PS3 4.75 CFW -- FERROX (Standard-CEX) by Alexander

Following the recent release of his 4.75 Dual Boot Firmware, developer Alexander has now also released a Standard CEX CFW for firmware 4.75 with the release of "4.75 FERROX v1.00". As many of you know for those of you who do not, this comes with the common standard cfw features as listed in the feature list, No native COBRA CFW features are present in the Custom Firmware but various features such as using background loading plugins & ISO Support can be achieved by the Mamba payload & other homebrew apps/utility on a standard CFW such as this one. If you need to find all [break]ss[/break]the updated Applications and Tools updated for 4.75 view this thread for all your 4.75 CFW needs.



4.75ferrox.PNG
​
4.75 FERROX (v1.00) - by Alexander
​
Based on FW:
FW Type:CFW Type:MD5 Checksum:

  • 4.75

  • CEX

  • Standard

  • 6ADE146697DB3089A71510480C66D42D
FEATURES OF 4.75 FERROX (v1.00)
  • Built-based OFW 4.75
  • Disabled the CoreOS and control ECDSA
  • LV1: patched to remove the protection LV2
  • LV1: patched CoreOS Hash Check (prevents brick from the console downgradate not dehashed)
  • LV1: Peek & Poke
  • LV2: Peek & Poke
  • Compatibility PS2 Games
  • Compatibility PSP Remastered
  • Compatibility PSP Minis
  • Key 4.75 (start games with keys 4.70 EBOOT / sprx)
  • PSN / SEN Enabled.
  • RSOD Screen Bypass for consoles suffering from RSOD
  • BT Remote PS3 patch
  • PS3 BluRay DISC patch
  • Compatibility with the latest version of REACTPSN
  • App_home / PS3_GAME *
  • Install Package Files *
  • Ability to Downgrade from OFW 3:55 with QA activated.
  • Upgradable from any CFW's
  • Support XMB InGame ScreenShot Feature
  • Support Remote Play Feature
  • Stability as nell'OFW 4.75
  • Ability to downgrade from any custom firmware with QA activated.

PS3 Models Tested:
  • CECH 2004A - Tested and Working. (Thanks Mizio)
  • CECH 2004b - Tested and Working. (Thanks Mizio)
  • CECHG04 - Tested and Working. (Thanks SNK)
  • CECHL-01A - Tested and Working.
  • CECH-2501 - Tested and Working. (Thanks REIZA72)
  • CECH 2504A - Tested and Working.
  • CECHC-04 - Tested and Working.
  • CECHL04 - Tested and Working

HOMEBREW TESTED:


It is recommended that, after a successful installation of custom firmware, run:​


  • [*=center] Restore File System (Recovery)
    [*=center] Rebuild Database (Recovery)
This is done so, you will have a clean installation and you'll be fine. (. (Thanks to franci97 & SonyForever))
​
Click to expand...
Click to expand...

Download: FERROX 4.75 (1.00) (MD5: 6ADE146697DB3089A71510480C66D42D)
INSTALL CFW AT YOUR OWN RISK


Source: openmodding.net
Checkout CFW / Apps / Tools and more updated for 4.75 ---- > LINK



Official Firmware users': YOU CAN NOT INSTALL THIS CFW ON OFW FIRMWARE ABOVE 3.55 OFW:
Use this utility for additional info about your PS3 Model and the possibility of Downgrading
​
 
Click to expand...
kozarovv
This depend on what you want from that cfw. If you looking for stable non cobra system then ferrox or habib noncobra, If you are enjoying cobra functions then habib cobra beta 0,4. If you want to swap between cobra - noncobra, cex-dex, and have aditional features then Rebug is best option. Also all mentioned fw are stable.
 
A
kozarovv said:
This depend on what you want from that cfw. If you looking for stable non cobra system then ferrox or habib noncobra, If you are enjoying cobra functions then habib cobra beta 0,4. If you want to swap between cobra - noncobra, cex-dex, and have aditional features then Rebug is best option. Also all mentioned fw are stable.
Click to expand...

cobra and play online with psnpatch...
 
kozarovv
Then probably habib, or rebug. Habib is less modified so in theory can be safer, but i'm using rebug online without issues (one week for now). Just changed xmb mode to retail and debug menu to cex qa.
 
A
kozarovv said:
Then probably habib, or rebug. Habib is less modified so in theory can be safer, but i'm using rebug online without issues (one week for now). Just changed xmb mode to retail and debug menu to cex qa.
Click to expand...

thank you ok habib....less complicated i want use psid from my PSP for PS3 with psnpatch
I hope it works!
 
G
Is this for ofw 4.75?

Sorry im wuite new with jailbreaking and my question is is this for the ofw 4.75 release? Will it work on that? Or do I have to wait ? Thx
 
bitsbubba
Gunxsord said:
Sorry im wuite new with jailbreaking and my question is is this for the ofw 4.75 release? Will it work on that? Or do I have to wait ? Thx
Click to expand...

depends on your model version on whether you can HARDWARE downgrade to 3.55 OFW (that is the only OFW you can install any CFW from)
 
pinky
bitsbubba said:
not unless someone wants to do a hell of alot of work because Sony fixed the security on fw above 3.55
Click to expand...

indeed. there were around 5 hardware tools used originally. I believe what happened was that geohot was able to get the public key from a flaw with the usb ports while an ocillator was used to retrieve the metldr key. someone is using the same method to get the new keys from the system, but the issues is lv 0.2 which seems to be a checksum of sorts. if u use PUAD, u'll get an error with the coreos since the lv 0.2 key is unknown. I believe that's also not part of the bootchain with 1 and 2K systems, only 3 and 4K which have new metldr and bootldr keys anyway. the metldr key was relatively easy to obtain since u can do so with the system on, but the bootldr key required turning the system on and off constantly as it's retrieved from a coldboot of the system. I'm not 100% certain of that, but that's my theory anyway.

edit: I forgot to mention that I believe the ps4 has an integrated lv0.2 with the pup file itself. that's what I believe pup 1 is within the pup file. it may be a key that cycles through the system similar to a rap2rif making a cfw next to impossible since we can't access the algorithm unless the firmware is decrypted, but we can't decrypt it without the algorithm. that's a theory as well, but it seems likely that sony would do something such as that for extra security. we know the ECDSA algorithm, but we wouldn't know that algorithm.

edit 2: oh, and the usb port flaw, 5 tools, and ocillator used to nab the metldr/bootldr keys is fact as it's documented. my belief on the purpose of lv 0.2, bootchain, and what's going on with the ps4 pup is theory.
 
Last edited:
pinky
btw, sony moved the usb further down the boot chain to prevent further hacks. I read extensively about how the hack was created originally way beyond the fail0verflow presentation. the hack didn't start when the system was released. it started around the time of the linux removal. it's been documented that it only took five weeks to hack the ps3 actually, because of a serious flaw that sony has since corrected. I'm not entirely sure how a number is randomized with ECDSA, but I'm assuming it's an n number in which n changes after going through the algorithm (i.e. n+1 =2, in which n was 1, but it becomes 2 afterword while going though the same algothrm). however, it might also do what klicenses do which r actually random bytes within lv 2. the system may grab a random byte to create a private key. my thinking has been that the random key (elliptical) is similar to the way in which a beginning and end point r determined by a base point. it could be the same process anyway - random but not random in the general sense.
 
Alexander
FERROX 4.76 & IrisMan 3.48.5 in Testing :

CECH2004A /0A : Working
CECHG04 : Working
2104A : Working
CEHCL : Working
2105AB/1C : Working
2105B/0D : Working

Since, the 476 has the lv2 identical to 475, I decided to " clone " payloads of 476 of those in the 475, without stopping to rewrite them all. (Although in the backup manager 475 appears instead of 476). As it has already been done for 465
The result is identical. The Games under mamba, work great and all our other features.
 
Last edited:
N
Alexander said:
FERROX 4.76 & IrisMan 3.48.5 in Testing :

CECH2004A /0A : Working
CECHG04 : Working
2104A : Working
CEHCL : Working
2105AB/1C : Working
2105B/0D : Working

Since, the 476 has the lv2 identical to 475, I decided to " clone " payloads of 476 of those in the 475, without stopping to rewrite them all. (Although in the backup manager 475 appears instead of 476). As it has already been done for 465
The result is identical. The Games under mamba, work great and all our other features.
Click to expand...

Waiting for it... Keep up the good work!
 
You must log in or register to reply here.

Similar threads

Featured content

Trending content

Latest posts

Back
Top