Kohada

A repair & tuning toolkit for the PlayStation 3 system controller (syscon)

Talks to Mullion and Sherwood syscon controllers over UART

• EEPROM dump - self sizing dump of the full syscon NVS (20 KB / 32 KB auto detected) plus the secondary 0x48xxx pages, saved to a single self describing container file.
• Console identity restore guard - before a restore, Kohada reads the QA token + platform ID + manufacturing strings from the live console and compares them to the backup, so you can't accidentally flash one console's EEPROM onto another.
• EEPROM hex editor with named region map and automatic checksum fix-up.
• Fan curve editor - drag to edit fan curves per thermal zone, with byte-exact factory presets for every documented board and a live preview before you commit.
• Voltage tuner - Cell/RSX VID editor whose ceiling is derived from the console's silicon process node (90/65 nm vs 45/40 nm), identified from its platform ID.
• CELL / XDR overclocking - clock generator configuration.
• XDR memory timing override - full 46-entry MIC descriptor editor. (Mullion only)
• Config ring editor - Cell BE config-ring patch sources + scatter table. (Mullion only)
• NVS tweak panel - typed editors for the documented syscon NVS fields. (Mullion only)
• Error-log decoder - reads and decodes the syscon error log against a community maintained code database.

Sherwood runs a different microcontroller that has not been reverse engineered. Anything derived from decompiled Mullion firmware therefore has no known meaning on Sherwood, and XDR Timing, Config Ring and Tweaks are disabled there rather than left pointing at arbitrary NVS bytes. Everything else is driven by documented offsets and works on both families.

Builds are distributed as archives outside this repository (this repo does not host binaries). Windows and Linux (x64) builds are provided.

1. You MUST extract Kohada to a dedicated directory. Kohada requires the Qt libraries provided to function properly and will NOT not run from a archive utility such as 7Zip.
2. Run kohada.exe and accept the disclaimer.

Two formats are provided. Both bundle Qt and OpenSSL, so nothing needs installing and nothing needs to be on LD_LIBRARY_PATH.

AppImage - single file, no extraction:

chmod +x Kohada-*-x86_64.AppImage
./Kohada-*-x86_64.AppImage

Tarball - extract to a dedicated folder and keep it intact; the binary needs the lib/ directory beside it and will not run from inside an archive viewer:

tar -xzf kohada-*-linux-x86_64.tar.gz
cd kohada-*-linux-x86_64
./bin/kohada

Serial access: to talk to the syscon over USB you need read/write on the serial device (e.g. /dev/ttyUSB0). Add yourself to the dialout group once:

sudo usermod -aG dialout $USER

then log out and back in. If your distribution does not use the dialout group, the tarball includes 70-kohada-serial.rules as a udev alternative.

The golden rule. Before touching any value:

1. Dump your EEPROM (EEPROM Dump tab).
2. Save the .scdump somewhere safe, on more than one device.
3. Only then make changes.

That dump is your only way back if a write goes wrong.

Note: Full Restore rewrites main NVS only. The secondary 0x48xxx pages (including the QA token) are archived in your backup for reference but are not written back during a restore.

Kohada is not open source (yet, code needs a major cleanup), but the error-code database (src/core/error_codes.h) is published here so the community can improve it. If you've decoded a syscon error the tool doesn't recognise, or have better repair context for an existing one, contributions to that file are welcome via pull request.

This is the only source file in the repository, the rest of the application is closed source.

This software is provided "as is", without warranty of any kind. You assume all risk for any damage to your hardware or data. Not affiliated with or endorsed by Sony Interactive Entertainment.