Hack your PlayStation 3 and play ALL the games – EvilNat / BGToolset custom firmware jailbreak

The Sony PlayStation 3 was the company’s flagship console for seven years, from its launch in 2006 to the release of the PS4 in 2013. Over that period it built up a huge following and, more importantly, a fantastic games library.

Today you can pick up a fully working unit in good condition with original controllers for under £60. At that price it’s great value for money, especially since the console is so easy to jailbreak so you can play any of these games from your DVD backup files.

In this video I’ll show you how to use the PS3 BGToolset by bguerville to install a custom firmware mod to the console. We’ll also look at how to backup your original game disks and then how to use any game backup file to copy the software onto your PS3 so you can play the entire back catalogue of titles.

So let’s hack the PS3.

Non Windows Users

Before we start just a note for non Windows users. There is one step in this process that requires a Windows based PC or laptop. It’s to run a final check on your console to make sure that it’s safe to install the custom firmware. You can skip this step but you do then risk bricking your PS3. You don’t need the Windows PC next to your console. You can simply email a file to a friend to check for you, but I do strongly advise you do complete this step. I’ll talk more about it when we get there.

Compatible Consoles

For a second reality check, unfortunately not all models of PS3 can be hacked with custom firmware. Our first task then is to identify our PS3 model and work out if it is a CFW compatible model.

Any original or phat model can be hacked.

Any super slim model can’t be hacked with CFW, but you can use PS3HEN.

Early slim models can be hacked but some later models can’t. For these you first need to look at the exact model number. You’ll find this on the label on the bottom of the console. On there you’ll find a number in the format CECH-XXXX.

If your console is a 20XX or 21XX model you can hack it. If it’s a 25XX model it might be hackable. 30XX and 31XX models aren’t compatible with the hack.

Part of the jailbreaking process is to run a full compatibility check to get a definitive answer, but this should give you a good guide. If you’re looking to buy a unit for this project make sure you get either a phat or a slim with the 2000 or 2100 series model number. Most listings on places like eBay will show this, or make sure to ask the seller.

If you’ve got an incompatible model don’t worry. You can still modify it using the PS3HEN hack, and I’ve got a video on how to do that. PS3HEN doesn’t allow you to do everything that a full custom firmware hack will do but it does allow you to play games from backup files and most of the popular homebrew apps such as emulators. So do make sure you check out that video to get the most from your device.

Which Method

There are few different ways of installing custom firmware onto your PS3. The easiest is to use bguerville’s PS3 toolset. This is a set of software tools that make use of a vulnerability in the PS3 browser. To use the toolset we simply need to visit the ps3toolset.com website.

Preparing the Console

Before we think about hacking the machine I’d advise you to think about your internal hard drive. Most people use this hack to play games from backup files. You’ll probably end up playing PS3, PS2, PS1 and PSP games along with a range of other retro consoles. These take up a lot of hard drive space. Most consoles come with fairly small internal drives. You can use external USB drives but I find upgrading the internal one to around 1TB just means that I can stick everything on there with plenty of space to spare. At around £25 for a used 1TB laptop drive it makes great sense. If you want to upgrade your hard drive check out my PS3 upgrade video, but please do this before you go through the hack process as it just makes the whole disk swap process so much easier.

So now let’s get ready for the exploit.

The first part of the hack is to make sure our console is fully compatible with the custom firmware. There’s a few things we need to check.

If you’ve been messing around with your console installing PS3HEN or some other firmware modifications then it’s probably a good idea to remove those and get yourself back to a stock console. To help I made a video to get you back to the original firmware so please do have a look at that so you can get your PS3 into a good state to start the project.

The custom firmware we’ll be installing will only be compatible with a range of original firmware versions. If you go to the ps3xploit.me website you’ll see what that currently is.

At the moment the toolset mod will work with versions 4.75 to 4.91. This may be different when you come to install yours, but just follow along and make sure you update to a supported version.

To check this boot up your PS3 go to the Settings option on the cross menu bar and select System Settings. Then go all the way down to the bottom and select System Information. You’ll see your System Software version listed. If this isn’t in the current range you’ll need to run a System Update from the option at the top of the settings menu. If you see a version number with letters after it like PS3HEN then you’ve got some sort of mod installed and you’ll need to uninstall that. Again have a look at my console reset video.

Next we need to be connected to the Internet. If you can’t get your console connected this tutorial isn’t going to work for you. You can set this up by going to Network Settings option on your PS3. From here go to the Internet Connection Settings and then just follow the prompts to connect to your WiFi or Ethernet.

We now need to make sure the date and time on the console is set correctly to make sure that the exploit software has the correct values to work with. Again in the settings section select  the Date and Time settings. Set the Automatic option to on and then make sure the other settings for time zone etc. are correct. Then select the Date and Time option to set the values and select the via Internet option to have the console update itself correctly.

Our next step is to create a temporary user for the exploit. This just makes sure that the user account is at the default settings so that the exploit code can run in the built in browser. It’s probably not essential but just removes any settings issues.

On the XMB go to the far left for the Users section and create a new user. Any name is fine and then select that user to log in.

Now we can start to load in the exploit code.

On the cross menu bar and go to the Network section and start the browser app.

We need to clean this out so that it will run the toolset code correctly.

When the browser app opens click the triangle button to open up the settings menu.

Use the D pad to go up to the JavaScript section and make sure that’s turned on by clicking the right D Pad and selecting On.

After each of these settings changes you’ll drop back into the browser, so just press triangle again to get back to the settings. Next we need to go to the tools section and set confirm browser close to off. Now back to the tools settings and select the Home Page option with the X button. Select the Use Blank Page option, make sure the Restore Window at Startup is unchecked and the select OK to save the settings.

We now need to clear the browser caches. So back into the tools settings and you’ll see four delete options at the bottom of the list for Cookies, Search History, Cache and Authentication. You need to clear each of these in turn.

Once that’s all complete exit out of the browser with the circle button. That should now give us a completely clean browser.

Open the browser back up again and press the Start button to bring up the address bar. Type in the following address.

https://ps3toolset.com

And then select the Start or enter button.

This should take you to the Bguerville toolset website. If you get a warning about letting a script run make sure to allow it as that will be the software we want to install.

You should now see some messages appearing as the toolset exploit software is downloaded and run. If you get any errors during this process just back out of the browser, restart the console and restart from the browser cleaning step.

If all’s gone well you should get a confirmation message and a donation popup will probably appear. The toolset developer and the ps3xploit team who create and manage this firmware code provide everything free of charge. But as you can imagine they put in an enormous amount of work to create these tools. If you find any of this useful please do consider making a donation to help cover the costs of servers and maybe treat the team members to a cup of coffee or something stronger.

With the code up and running we’re ready to start using the toolset. Since we’ll be coming back to this page let’s bookmark it so we don’t have to keep typing in the address. Just hit your Select button and then Add Bookmark. If we ever want to get back here you can just press the select button and then select the site you want to visit.

Back on the toolset page, select the System Manager tab and it will scan your console and report back to you with some important information. The most important bit is the green tick at the top of the window. This means your console is fully compatible and you’re ready to start the hack.

If you don’t get a green tick you’ll need to use the PS3HEN hack from my other video.

For now close down the browser while we prepare all the parts we need to install the custom firmware.

Downloading the CFW Software

To install the custom firmware we’re going to need to prepare some files on our PC and then port them over to the PlayStation 3 on a USB drive. So you’re going to need a USB drive formatted with the FAT32 file system. If you’re not sure how to do this then please have a look at my FAT32 formatting video. The drive you use doesn’t need to be massive as it’s only going to be used for a few GB of files, but it must be FAT32 formatted.

Once you’ve got your USB drive ready you can test to make sure it’s going to be recognised by simply plugging it into your console. If it pops up on your video or music menu then it’s all working fine.

The first download we need is the actual custom firmware package that we want to install onto our console. The best option for this is the custom firmware from EvilNat. This code is kept up to date with the latest official releases and the programmer puts a lot of effort into making this a great package to install.

You can get to the latest release through the PSX-Place website. Go to the PS3 CFW section at

https://www.psx-place.com/forums/ps3-cfw-custom-firmware.179/

From there you should find a link to the latest EvilNat release page as a pinned post at the top of the post list. On this page you’ll find out all about the latest version. If you read through the notes you’ll see that this code is being improved all the time and offers some great features.

Lower down the first post on the release page you’ll find the download links. There are a range of versions of the CFW depending on what you want to do. If you click the download link it will take you to a file hosting site where you can see what’s available.

At the time of making this video there are a range of Beta versions to choose from. The latest one will be the best but it will depend on what variations have been completed.

There are 3 main versions.

CEX is the full retail version of the firmware. This mimics a standard console which will let you run all the homebrew code we want but limit the system to the standard operating system calls.

PEX is the retail version with a few extra bits of development and debug code to add some extra functionality to the jailbreak.

DEX is a full development and debug firmware. You should only use this if you know what you’re doing.

In general I’d opt for the PEX package as it will give you a bit of extra functionality as you expand your homebrew experience. If you really just want to play games from across the full PlayStation range you can go for CEX.

On the download site just navigate into the package and find the download file for the version you want. For me the Beta V10 release has a PEX package available so that’s the one I’m going to use.

The downloaded file will be delivered as an archive file. Mine has come down as a .rar format. If your computer can’t open these directly you’ll need the help of an archive file app. For the PC I’d recommend either 7-zip, or the package I use, Ashampoo Zip Pro.

Once you’ve got the download file just extract it into its own folder for later use and delete the archive file if you want.

 

Next we will need some tools to help us backup and verify our NAND or NOR flash data. This will help us save our console if we manage to brick it at some later date. We’ll be using the PyPS3Checker app from the PyPS3Tools package. You can download this from the project’s GitHub repository at

https://github.com/littlebalup/PyPS3tools

On the main page click the link for the PyPS3Checker standalone zip archive file and then click its download link to save the file onto your computer. Again extract the file into it’s own folder and delete the archive file.

That’s all the software to install and check the modification so all we need now are some applications to run on our newly hacked PlayStation.

The first package most people install is called MultiMan. This is sort of an all in one package that will let you play PS3 games from disk backup files along with a range of other useful tasks. If you’re looking for homebrew code a great place to start is

https://brewology.com

If you head over to that website you’ll find a link on the left for the PS3 homebrew store. From here you can really start exploring the whole homebrew scene. The Homebrew link on the right will take you to information and download links for the full range of applications that you’ll soon be able to install onto your PS3. Apps, Games, Emulators and so on.

For now though we just want to grab a copy of MultiMan which has a dedicated link on the left. We want multiMan itself so we can expand out that section and then scroll down to the download links.

We need the BASE package . Don’t worry about the 4.85 version number. If you look at the text you’ll see that it is fully compatible with the 4.91 version I’m installing, and will most likely be fine with any future versions.

When you click the download link it will download a .pkg file. Your browser might complain about this so go into your downloads section and tell it that the file is fine to download and save onto your computer. This .pkg file is the one we will transfer to the PS3 so there’s no need to extract it.

That’s all the software we need. Let’s get our USB drive prepared.

Preparing Our USB Drive

There’s only two files we need to copy over to our USB drive.

First we need the custom firmware package. If you have a look at your downloads you should find the EvilNat folder that we extracted earlier. In side this you should find a PS3 folder and inside that an UPDATE folder. Inside this UPDATE folder there should be a PS3UPDAT.PUB file. This is the firmware code.

On our USB drive we need to use the same folder structure. The easiest way to do this is to back out until you can see the PS3 folder and then copy that to the root of your USB drive.

So on your USB you should now have a PS3 folder in the root directory, UPDATE inside that and then PS3UPDAT.PUP inside that. Note that all file and folder names must be fully capitalised.

Next we need to copy the multiMan .pkg file to the root of our SD card. This is the normal way that we install any homebrew package, so if you want to install anything else at the same time just copy its .pkg file to the root of the USB drive as well.

Checking the Downloads

At this point it is very important for us to check our downloads to make sure there is no corruption of the files. If anything has gone wrong we risk bricking our console which we really want to avoid.

If you go back to the download folder for the custom firmware you’ll find an MD5 checksum file. If you open that you’ll find a long hexadecimal number. This is a special code generated by running the file through a special algorithm that generates a code to verify the file contents.

Keep this number open on your PC.

Now open up your web browser and go to this online checksum site.

https://emn178.github.io/online-tools/md5_checksum.html

Make sure the settings are set to Input Type File, output encoding Hex and HMAC disabled. You can check files by clicking the input box and selecting a file, or by dragging and dropping it into the area. We need to check the PS3UPDAT.PUP file on the USB drive. Make sure it’s the file on the USB drive as that’s the one that we’ll be loading into the PlayStation.

If the generated MD5 value matches the value from the download package you’re good to go. If not you need to re download the custom firmware and try again.

If all’s gone well the USB drive is now ready.

Backing Up Our PS3 Flash Code

Power on your console and plug in the USB drive.

Our first task is to download a copy of our current flash contents both to make a safe backup in case we brick our PlayStation, but also to check that it’s not got any errors that will mess up our firmware installation.

Plug your USB drive into your console and start up your browser. Again we need to go to the ps3toolset.com website, but if you’ve bookmarked that in the last section you can just press select to use that.

As usual let the site load up and if you get any script popups just allow them to run.

Once you’re into the main toolset interface go to the top menu and select the System Manager button. This will scan your console and report back with a range of information. Now move your cursor to the Flash Memory option and click X. A single menu option should appear to backup your NAND or NOR flash. Select that.

It will now ask you where you want to save the backup so select your USB drive.

This can take a while to complete but just let it run through.

Once that’s finished we need to take our USB drive back to our PC.

On your PC open up the USB drive and you should see a dump.bin file. This is your flash backup. You need to make a copy of this somewhere safe. This backup will let you recover your console if you mess it up and brick it at a later date. These backup files are specific to each console so you must have this backup file to rebuild this console.

Final Checks

With your backup file safely stored we now need to run a final system check using the file.

Earlier we downloaded the PyPS3 System Checker app and extracted it to a folder. Open up this folder and make a copy of the dump.bin file in there. You should now have your dump.bin file sitting beside the system checker files.

To check the flash code you simply need to drag and drop the dump.bin file on top of the file named drag and drop here .bat. This will simply run the batch file using the dropped file as input.

A terminal window will open up and show you some results for dangers and warnings.

If you have any dangers do not install the custom firmware. There is a serious risk of bricking your console if you do. You’ll need to investigate these dangers or opt for the PS3HEN hack instead.

If you have any warnings you’ll need to sort these out before you continue. You can scroll up in the command prompt window to see what the errors and warnings are and save the log file to keep a record of what happened.

I’m not going to cover fixing things in this video so please have a look online for help. One thing that might help though is to do a full factory reset to completely wipe the system and bring it back to basics. You can then go through the whole dumping and checking process once more. Again have a look at my reset video for how to do this.

If you’ve managed to get through without any dangers or warnings then we can continue with the custom firmware installation.

Installing The Custom Firmware

Back on your PlayStation make sure you’ve got your USB drive plugged in.

First we need to change a couple of settings. Go to the Settings section and select System Settings. We need to turn off Auto Updates to make sure that the console doesn’t download a new firmware and overwrite our custom code. Next it’s a good idea to turn off the Display What’s New at startup option so we can jump straight to the game menu.

Next, open up your browser and go back to the ps3toolset.com website. Once that’s all opened up click on the System Manager option again and let that load.

We now need to install the Flash Memory Patch.

Move your cursor to that option in the list and click X. Next select the load via http option to download the patch. This will open up a download window to download and then verify the patch. Let that complete and then close the window.

We now need to apply the patch. This process will allow the custom firmware to be installed onto the console. While the toolset is applying the patch you must not do anything that could interrupt it like clicking something or messing with the console. If you do you risk bricking the PlayStation.

Again click on the Flash Memory Patch option and select the Apply Patch menu item.

You’ll get a warning message pop up. If you’re all ready to go select Yes and then leave the console and controller alone. The patching process can take up to a few minutes depending on the type of console you have. At times it may look like it’s crashed but ignore this and just let it run through.

Eventually you should get a success message and a green tick. This means that everything has gone to plan. You can now back out of the browser and back to the XMB.

Now power off the console by holding down the PlayStation button on your controller and then selecting Turn Of System. Once it’s turned off just turn it back on again to make sure that the newly patched flash is ready to run. Log in as your temporary user and get back to the XMB.

Our console is finally ready for the custom firmware.

Make sure your USB drive is still attached and go to the settings menu and scroll to the top for the System Update option. Select this and then select the Update via Storage Media option.

This will check your USB drive and it should report back with the EvilNat version you downloaded. If this all matches up select OK and wait for the terms page to load.

If you find this isn’t working or is blocked you’ll need to use the Safe Mode method to force the System Update. I’ll cover that in a while.

If you want to read the terms just use the D pad to scroll through. But once you’re happy press the right D pad button and then accept the terms. Then select the Start button and the console will copy the update file over to its internal hard drive. Once that’s copied over the PS3 will reboot and drop you into System Update mode.

Now you just need to press the PlayStation button on your controller to start the update installation. Once again just leave this running until the console reboots.

Once you reboot you’ll see a slightly different boot sequence but then drop into what looks like the normal login screen. But you’re now running a fully custom firmware PS3.

Just log in as your temporary user for now so we can start to clean up the machine.

If you go to the far left on the XMB you’ll see the user menu. Highlight the temporary user and click the triangle button to bring up the options. We just need to delete this user account as we’ve finished the custom firmware installation.

If you now go to the Settings Menu and then System Settings. Down at the bottom, we’ve got the System Information option. This should now show that you’re running the EvilNat formware. Congratulations, everything is working!

Installing a Package File

We now need to start using our Homebrew features.

On the XMB go over to the Game menu and you’ll see a new option, Package Manager.

Package manager is the base application on your jailbroken PS3. It allows you to install other Homebrew programs from their package files. If you remember we downloaded the multiManapp as .pkg package file so let’s install that.

Open up package manager and select the Install Package option. You’ll see there are a number of options on where to install packages from. We put the package into the root folder of our USB drive, so make sure that’s connected and select the Standard option.

You should now see the multiMan package file listed along with any other packages you downloaded. Select multiMan and click the X button. This will now copy the code to the internal hard drive and install it. This will take a few seconds to complete but once finished click the circle button and you should return to the XMB and see a multiMan icon sitting in the games list.

We can now run that by just selecting it.

If this is the first time running the app you’ll need to Ok a number of terms pages before the app sets itself. But once completed you should now be in the multiMan XMB.

Playing and Copying Games

MultiMan is packed with useful tools to help us work with our hacked PS3. But the main thing most of us will want to use it for is to play games.

MultiMan let’s us play games from the original DVDs and from backup files on a USB drive,  but will also let us copy those games to our internal hard drive and play them from there.

So I’ve got a DVD for Gran Tourismo in my console so I could obviously just launch that as normal and play the game. But if I select the game and then click the triangle button I get a range of options pop up. One is to copy the game to my internal hard drive. So if I select that multiMan will start to copy the game files over to a GAMES folder on my hard drive. This process will take a while so let’s leave it copying and come back when it’s finished.

Once that’s finished the game is now fully installed onto our internal hard drive. I can eject the DVD and I should still have the hard drive version of the game listed in MultiMan.

MultiMan is a game launcher. If I select the game and click to play it MultiMan will mount my hard drive files as sort of a virtual DVD and drop me back into the normal XMB. In the games list I’ll now find the game listed and I can play it as normal. All my game saves and achievements will work as they should but I no longer need to insert the game disks.

Using Game Backup Files

So that’s how you can backup your own games and keep your BluRay disks safe. But I guess we should also look at how you can use other game backups.

Downloading Backup Files

As we all know it’s not that hard to find game backup files available for download on the Internet. But please do check out my retro gaming copyright video to make sure you stay legal when you game.

Backup File Types

There are 3 main backup file types.

ISO files are straight game disk images usually supplied in a .ios format. To use these you need to copy the iso file to a PS3ISO folder in the root of a USB drive which you then connect to your jailbroken PS3. MultiMan will be able to detect the game and allow you to copy it to your internal hard drive.

JB folder games (Jail Break folder) are essentially the files created by MultiMan when it copies a game from the original disk to your console. These files need to be kept in a folder and put into a GAMES folder on the root of your USB drive. Again MultiMan will detect these games and offer to copy them to your internal hard drive.

Rap / Pkg format backups are backups of games downloaded from the PlayStation Network. These require a bit more setup so I’ll cover these in a more in depth backup video later.

What Next?

Well, you’ve not got a jailbroken PS3 with a full custom firmware installation. What else can you do with it?

So far we’ve looked at playing any PS3 game you want, but you can expand this to any PS2, PS1 or PSP game, again from backup files. The homebrew library also contains many retro console emulators so you can turn the PS3 into a Super NES, Megadrive, Arcade emulator and so on. Plus there’s a wealth of original homebrew apps and games to start experimenting with.

Over the next few videos I’ll start to cover many of these topics and show you how to get the most from this great console. So please do make sure to like this video and subscribe to the channel to make sure you get notified about the new videos as I release them.

I hope you’ve enjoyed this episode and that you’ll hack your console to unleash its full potential.