall the firmware such as corrupted HDD, you are stuck.

To recover, use BANKSEL pin on the modchip to go back to OFW.

• You can't install firmware directly from XMB or you will get 80029c9c error. You must use safe mode
• Because of strict timings, 100% success rate is not possible even with perfect wiring. This may affect PS2 mode.
• When install or replacing HDD, Go back to HFW first! or it may cause problems.

When you dump eMMC, you will see that it says complete or incomplete.

"incomplete" means first 0x40000 bytes of dump is missing because it can't read with hen.

If your eMMC died later on, this dump is not enough to recover it.

By successful boot with modchip at least once, this region will be copied to somewhere that can be read by hen. So it will become "complete" automatically.

You can then use this complete dump to transplant eMMC chip.

FOR FIRST INSTALLATION, BACKUP FLASH FIRST!!!. IF SOMETHING GOES TOO WRONG AND YOU DON'T HAVE BACKUP, YOUR CONSOLE MAY BE PERMANENTLY BRICKED

1. Prepare the USB drive by DELETING old qcfw folder if existed, DO NOT OVERWRITE!! then download qCFW and extract it into your drive like this:

2. Install PS3HEN 3.6.0 or later
3. Plug your USB drive into RIGHTMOST USB port of your ps3
4. On XMB, Enable HEN then use Network -> Hybrid Firmware Tools -> qCFW Options -> Install Stagex option. It must show Success
5. If not already, Install the modchip by following Installation (Hardware) section
6. After modchip installed and power plugged in, wait until LED of modchip becomes solid. If it doesn't solid after a while, check SC_RX/SC_TX wire
7. Turn on the console. modchip LED should flash briefly with triple beep right after. This means exploit is successful. If your console keep turning off and on, check CMD/CLK wire and Stagex

!!! (Pre qcfw-20260228-release-3) If modchip LED didn't flash briefly and console is GLOD for 30 seconds, CMD/CLK resistor may be damaged !!!

!!! (Since qcfw-20260228-release-3) If CMD/CLK is damaged, modchip LED will flash rapidly for 5 seconds before shut the console off (Console power LED turn red) !!!

This means XDR ram initialization has failed. Anything related to it can be a cause but CMD/CLK is the most common one

8. You should be on XMB now. now Enable HEN then use Install qCFW option
9. If it tell you to reinstall firmware and try again, do it ONCE. (PS3 Firmware)
10. Your screen will appear frozen. it is installing. This process take 10-20 minutes. If something goes wrong during this step, you should be still able to recover by entering safe mode and reinstall firmware normally
11. Then it will reboot itself. you should be on qCFW and see Evilnat logo now.
12. Congrats! qCFW installation is complete

From now on, modchip will be required to boot the console until you go back to OFW again

This can be done by reinstalling OFW/HFW firmware normally. Then after this you can disable or uninstall the modchip

Currently, Raspberry Pi Pico (RP2040) and RP2040-Zero are supported.

Only install modchip after Stagex is installed to console flash from above section. Otherwise it won't boot, if you already installed the modchip, You can use HOLD pin to temporary disable the modchip without unsoldering it.

To flash .uf2 file (it is included in qCFW zip), simply connect modchip USB port into your PC while pressing BOOTSEL button. Then new drive will appear, simply drag .uf2 file into it.

You should see LED blinking. Flash successful and ready to use. You can disconnect it from your PC.

For signal (NOR), you only need to solder 4 wires that marked red (CMD, CLK, SC_RX, SC_TX). Other signal pin is optional.

eMMC also need above and SB_RX (5 wires total).

For power, you must solder 5V/3.3V and GND.

It is possible to power the modchip using external power as long as it is active during ps3 standby (GND must be soldered to motherboard!)

You should measure the resistance of CMD/CLK point. Resistance to ground should be around 55 ohm. If it doesn't then something is wrong.

CMD/CLK wire should not be too thick. 0.1mm magnet wire RECOMMENDED

DO NOT USE MAGNET WIRE FOR 3.3V/GND! USE SOMETHING THICK FOR POWER!

WIRE RESISTANCE, LENGTH AND THICKNESS MATTERS A LOT!

Success rate depends on quality of your soldering and wiring.

Keep all wire short as much as you can, GND is the most important one. and avoid routing to noisy area.

When done properly, success rate should be 100%.

SIGNAL PIN:

CLK - XDR CLK signal

CMD - XDR CMD signal

SC_TX/SC_RX - Syscon UART signal

SB_RX - SB UART signal, eMMC need this

DEBUG - Optional modchip UART signal, for debugging and accessing syscon (baud 576000, NOT 57600!)

CONFIG PIN:

Short to ground to activate

HOLD - Disable the modchip without needing to remove power or unsolder

LITE - See wiki

BANKSEL - Go back to OFW forcefully. It is equal to syscon command w 1224 00. Only use when absolutely needed. You can't turn on the console while this pin is shorted. eMMC requires successful modchip boot to apply.

You can't update qCFW while on qCFW. you must go back to OFW first.

Simply reinstall firmware normally, then use Install qCFW option with updated files on USB again. No need to do anything else

When updating files on USB, delete whole qcfw folder first. Don't overwrite or it may causes problem.

Always use this method when possible. Simply reinstall firmware as normal. No extra steps required.

If you want to uninstall the modchip, you can do so after this

After booting the console with modchip, It is possible to downgrade the firmware up to minimum supported version of your console. It can't be done in XMB. You must use safe mode. It will always show as 3.60. This number is fake.

It is different from CFW. Simply follow these steps.

1. Download dtbImage.ps3.zfself and put it into root of your USB drive
2. Plug your USB drive into RIGHTMOST USB port of your ps3
3. On XMB, use Network -> Custom Firmware Tools -> OtherOS Tools -> Install OtherOS (qCFW) option. It should show Success
4. Use Boot OtherOS (qCFW) option. It should enter petitboot right away

You can't access syscon the old ways anymore. It must be done through modchip. Simply connect DEBUG pin of modchip into your UART adapter. (See pico pinout)

Do not use syscon script, instead use normal serial terminal program with baud 576000.

See wiki

1. On qCFW, use option Custom Firmware Tools -> Dump Tools -> Dump HDD Key (qCFW)
2. Your console will reboot
3. After you back to XMB, insert USB drive into RIGHTMOST slot
4. Use Save HDD Key to USB (qCFW) option
5. HDD Key dumped

You can use PS3HDH or PS3HDDTool (Import ata_key.bin) to mount it

This method is useful if you can't use XMB for any reason.

This should work as long as you hear triple beeps

1. Use syscon command "w f03 1"
2. Turn on the console
3. See syscon log for keys

Note: qCFW will exit FSM automatically every 5 boots!

1. Extract this zip into root of your USB drive
2. Plug it into RIGHTMOST USB port of your console
3. Enter FSM using Network -> CFW Tools -> Service Tools -> Advanced Service Tools -> Toggle Factory Service Mode
4. You should see something like this on the screen:
5. Then the console should turn itself off without any errors
6. Remove USB drive then turn on the console
7. (Optional) If you want to play BD movies, insert it and play it once while in FSM
8. Exit FSM

See wiki

Available in both qCFW and HEN

// lv1_peek64(34)
// in: r3 = addr
// out: r3 = value

// lv1_poke64(35)
// in: r3 = addr, r4 = value
// out: r3 = 0

// lv1_exec(36)
// in: r3-r8 = args, r9 = addr

// lv1_peek32(37)
// in: r3 = addr
// out: r3 = value

// lv1_poke32(38)
// in: r3 = addr, r4 = value
// out: r3 = 0