PS3 4.88.2 Evilnat Cobra (8.3) Custom FirmWare (CFW-CEX) Released

UPDATE 4.88.2: PS3 Developer @Evilnat has updated and released 4.88.2 Evilnat (Cobra 8.3) CFW , there is a number of new options like an added File manager, Option to toggle Cobra version, and various other new options detailed in the changlog provided below. Also the developer has provided a number of fixes and improvements, View all the details of 4.88.2 release of this latest CFW by @Evilnat

.Original release (4.88.1) Developer @Evilnat (creator of releases like SEN Enabler and PAUD Unpacker) has created and released 4.88 EVILNAT's COBRA CFW, following the success of 4.87 Evilnat's CFW, the developer provides another trusted CFW release that provides the Cobra Payload and all the features it brings (note: MAMBA is an alternative to the Cobra Payload, Cobra is included in firmware's where as MAMBA is typically injected in a Standard CEX CFW via a homebrew app. See all the details of this CFW Release below

Also Included are: noBD / noBT / noBD & noBT CFW Builds (for damaged console's to make them usable again)
-STLcardsWS​



CFW Evilnat.png

  • 4.88.2 EVILNAT (COBRA 8.3)

    Changelog
    • Fixed memory leak in LV2 kernel while Cobra is enabled
    • Added option to dump ERK (eid_root_key) through xai_plugin (from flatz's EID root key dumper)
    • Added option to dump LV2 through xai_plugin
    • Added option to dump LV1 through xai_plugin
    • Added File Manager in xai_plugin (by DeViL303)
    • Added option to toggle Cobra version, release (default in CFW) and debug (get debug logs through socat)
    • Manual FAN speed now works with Cobra disabled too
    • Added system to block login in on PSN/SEN while CFW syscalls are enabled (by DeViL303)
    • Added sort games by name and date options (by aldostools)
    • xai_plugin translated to Brazilian (thanks to jcorrea and LuanTeles)
    • xai_plugin translated to Polish (thanks to KcrPLo and Agrippa)
    • xai_plugin translated to Italian (thanks to Sheireen)
    • xai_plugin translated to Chinese Traditional/Simplified (thanks to xiaoyang)
    • xai_plugin translated to Spanish

    Features
    • Made out of 4.88 OFW
    • Made manually without automatic tools
    • SEN/PSN enabled
    • Disabled deletion of unsigned act.dat and .rif files
    • Allowed unsigned act.dat and .rif files
    • Allowed running of unsigned applications
    • Compatibility with FSELF
    • C00 demo unlocker
    • Disabled LIC.EDAT license check
    • Can be installed over 3.55 OFW
    • Can be installed over +3.56 OFW (bguerville Toolset)
    • Can be installed over any CFW CEX
    • COBRA 8.3 added and enabled as default
    • Full PS2 Games Compatibility
    • Possibility of Downgrade from any CFW with active QA Flags
    • QA Flags active if previously enabled
    • Disabled Epilepsy Message on Boot
    • Compatibility with PSX games in ISO
    • Compatibility with PSP games in ISO
    • Compatibility with PS2 games in ISO
    • Compatibility with PS3 games in ISO/JB folder format
    • Compatibility with ReactPSN
    • Display of Temperatures in XMB In-Game on PS2 Games
    • RSOD Screen Bypass
    • BSOD Screen Bypass
    • PS3_GAME/app_home
    • XMB In-Game Screenshot
    • Added Package Manager
    • CoreOS Hash Check patched to prevent Brick on non-dehashed Downgradate consoles
    • Patched to remove LV2 Protection
    • Peek and Poke (LV2)
    • Peek and Poke (LV1)
    • CINAVIA protection disabled
    • Option to sort games by name and date

    Cobra 8.3
    • Failsafe Cobra stage2 (by bguerville/aldo)
    • Restore CFW Syscalls without reboot just entering to 'Settings > System Update' on XMB (by aldo)
    • Integrated Dynamic Control FAN (to control fan when webMAN is unloaded) (by aldo/Evilnat)
    • Support Photo GUI integration with webMAN MOD (mount games from 'Photo' column) (by aldo/DeViL303)
    • Get/Set FAN speed (by aldo)
    • Enable/disable features: Photo GUI, Restore Syscalls (by aldo)
    • Opcode to create CFW Syscalls (6, 7, 8, 9, 10, 11, 15, 35) (by aldo)
    • Opcode to set fake accountID (by Evilnat)
    • Opcode to activate account (act.dat) (by Evilnat)
    • Opcode to create license (RIF) (by Evilnat)
    • Updated ps3mapi_load_process_modules to load custom modules and system modules (by haxxxen)
    • Added ps3mapi_get_process_module_info
    • Increased from 24 to 32 the max number of map paths (by aldo)
    • Added sm_get_temperature patch in kernel (by Evilnat)
    • Added sm_get_fan_policy patch in kernel (by Evilnat)
    • Added sm_set_fan_policy patch in kernel (by Evilnat)
    • Fixed Control FAN payload, avoids loading previous mode (by Evilnat)
    • Disable stage2.bin while Recovery Menu is loaded (by haxxxen)
    • Fixed max FAN speed after shutdown (by Evilnat)
    • Improved Habib's QA flags code imported by aldostools (by Evilnat)
    • Fixed black screen in CFW2OFW converted games (by Evilnat)
    • Added sm_ring_buzzer with single_beep, double_beep and triple_beep (by Evilnat)
    • Skip license creation (rif) if it already exists (by aldo)
    • Added cellFsMkdir symbol (by Evilnat)
    • Added constant FAN Speed while a PS2 ISO is launched (by Evilnat)
    • Check/Disable/Enable QA Flags (by Evilnat)
    • Creation of act.dat while launching a PSN game (by Evilnat)
    • Convert someones's else savedata to your own savedata (by Evilnat)
    • Block Log In on PSN/SEN when CFW syscalls are enabled (by DeViL303)

    Tested in:
    • CECH-2000A
    • CECH-2000B
    • CECH-2001A
    • CECH-2002B
    • CECH-2004A
    • CECH-2012A
    • CECH-2104B
    • CECH-2500A
    • CECH-2501A
    • CECH-2504A
    • CECH-2511A
    • CECH-2511B
    • CECH-L04
    • CECHA01
    • CECHE01
    • CECHB01
    • CECHC04
    • CECHG01
    • CECHP01

    Improvements xai plugin


    These options are in Network tab under [★ Custom Firmware Tools] option:

    Power Options
    • Turn Off: Turns off the PS3
    • Hard Reboot: Reboots the PS3 completely
    • Soft Reboot: Reboots the PS3 softly
    • Reboot LV2: Reboots the LV2

    File Manager
    • Internal Hard Disk Drive 0: Manage PS3 files in /dev_hdd0
    • Internal Hard Disk Drive 1: Manage PS3 cached files in /dev_hdd1
    • USB Mass Storage Devices: Manage files on your USB devices
    • Internal Flash Memory: Manage PS3 internal flash files
    • Optical Disc: Manage optical discs
    • Memory Cards: Manage memory cards

    Basic Tools
    • FAN Speed: Shows current FAN speed
    • PS3 Temperature: Shows current CPU and RSX temperature
    • Show IDPS: Shows current IDPS
    • Show PSID: Shows current PSID
    • Toggle Coldboot: Toggles between custom/original coldboot.raf
    • Toggle System Version: Toggles between custom/original system version in "System Information"

    Basic Tools > xRegistry Tools

    • Backup xRegistry.sys: Creates a backup of xRegistry.sys to /dev_usb or /dev_hdd0
    • Button Assignment: Switches O and X buttons

    Cobra Tools
    • Cobra Information: Shows current Cobra information
    • Check Syscall 8: Checks Cobra's Syscall 8 status
    • Create Syscalls: Create syscalls 6, 7, 8, 9, 10, 11, 15 and 35
    • Allow Restore Syscalls: Allows restoring syscalls through "System Update"
    • Skip license creation: Skips overwriting license file (RIF) if it already exists
    • Toggle Cobra Version: Toggles between release and debug versions (reboot is required)
    • Toggle Cobra: Enables or disables Cobra (reboot is required)

    Cobra Tools > FAN Tools
    • Control FAN Mode: DISABLED: Disables Cobra's Control FAN
    • Control FAN Mode: SYSCON: Allows the PS3's SYSCON to control FAN speed
    • Control FAN Mode: MAX: Set Cobra FAN speed to 0xFF

    Cobra Tools > QA Tools
    • Check QA Flags: Check if QA flags are enabled or disabled
    • Enable QA Flags: Enables QA Flags
    • Disable QA Flags: Disables QA Flags

    Cobra Tools > FAN Tools > Dynamic FAN Control
    • Maximum temperature: 60°C: Sets the fan speed dynamically to keep the system at a maximum temperature of 60°C
    • Maximum Temperature: 65°C: Sets the fan speed dynamically to keep the system at a maximum temperature of 65°C
    • Maximum Temperature: 70°C: Sets the fan speed dynamically to keep the system at a maximum temperature of 70°C
    • Maximum Temperature: 75°C: Sets the fan speed dynamically to keep the system at a maximum temperature of 75°C

    WARNING: Some PS3 cannot reach/stay some option temperatures, use with caution

    Cobra Tools > FAN Tools > Manual Speed
    • Manual Speed: 40%: Sets the fan speed statically at 40% (0x67)
    • Manual Speed: 45%: Sets the fan speed statically at 45% (0x75)
    • Manual Speed: 50%: Sets the fan speed statically at 50% (0x80)
    • Manual Speed: 55%: Sets the fan speed statically at 55% (0x8E)
    • Manual Speed: 60%: Sets the fan speed statically at 60% (0x9B)
    • Manual Speed: 65%: Sets the fan speed statically at 65% (0xA8)
    • Manual Speed: 70%: Sets the fan speed statically at 70% (0xB5)
    • Manual Speed: 75%: Sets the fan speed statically at 75% (0xC0)
    • Manual Speed: 80%: Sets the fan speed statically at 80% (0xCE)
    • Manual Speed: 85%: Sets the fan speed statically at 85% (0xDA)
    • Manual Speed: 90%: Sets the fan speed statically at 90% (0xE7)
    • Manual Speed: 95%: Sets the fan speed statically at 95% (0xF4)

    WARNING: The chosen speed will be static, it will not be changed at any time automatically

    Cobra Tools > FAN Tools > PS2 FAN

    • PS2 Fan Mode: DISABLED: Disables Control FAN on PS2 game
    • PS2 Fan Mode: SYSCON: Allows the PS3's SYSCON to control FAN speed on PS2 game
    • PS2 Fan Mode: 40%: Sets FAN speed to 0x66 on PS2 game
    • PS2 Fan Mode: 50%: Sets FAN speed to 0x80 on PS2 game
    • PS2 Fan Mode: 60%: Sets FAN speed to 0x9A on PS2 game
    • PS2 Fan Mode: 70%: Sets FAN speed to 0xB4 on PS2 game
    • PS2 Fan Mode: 80%: Sets FAN speed to 0xCE on PS2 game
    • PS2 Fan Mode: 90%: Sets FAN speed to 0xE8 on PS2 game

    WARNING: There is no Control FAN in a PS2 game, select with caution

    PSN Tools
    • Disable Syscalls: Disables syscalls and remove history files
    • Show accountID: Shows current user's accountID
    • Create accountID: Creates a fake accountID for current user's in xRegistry
    • Overwrite accountID: Overwrites current user's accountID with a fake one in xRegistry
    • Activate account: Creates act.dat file in the current local account
    • Create license: Creates RIF licenses from RAP files from "x:\exdata"
    • Backup activation file: Creates a backup of act.dat to /dev_usb or /dev_hdd0
    • Disable account: Deletes current user's activation file act.dat permanently
    • Convert savedata: Converts savedata from "/dev_usbXXX/PS3/SAVEDATA" to your own savedata

    Dump Tools
    • View Log: http://localhost/dev_hdd0/tmp/cfw_settings.log (webMAN MOD is required for this function)
    • Clean Log File: Resets /dev_hdd0/tmp/cfw_settings.log file
    • Dump IDPS: Saves IDPS to log file
    • Dump PSID: Saves PSID to log file
    • Dump LV2: Dumps LV2 to /dev_usb or /dev_hdd0/tmp
    • Dump LV1: Dumps LV1 to /dev_usb or /dev_hdd0/tmp
    • Dump ERK: Dumps eid_root_key to /dev_usb or /dev_hdd0/tmp
    • Log KLicense usage: Saves filename and klicensee to log file
    • Log Secure File ID usage: Writes save data name and file ID key to log file
    • Dump Disc Hash Key: Retrieves disc hash key from an ORIGINAL game disc

    Service Tools
    • Display Applicable Version: Displays minimum downgrade version
    • Check File System: Reboots and allows you to check and repair filesystem
    • Rebuild Database: Reboots with Database rebuilding flag set
    • Toggle Recovery Mode: Reboot to Recovery Mode (Not supported on NAND models!)

    Service Tools > Advanced Service Tools
    • RSOD fix: Re-initialize VTRM-Region to attempt to fix RSOD
    • Toggle Factory Service Mode: Enter/Exit Factory Service Mode (DON'T INSTALL CFW ON FSM)
    • Remarry Bluray Drive: Requires: Enter to FSM and copy "eid_root_key" to /dev_usb
    • Load LV2 kernel: Loads lv2_kernel.self file from /dev_usb000 or /dev_flash


    Savegames conversion tutorial

    WARNING: This option will overwrite your current savedata in dev_usbXXX, use it with caution

    • Download someone else's savegame for your game of your choice
    • Put the savedata in your pendrive in "X:\PS3\SAVEDATA" (pendrive must be in FAT32)
    • Put in the pendrive in the PS3
    • Select Network Tab > [★ Custom Firmware Tools] > PSN Tools > Convert Savedata
    • Wait until the conversion finishes
    • Once finished, copy your converted savedata throught XMB "Saved Data Utility (PS3)"
    • Launch your game and load your new savedata


    Creation of act.dat tutorial

    WARNING: The accountID is linked to savedata and trophies, so, if your current user already have a valid accountID and you overwrite it, you will be unable to use your trophies and savedata on that account until you restore the original accountID in xRegistry.sys.


    I recommend to use an empty account without trophies and savedata or an account without accountID.


    To create a fake act.dat, Cobra 8.3 must be enabled, and your PS3 must have at least one account with a valid accountID and launch a game that requires a RIF/RAP license file.

    Cobra will search a valid accountID in all existing accounts and create act.dat while the game is launched through the XMB. If no accountID is found, act.dat will not be created.

    You can create a fake accountID (like reactPSN), to do this go to Network > ★ Custom Firmware Tools > PSN Tools and choose between "Create accountID" or "Overwrite accountID" (Be careful about the last option because if you already have a fake/real accountID it will be overwritten). It is recommended to use these options in an account that does not have an ID. The PS3 will restart if everything went well.

    The tutorial would be the following:
    • Download your purchased PSN game from PS Store
    • Put game RAP file in "X:\exdata" or "/dev_hdd0/exdata"
    • Launch your purchased PSN game
    • Cobra will check if any of your PS3 accounts have accountID
    • Faked act.dat will be created while the game is launching

    If none of your accounts have a valid accountID you will need to create it. To do this log into the local PS3 account where you want to create the accountID. You can see if your current local account has an accountID choosing Network Tab > [★ Custom Firmware Tools] > PSN Tools > Show accountID.

    To create a faked act.dat do the following:
    • Make sure Cobra 8.3 is enabled
    • Select Network Tab > [★ Custom Firmware Tools] > PSN Tools > Create accountID
    • Select Network Tab > [★ Custom Firmware Tools] > PSN Tools > Activate account
    • Launch your purchased PSN game
    • Faked act.dat will be created while the game is launching

    Now you have a faked act.dat and your local account is activated. The act.dat file works for every local account, you only need one file for all accounts.


    Block PSN log in

    This method is developed by @DeViL303, it will only work with Cobra enabled, Cobra will block log in on PSN/SEN while the CFW syscalls are enabled, to enable it again you need to disable CFW syscalls completely (you can do it with webMAN MOD, psnpatch, SEN Enabler, etc…).

    If you want to disable this feature, simply delete /dev_flash/vsh/resource/npsignin_plugin.lck


    Translations


    Final Words

    I hope that the CFW is working fine and without issues for everyone, but if you see any issue, please let me know in my twitter and I will try to fix it as soon as possible: @xXEvilnatXx

    Cobra 8.3 and xai_plugin source code can be found in my Github repository:


    Credits and Acknowledgment

    Credits to Team Rebug, Team Cobra, @mysis, @Joonie, @habib, @aldostools, @haxxxen, @DeViL303, @zecoxao, @3141card, @Berion, @kakaroto, @KW, @naehrwert, @flatz, @Dean, @Rogero, @Estwald and anyone who has contributed to the PS3 scene.

    Thanks to @DeViL303, @Berion, @Brandon Stump, @jcorrea, @nhie07, @NSC-Modz, @LuanTeles, @thejavigames, @raidriar, @xiaoyang, @Zwei, @haxxxen, @RetroFan_90, @SpyroMancer, @patricksouza472, @MrYadro, @CFW-Us3r, @Andrio, @KcrPLo, Nur Rakhmadi Rajab, @Lwiz, @Sheireen, @TheWizWiki and all who helped me testing the CFW 4.88.

    If I forgot someone, I apologize, there are many people in the PS3 scene and you are many people who
    have helped me to test the CFW.



Download: MEGA FOLDER WITH ALL CFW VERSION

Download: CFW EVILNAT 4.88.2 COBRA 8.3 [CEX]
MD5: 3202971E05140F24E52B36D5C443AD35

Download: CFW EVILNAT 4.88.2 COBRA 8.3 [CEX] [noBD]

MD5: 80029DC0FBD238DAF8ED45BCDFD04CD6

Download:CFW EVILNAT 4.88.2 COBRA 8.3 [CEX] [noBT]
MD5: 360569FE808B1815BD05258C8496003F

Download: CFW EVILNAT 4.88.2 COBRA 8.3 [CEX] [noBD] [noBT]
MD5: D8BB1F47B77F1737F974308B935F81B6
 
Last edited by a moderator:
Hello another newbie question,

I have this Evilnat operating system running great, super reliable. Most of the games I have are the updated PKG type, but I have a few which are game folders only, is the only way to run them to go into multiman and run them or can you make them appear in the usual games list like other games.

My kids love portal ( and me!) and I cant see any other way to get it play than through multiman. not outrageous but I like to make things as simple as possible. thxs
There are 2 main categories of ps3 games, the retail discs & the PSN games distributed online.
Retail disc backups come in 2 different types, iso format & legacy JB folder format (folders & files).

Legacy JB folder format should be supported by all backup managers including multiman just like ISO format, but unlike games in the PSN pkg format (pkg files downloaded from PSN), retail disc backups only get listed as mountable backups, they only appear on XMB one at a time when mounted just like an inserted retail disc does, and you only get a list of those games inside backup managers.
Unless you have specific reasons to use legacy JB folder format, you should favour backups in ISO format..
 
Hello another newbie question,

I have this Evilnat operating system running great, super reliable. Most of the games I have are the updated PKG type, but I have a few which are game folders only, is the only way to run them to go into multiman and run them or can you make them appear in the usual games list like other games.

My kids love portal ( and me!) and I cant see any other way to get it play than through multiman. not outrageous but I like to make things as simple as possible. thxs

If the games are in folder format, they should be in Games folder, under hdd0 partition.

Installing webman mod, when it scans for games they should appear under ps3 games in webman games folder on XMB
 
why can't i modify the vsh.elf? if i edit it and resign it, when i reboot the console won't start at all and i have to recover it.
never had this issue in older cfws
 
why can't i modify the vsh.elf? if i edit it and resign it, when i reboot the console won't start at all and i have to recover it.
never had this issue in older cfws

You must resign vsh.elf with the same parameters of the original vsh.self
To do it, copy the unmodified vsh.self to vsh.self_ORIGINAL, then sign vsh.elf with this command:

scetool --sce-type=SELF --compress-data=TRUE --template=vsh.self_ORIGINAL --encrypt "vsh.elf" "vsh.self"

Be aware that modifying vsh.self could require update the VSH_HASH in Cobra / Mamba.
Otherwise some patches to VSH won't be applied and ps2 emulation will be broken.
 
You must resign vsh.elf with the same parameters of the original vsh.self
To do it, copy the unmodified vsh.self to vsh.self_ORIGINAL, then sign vsh.elf with this command:

scetool --sce-type=SELF --compress-data=TRUE --template=vsh.self_ORIGINAL --encrypt "vsh.elf" "vsh.self"

Be aware that modifying vsh.self could require update the VSH_HASH in Cobra / Mamba.
Otherwise some patches to VSH won't be applied and ps2 emulation will be broken.
thank you, this works.
By the way any idea why if i attach to vsh.self process with ccapi it only reads as null bytes? tried to scan it fully and it's all 00, i wanted first to poke the edits i wanted to do, now i can only edit the elf completely with the method you mentioned but i can't do pokes
 
thank you, this works.
By the way any idea why if i attach to vsh.self process with ccapi it only reads as null bytes? tried to scan it fully and it's all 00, i wanted first to poke the edits i wanted to do, now i can only edit the elf completely with the method you mentioned but i can't do pokes

Try /home.ps3mapi in webMAN MOD... I don't use ccapi. Maybe it's using a hash check.
 
I installed 4.86 rebug hfw 4.88 then I installed 4.88.2 evilnat 4.86 rebug 4.86 I got bored I went back to 4.88.2 evilnat again evilnat seems faster to me
 
my game 4.86 rebug plays well 4.88 bad It stutters a bit. Have you made any changes that will affect the performance of the games?
 
  • PS3 Temperature: Shows current CPU and RSX temperature It shows 70 degrees, I enter multimane, I enter 68 irisman, it shows 68 there, there is 2 degrees of fluctuation
 
Any plans on making evilnat CFW for DEX? It would be nice to have all these new features and Cobra 8.3 on 4.84 DEX
Evilnat has not been around for some time, there has never been any plans to make a DEX release with old files, Rebug REX 4.84.2 stands as the last DEX compatible CFW but you can update it manually.

Afaik Evilnat updated both Cobra for Rebug REX 4.84.2 & the xai_plugin source.
Check his github repositories.

He may also have posted a repack of a Rebug REX 4.84.2 PUP with updated Cobra somewhere in this forum months ago if that's what you are really looking for..
 
I am using the TrueAncestor SELF Resigner to reencrypt the SELF files and I am decrypting the PS1 emulator SELF files using the "Decrypt SELF/SPRX only" option. Is the "Custom Sign NON-DRM SELF" option enough to encrypt the file properly?

EDIT: I have used a scetool and imported the keys from the webMAN. I decrypted the original self:
Code:
scetool.exe -d ps1_netemu.self ps1_netemu.elf
then modified the ELF file and encrypted using this command:
Code:
scetool.exe --sce-type=SELF --compress-data=TRUE --template=ps1_netemu.self_ORIGINAL --encrypt ps1_netemu.elf ps1_netemu.self

The resulting SELF file is 28 KB smaller than the original one. Is that alright?
 
Last edited:
I am using the TrueAncestor SELF Resigner to reencrypt the SELF files and I am decrypting the PS1 emulator SELF files using the "Decrypt SELF/SPRX only" option. Is the "Custom Sign NON-DRM SELF" option enough to encrypt the file properly?
then modified the ELF file and encrypted using this command:
Code:
scetool.exe --sce-type=SELF --compress-data=TRUE --template=ps1_netemu.self_ORIGINAL --encrypt ps1_netemu.elf ps1_netemu.self

The resulting SELF file is 28 KB smaller than the original one. Is that alright?

It's normal if the original self is not compressed. Check if using --compress-data=FALSE returns the same size.
 
Yes, of course. I do not know where the size difference comes from.

Is there any way to perform the debugging without the ProDG and DEX mode? I am interested in setting the R/W breakpoints (not available in the RPCS3) and searching the memory while the PS1 emulator is running. Is that possible at all?
 
Yes, of course. I do not know where the size difference comes from.

Is there any way to perform the debugging without the ProDG and DEX mode? I am interested in setting the R/W breakpoints (not available in the RPCS3) and searching the memory while the PS1 emulator is running. Is that possible at all?

You can modify Mamba or Cobra to add hooks and debug messages in the events that you want.

ProDG would be the easiest way without having the code/build a new payload.

If you have Evilnat 4.88.2 you can check if using the debug stage2 provides the information that you need. The option is found in Network > CFW Tools > Cobra > Toggle Cobra Version

You will need to run socat to capture the debug messages on the PC
Code:
socat -u udp-recv:18194 stdout
 
Back
Top