Video: PS3 QA Flag Demo, Enables Hidden Firmware Options

[d3adliner]

Button combo will be changed in the next FW update.

[Brenza]

They doesn't need to change the combo, if you don't flag the token combo will not work.

If you don't own the keys to decrypt the token you can't flag it, but if you had the keys you no longer need the QA Flag! LOOL

[B4rtj4h]

Oh boy... i see another opportunity here! USB dongles that push button combos...

[anon777]

that's what i'm talking about

[PS3 News]

Here is a PS3 QA Tutorial by Slynk for those following: coderslynk.blogspot.com/2011/06/qa-tutorial.html

There are many methods to accomplish qa and I'm too lazy to document them all so I'll tell you one way. Linux.

PS3
Step 1) Install OtherOS++, install linux, make sure to enable the ps3 modules when compiling the kernel. (http://git.gitbrew.org/ps3/?p=otheros-utils/doc.git;a=blob_plain;f=DEBOOTSTRAP;hb=HEAD)

Debootstrap HOWTO by glevand

Links:

http://www.debian.org/releases/stable/i386/apds03.html.en
https://help.ubuntu.com/6.10/ubuntu/installation-guide/i386/linux-upgrade.html

Installing Debian Squeeze with debootstrap on petitboot

- Configuring the base system

1. umount /dev/ps3vflashh2
2. mkdir /mnt/debian
3. mount /dev/ps3vflashh2 /mnt/debian
4. rm -rf /mnt/debian/*
5. debootstrap --arch powerpc squeeze /mnt/debian http:/ftp.us.debian.org/debian
6. mount -t proc none /mnt/debian/proc
7. mount --rbind /dev /mnt/debian/dev
8. LANG=C chroot /mnt/debian /bin/bash
9. export TERM=xterm-color

- Mounting partitions

File /etc/fstab

/dev/ps3vflashh2 / ext3 defaults 0 1
/dev/ps3vram none swap sw 0 0
/dev/ps3vflashh1 none swap sw 0 0
/dev/sr0 /mnt/cdrom auto noauto,ro 0 0
proc /proc proc defaults 0 0
shm /dev/shm tmpfs nodev,nosuid,noexec 0 0

- Setting timezone

1. vi /etc/default/rcS
2. dpkg-reconfigure tzdata

- Configuring networking

1. echo "debian-vflash" > /etc/hostname

File /etc/network/interface

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

File /etc/resolv.conf

nameserver 192.168.1.1

- Configuring apt

File /etc/apt/sources.list

deb http://ftp.us.debian.org/debian squeeze main
deb-src http://ftp.us.debian.org/debian squeeze main

deb http://security.debian.org/ squeeze/updates main
deb-src http://security.debian.org/ squeeze/updates main

1. aptitude update

- Configuring locales and keyboard

1. aptitude install locales
2. dpkg-reconfigure locales
3. aptitude install console-data
4. dpkg-reconfigure console-data

- Finishing touches

1. tasksel install standard
2. aptitude clean
3. passwd

- Installing kernel

1. cd /usr/src
2. git clone git://git.gitbrew.org/ps3/ps3linux/linux-2.6.git
3. ln -sf linux-2.6 linux
4. cd linux
5. cp ps3_linux_config .config
6. make menuconfig
7. make
8. make install
9. make modules_install

If you compile your kernel on PS3 then make sure you activate swap because
compiling kernel needs much RAM. I used /dev/ps3vflashh1 as swap which
you have to create with fdisk first of course or some other program.

1. mkswap /dev/ps3vflashh1
2. swapon /dev/ps3vflashh1

- Creating kboot.conf

File /etc/kboot.conf

debian_vflash=/boot/vmlinux-2.6.38-gf77c53d root=/dev/ps3vflashh2
debian_vflash_hugepages=/boot/vmlinux-2.6.38-gf77c53d root=/dev/ps3vflashh2 hugepages=1

- Creating /dev/ps3flash device (needed for ps3-utils)

File /etc/udev/rules.d/70-persistent-ps3flash.rules

KERNEL=="ps3vflashf", SYMLINK+="ps3flash"

Installing Ubuntu Natty with debootstrap on petitboot

- Configuring the base system

1. umount /dev/ps3vflashh3
2. mkdir /mnt/ubuntu
3. mount /dev/ps3vflashh3 /mnt/ubuntu
4. rm -rf /mnt/ubuntu/*
5. debootstrap --arch powerpc natty /mnt/ubuntu http://ports.ubuntu.com
6. mount -t proc none /mnt/ubuntu/proc
7. mount --rbind /dev /mnt/ubuntu/dev
8. LANG=C chroot /mnt/ubuntu /bin/bash
9. export TERM=xterm-color

- Mounting partitions

File /etc/fstab

/dev/ps3vflashh3 / ext3 defaults 0 1
/dev/ps3vram none swap sw 0 0
/dev/ps3vflashh1 none swap sw 0 0
/dev/sr0 /mnt/cdrom auto noauto,ro 0 0
proc /proc proc defaults 0 0
shm /dev/shm tmpfs nodev,nosuid,noexec 0 0

- Setting timezone

1. vi /etc/default/rcS
2. dpkg-reconfigure tzdata

- Configuring networking

1. echo "ubuntu-vflash" > /etc/hostname

File /etc/network/interfaces

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

File /etc/resolv.conf

nameserver 192.168.1.1

- Configuring apt

File /etc/apt/sources.list

deb http://archive.ubuntu.com/ubuntu/ natty main restricted
deb-src http://archive.ubuntu.com/ubuntu/ natty main restricted

deb http://ports.ubuntu.com/ubuntu-ports/ natty-updates main restricted
deb-src http://ports.ubuntu.com/ubuntu-ports/ natty-updates restricted

deb http://ports.ubuntu.com/ubuntu-ports/ natty universe
deb http://ports.ubuntu.com/ubuntu-ports/ natty-updates universe

deb http://ports.ubuntu.com/ubuntu-ports/ natty multiverse
deb http://ports.ubuntu.com/ubuntu-ports/ natty-updates multiverse

deb http://ports.ubuntu.com/ubuntu-ports/ natty-security main restricted
deb-src http://ports.ubuntu.com/ubuntu-ports/ natty-security main restricted
deb http://ports.ubuntu.com/ubuntu-ports/ natty-security universe
deb-src http://ports.ubuntu.com/ubuntu-ports/ natty-security universe
deb http://ports.ubuntu.com/ubuntu-ports/ natty-security multiverse
deb-src http://ports.ubuntu.com/ubuntu-ports/ natty-security multiverse

1. apt-get update

- Configuring locales and keyboard

1. apt-get install locales
2. dpkg-reconfigure locales
3. apt-get install console-data
4. dpkg-reconfigure console-data

- Finishing touches

1. apt-get update
2. apt-get upgrade
3. apt-get clean
4. passwd

- Installing kernel

1. cd /usr/src
2. git clone git://git.gitbrew.org/ps3/ps3linux/linux-2.6.git
3. ln -sf linux-2.6 linux
4. cd linux
5. cp ps3_linux_config .config
6. make menuconfig
7. make
8. make install
9. make modules_install

If you compile your kernel on PS3 then make sure you activate swap because
compiling kernel needs much RAM. I used /dev/ps3vflashh1 as swap which
you have to create with fdisk first of course or some other program.

1. mkswap /dev/ps3vflashh1
2. swapon /dev/ps3vflashh1

- Creating kboot.conf

File /etc/kboot.conf

ubuntu_vflash=/boot/vmlinux-2.6.38-gf77c53d root=/dev/ps3vflashh3
ubuntu_vflash_hugepages=/boot/vmlinux-2.6.38-gf77c53d root=/dev/ps3vflashh3 hugepages=1

- Creating /dev/ps3flash device (needed for ps3-utils)

File /etc/udev/rules.d/70-persistent-ps3flash.rules

KERNEL=="ps3vflashf", SYMLINK+="ps3flash"

Step 2) Download, and compile the ps3dm utils (http://git.gitbrew.org/ps3/?p=ps3linux/ps3dm-utils.git;a=summary)

Download: ps3dm_um (Compiled) / ps3dm_aim (Compliled)

PC
Step 3) Download my tokenator (Tokenator (SRC) / Tokenator (Compiled))

PS3
Step 4) Dump your eid by running ./ps3dm_iim /dev/ps3dmproxy get_data 0x0>dump

Step 5) Set your flag by running ./ps3dm_um /dev/ps3dmproxy write_eprom 0x48C0A 0x00

PC
Step 6) Open your dump in a hex editor and type in the first 16 bytes into tokenator

PS3
Step 7) Run the script it spits out

PS3
Step 8) Restart your ps3. Go to the Network Settings options and press L1 + L2 + L3 + R1 + R2 + D-Pad Down

Have fun. It doesn't work on rebug yet. There are other flags to set for debug firmwares and rebug is pseudo debug.

How to setup QA Flag with Grafs Payload:

First you have to dump your Flash -> Extract EID -> Extract EID0 and EID4 -> put them on eid.c

To do this you can use Hardware_flashing, Linux with graf_chokolo kernel with acces to /dev/ps3nflasha or using this payload uncommenting dump_dev_flash()

Once you are set - Use the payloads in the following order uncommenting the required function

Set the QA flag: update_mgr_qa_flag()

Calculate the token: update_mgr_calc_token()

Verify token: update_mgr_verify_token()

Set the calculated and verified token in update_mgr_set_token.c: update_mgr_set_token()

You should use wireshark or tcpdump to capture the responses.

GameOS app SRC to QA-flag: pastie.org/2105541 / Makefile: pastie.org/2105567

/*
 * Based on glevands product mode toogle
 * PsiCoLeO 2011
 */

/*
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; version 2 of the License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */

#include <stdio.h>
#include <string.h>
#include <unistd.h>

#include <psl1ght/lv2/net.h>

#include <lv2_syscall.h>
#include <udp_printf.h>

#define UPDATE_MGR_PACKET_ID_READ_EPROM		0x600b
#define UPDATE_MGR_PACKET_ID_WRITE_EPROM	0x600c
#define EPROM_QA_FLAG_OFFSET				0x48c0a
#define EPROM_QA_Token_OFFSET				0x48D3E

/*
 * Set your encrypted token
 * Calculated with Slynk Tokenator
 */
static uint8_t qa_token[0x50] =
{
	0xF6, 0x58, 0xDB, 0xAC, 0x63, 0xEB, 0x47, 0x99, 0xE2, 0x63,
	0xC0, 0x10, 0x66, 0x42, 0x3D, 0xF7, 0x34, 0x29, 0x90, 0x61,
	0x23, 0xED, 0x89, 0xEC, 0x21, 0x9E, 0xE2, 0x8B, 0x83, 0xF9,
	0x87, 0x2F, 0x32, 0x50, 0xEC, 0xC3, 0xD0, 0x3D, 0xEA, 0x6E,
	0x14, 0xE0, 0x81, 0xA2, 0x67, 0xCE, 0x86, 0xF7, 0x7A, 0xFE,
	0xDF, 0x11, 0xAB, 0x39, 0xE1, 0xCE, 0x57, 0x06, 0x42, 0xC0,
	0x2B, 0xB2, 0x3F, 0x49, 0x04, 0xC7, 0xE7, 0x58, 0x70, 0x19,
	0x6A, 0xF1, 0xE4, 0x94, 0x32, 0x36, 0x61, 0xB0, 0xA6, 0xB5,
};


/*
 * main
 */
int main(int argc, char **argv)
{
	uint8_t value;
	int result;
	int n;

	netInitialize();

	udp_printf_init();

	PRINTF("%s:%d: start\n", __func__, __LINE__);

	result = lv2_ss_update_mgr_if(UPDATE_MGR_PACKET_ID_READ_EPROM,
		EPROM_QA_FLAG_OFFSET, (uint64_t) &value, 0, 0, 0, 0);
	if (result) {
		PRINTF("%s:%d: lv1_ss_update_mgr_if(READ_EPROM) failed (0x%08x)\n",
			__func__, __LINE__, result);
		goto done;
	}

	PRINTF("%s:%d: current qa flag mode 0x%02x\n", __func__, __LINE__, value);

	if (value == 0xff) {
		/* enable */

		PRINTF("%s:%d: enabling qa flag mode\n", __func__, __LINE__);

		value = 0x0;

		result = lv2_ss_update_mgr_if(UPDATE_MGR_PACKET_ID_WRITE_EPROM,
			EPROM_QA_FLAG_OFFSET, value, 0, 0, 0, 0);
		if (result) {
			PRINTF("%s:%d: lv2_ss_update_mgr_if(WRITE_EPROM) failed (0x%08x)\n",
				__func__, __LINE__, result);
			goto done;
		}
	} else {
		/* disable */

		PRINTF("%s:%d: disabling qa flag mode\n", __func__, __LINE__);

		value = 0xff;

		result = lv2_ss_update_mgr_if(UPDATE_MGR_PACKET_ID_WRITE_EPROM,
			EPROM_QA_FLAG_OFFSET, value, 0, 0, 0, 0);
		if (result) {
			PRINTF("%s:%d: lv2_ss_update_mgr_if(WRITE_EPROM) failed (0x%08x)\n",
				__func__, __LINE__, result);
			goto done;
		}
	}

	PRINTF("%s:%d: end\n", __func__, __LINE__);

	lv2_sm_ring_buzzer(0x1004, 0xa, 0x1b6);
	
	/* Setting the QA token */
	for ( n=0 ; n<80 ; n++ )
	{
		PRINTF("Setting QA token bit\n");

		value = qa_token[n];

		result = lv2_ss_update_mgr_if(UPDATE_MGR_PACKET_ID_WRITE_EPROM,
			EPROM_QA_Token_OFFSET+n, value, 0, 0, 0, 0);
		if (result) {
			PRINTF("%s:%d: lv2_ss_update_mgr_if(WRITE_EPROM) failed (0x%08x)\n",
				__func__, __LINE__, result);
			goto done;
	}

	lv2_sm_ring_buzzer(0x1004, 0xa, 0x1b6);

done:

	udp_printf_deinit();

	netDeinitialize();

	return 0;
}

.SUFFIXES:
ifeq ($(strip $(PSL1GHT)),)
$(error "PSL1GHT must be set in the environment.")
endif

include $(PSL1GHT)/host/ppu.mk

TARGET		:=	$(notdir $(CURDIR))
BUILD		:=	build
SOURCE		:=	../common/source source
INCLUDE		:=	../common/include include
DATA		:=	data
LIBS		:=	-lnet -lsysmodule

TITLE		:=	QA flagger
APPID		:=	QAFL00003
CONTENTID	:=	UP0001-$(APPID)_00-0000000000000000
PKGFILES	:=	release

CFLAGS		+= -O2 -Wall -std=gnu99
CXXFLAGS	+= -O2 -Wall

ifneq ($(BUILD),$(notdir $(CURDIR)))

export OUTPUT	:=	$(CURDIR)/$(TARGET)
export VPATH	:=	$(foreach dir,$(SOURCE),$(CURDIR)/$(dir)) \
					$(foreach dir,$(DATA),$(CURDIR)/$(dir))
export BUILDDIR	:=	$(CURDIR)/$(BUILD)
export DEPSDIR	:=	$(BUILDDIR)

CFILES		:= $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.c)))
CXXFILES	:= $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.cpp)))
SFILES		:= $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.S)))
BINFILES	:= $(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.bin)))
VCGFILES	:= $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.vcg)))

ifeq ($(strip $(CXXFILES)),)
export LD	:=	$(CC)
else
export LD	:=	$(CXX)
endif

export OFILES	:=	$(CFILES:.c=.o) \
					$(CXXFILES:.cpp=.o) \
					$(SFILES:.S=.o) \
					$(VCGFILES:.vcg=.vcg.o) \
					$(BINFILES:.bin=.bin.o)

export BINFILES	:=	$(BINFILES:.bin=.bin.h)

export INCLUDES	:=	$(foreach dir,$(INCLUDE),-I$(CURDIR)/$(dir)) \
					-I$(CURDIR)/$(BUILD)

.PHONY: $(BUILD) clean pkg run

$(BUILD):
	@[ -d $@ ] || mkdir -p $@
	@$(MAKE) --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile

clean:
	@echo "[RM]  $(notdir $(OUTPUT))"
	@rm -rf $(BUILD) $(OUTPUT).elf $(OUTPUT).self $(OUTPUT).a $(OUTPUT)*.pkg

run: $(BUILD)
	@$(PS3LOADAPP) $(OUTPUT).self

pkg: $(BUILD) $(OUTPUT).pkg

else

DEPENDS	:= $(OFILES:.o=.d)

$(OUTPUT).self: $(OUTPUT).elf
$(OUTPUT).elf: $(OFILES)
$(OFILES): $(BINFILES)

-include $(DEPENDS)

endif

From http://psx-scene.com/forums/showthread.php?t=88911#post844236: QA: use set_token instead of write_eprom!

i've seen some nice tutorials and tools around, but... if you're going to flag your ps3 via linux, i'd recommend using set_token instead of write_eprom! set_token will set the flag and write the token, if the token you specified is valid. if not, it won't write anything to the eprom (unlike write_eprom).

btw: another way to generate valid tokens

#include <sys/types.h>
#include <sys/mman.h>
#include <stdio.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/stat.h>
#include <string.h>
#include <stdarg.h>
#include <stdlib.h>
#include <zlib.h>
#include <dirent.h>

#include "tools.h"
#include "aes.h"
#include "sha1.h"

static u8 *token_encrypted = NULL;

static u8 key[] = {0x34, 0x18, 0x12, 0x37, 0x62, 0x91, 0x37, 0x1C, 0x8B, 0xC7, 0x56, 0xFF, 0xFC, 0x61, 0x15, 0x25, 0x40, 0x3F, 0x95, 0xA8, 0xEF, 0x9D, 0x0C, 0x99, 0x64, 0x82, 0xEE, 0xC2, 0x16, 0xB5, 0x62, 0xED};
static u8 iv[] = {0xE8, 0x66, 0x3A, 0x69, 0xCD, 0x1A, 0x5C, 0x45, 0x4A, 0x76, 0x1E, 0x72, 0x8C, 0x7C, 0x25, 0x4E};

static u8 hmac_key[] = {0xCC, 0x30, 0xC4, 0x22, 0x91, 0x13, 0xDB, 0x25, 0x73, 0x35, 0x53, 0xAF, 0xD0, 0x6E, 0x87, 0x62, 0xB3, 0x72, 0x9D, 0x9E, 0xFA, 0xA6, 0xD5, 0xF3, 0x5A, 0x6F, 0x58, 0xBF, 0x38, 0xFF, 0x8B, 0x5F,0x58, 0xA2, 0x5B, 0xD9, 0xC9, 0xB5, 0x0B, 0x01, 0xD1, 0xAB, 0x40, 0x28, 0x67, 0x69, 0x68, 0xEA, 0xC7, 0xF8, 0x88, 0x33, 0xB6, 0x62, 0x93, 0x5D, 0x75, 0x06, 0xA6, 0xB5, 0xE0, 0xF9, 0xD9, 0x7A};

static FILE *out = NULL;



int main(int argc, char *argv[])
{
	u8 tmp[0x50];
	if (argc != 3)
		fail("usage: gen_qa encrypted_dummy_token.bin out.bin");

	token_encrypted = mmap_file(argv[1]);

	//decrypt
	aes256cbc(key, iv, token_encrypted, 0x50, tmp);

	//set qa
	memset(tmp+0x2f,0x02,1);

	//recalc digest
	sha1_hmac(hmac_key, tmp, 0x3c, tmp+0x3c);

	//encrypt
	aes256cbc_enc(key, iv, tmp, 0x50, tmp);

	out = fopen(argv[2], "w+");
	fwrite(tmp, 0x50, 1, out);

	fclose(out);

	return 0;
}

compile together with f0f tools...

[TUHTA]

Guys who already gone thru the Linux installation tutorial above??

Send me PM i need your help please... i'm very close to finish... but can't install some things.

[young blade]

Guys I dont understand what this QA stuff is about..

[NTA]

You will understand when the time is right haha.

[ConsoleDev]

Shortly after the PS3 QA Flag Method was revealed comes the QA Flagging Tools in PKG format alongisde a CFW355-OTHEROS++-SPECIAL.PUP which is https://twitter.com/#!/gitbrew/status/84374205172428800 working via QA Auto Flag with Flash, Run, and Reflash to PS3 CFW (Kmeaw, Waninkoko, etc) support coming soon.

Download: http://7track.org/~glevand/ps3/pkgs/qa_flag.pkg / http://7track.org/~glevand/ps3/pkgs/reset_qa_flag.pkg / http://7track.org/~glevand/ps3/pkgs/qa_flag_extra.pkg / http://7track.org/~glevand/ps3/pkgs/get_applicable_version.pkg / http://7track.org/~glevand/ps3/pkgs/get_token_seed.pkg / http://7track.org/~glevand/ps3/cfw/CFW355-OTHEROS++-SPECIAL.PUP

For those curious, the PS3 QA Flag Extra (Advanced) has a few other flags / tokens set but it's not for general use.

Requirements:

What we have tested on so far:

• 3.55
• 3.41

Instructions:

Set QA Flag to Standard:

• Run qa_flag.pkg if you hear a beep, it worked. If not dump your debug messages via udp_printf on linux and send to us to fix.
• Reboot the ps3
• Go to network settings (Do not enter it) and hit or hold
• L1+L2+L3+R1+R2+down on the dpad
• QA auto flagging is now done.

Reset QA Flag to Default:

• Run reset_qa_flag.pkg
• If you hear a beep it worked. If not dump your debug messages via udp_printf_client in linux and send it to us.
• Reboot the ps3
• QA Flag is now set to default (Off) Your PS3 is now normal again.

Git Repository:

git://git.gitbrew.org/ps3/otheros-utils/qa_flag.git
git://git.gitbrew.org/ps3/otheros-utils/reset_qa_flag.git
git://git.gitbrew.org/ps3/otheros-utils/get_token_seed.git

PS3 Downgrade:

Tools Needed:

• CFW355-OTHEROS++-SPECIAL.PUP
• qa_flag_extra.pkg
• Firmware you want to downgrade to (3.41, 3.15).

Notes: These tools WILL format your PS3. Any and ALL PSN / downloaded data will be erased! The lowest firmware you can go to is what was originally on your PS3 originally!

If your ps3 came with 3.41 then that's the lowest it can go. If it came with 3.15 again thats as low as it can officially go! be warned if you go lower, you WILL brick!

Installation Process:

1. Install CFW355-OTHEROS++-SPECIAL.pup (Doesn't matter what version you are 3.41, 3.50 etc etc)
2. Install qa_flag_extra.pkg
3. Run qa_flag (It will show up as this, that is fine)
4. If you hear the beeps, continue. If you don't hear the beeps go to step 10
5. Reboot
6. Go into recovery menu and Update your ps3 with the firmware that you want (3.15, 3.41 etc)
7. Have it install and now you're done. You just successfully downgraded your PS3.

They have also stated via http://twitter.com/#!/gitbrew/status/85310673642455040 that they are working on a 3.56+ PS3 Firmware exploit, to quote:

Currently our main developers are working on 3.55 and below, I am working on a exploit for 3.56+ however. Anything key related and 3.56+ is currently not going to be answered. News will be released as we figure it out, If it works we will say so. It's still going to be rough to do anything though. We might save it for the new 3000 series of the ps3 though.

Finally, in related news http://www.nextgenupdate.com/forums/showthread.php?t=421380#post3465221 has made available what he calls Varaques 3.55 PS3 CFW based on PS3MFW Builder which features the following:

• Other+OS Support
• Q&A Flag Support
• Custom Boot Logo
• Custom Theme
• 3.66 Spoofed
• LV1 & LV2 Patched
• Run Unsigned PKG's & More

Shortly following, he made available Kmeaw CFW with Other+OS and QA Flag Support via MFW Builder. Simply put it in the root of your PS3 storage device as follows : PS3/UPDATE/PS3UPDAT.PUP

More PlayStation 3 News...

[daveshooter]

Respect to you man. +rep to you also..

Boss it would not let me Rep him, can you do one from me please.