PS3 4.89 Jailbreaking - PS3 CFW (Custom Firmware Capable Models) Status + Warnings

[STLcardsWS]

​

PS3 CFW Models (Capable of CFW installation)

Status About Official PS3 Toolset Status FAQ - Unofficial Clones / DNS

• 
  
  • CFW <> CFW Installation: Yes
    • If you already have a Custom Firmware (CFW) installed (4.88 or lower) and wish to update to a 4.89 CFW,, just download the CFW and install via USB method.
    • Spoiler

      Download the update file to your computer, and then save it on a USB storage device. Copy the saved file to the system storage of your PS3 system to update the system.
      For the standard update procedure, follow the steps below.
      The following things are needed to perform the update:
      

      • PS3 system
      • Computer connected to the Internet
      • USB storage device, such as a USB flash drive

      * There must be approximately 320MB of free space.
      1. On the USB storage device, create folders for saving the update file.
      Using a computer, create a folder named "PS3". Inside that folder, create another folder named "UPDATE".
      2. Download the update file, and save it in the "UPDATE" folder you created in step 1.
      Save the file with the file name "PS3UPDAT.PUP".
      Right click and select "save as" to start the download.
      3. Connect the USB storage device that the update file is saved on to your PS3 system, and then from the function screen, select Settings > System Software Update.
      Follow the screens to complete the update.
      If your PS3 system does not recognize the update file, check that the folder names and file name are correct. Enter the folder names and file name in single-byte characters using uppercase letters. via
  • 4.89 OFW <> CFW Installation: No (See FAQ tab)
    • There is no short answer for this one you will need to read the next tabs to get a better idea and understanding on this answer to decide what is best for yourself.(See FAQ tab for more information)
    • Note: CFW can install directly from 3.55 and below (no hack needed just CFW PUP)
  
  PS3HEN updated Officially to 4.89 = Yes
  bguerville PS3 Toolset Officially Online? = No (Don't be fooled by imposter's)
  
• 
  
  Latest Public Updates​
  
  via bguerville
  
  The ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com domain (along with all the other domains esc0 registered) is gone, it was arbitrarily suspended without any explanation or chance of appeal (other than going to court), there's nothing we can do about it, don't blame us for the interruption of service, if you really must blame someone, blame GoDaddy.
  
  Without a working domain, a SSL certificate cannot be renewed and as the currently used certificate must have expired last week, in theory the PS3 Toolset should no longer be accessible, even using the DNS trick.
  
  There is no plan to release an offline version of the PS3 Toolset for the time being, there's no point asking, the PS3 Toolset will come back online under a new domain name, the URL to access it will be posted in this forum when the new setup is ready. And because that new setup will also aim at providing console development related hosting to the community, not just host the 2 ps3xploit sites and the no-psn site, we won't rush this new redeployment, it may take another week or 2 to sort out all the details, but even then that's really nothing in the great scheme of things.
  An announcement about all this will be made some time this month, in the meantime you all need to give us the space and time necessary for a proper redeployment, be patient.​
  
  
  via esc0rtd3w
  
  I think we are still waiting to hear back about SSL cert issue. There is also another issue with the new domain being flagged as spam, which is so ridiculous that it caught Ben and I by surprise. There is a temp workaround being done right now. I haven't talked to @bguerville in a few days now, but he has been in contact with the hosting and others to get these issues resolved.
  
  Hopefully, the toolset will be available soon.​
• 
  What are the unofficial clones exactly?
  
  • They are INCOMPLETE reversed portions of PS3 Toolset v1.1 . So they are not even the complete v1.1 . ts not exactly the toolset or how its designed to work. Its a hack and slash to get portions working but neglects other important aspects that prevents bricks in various scenario's. There are reports of successful patches using these clones but the problem is there is also reports of brick systems. Which was predicted by @bguerville when we seen these clones arise.
  
  Why did these clone's arise?
  
  • As mentioned there was a partial INCOMPLETE portion out there in the wild for over a year, but when official firmware 4.89 was released. bguerville was already about to unleash a new version of the toolset with some great new features for developer's and user's. However when 4.89 came out it made sense for the developer to roll everything out in one update and single testing session. Well that is when some of these people started to take advantage of the situation and started to roll out this incomplete version that was in the wild. So that revised bguerville plans and he decided to push a 4.89 update without the new features as initially planned..
  
  Why is the official bgtoolset (PS3 Toolset) offline now?
  
  • The domains of PS3Xploit ,com & .net were taken (info here ) and that has had a domino effect on getting the toolset back online. While PS3HEN and other PS3Xploit services are back online at ps3xploit.me , there is more complex issue that are keeping the Official PS3 Toolset offline.
  
  Should i trust the clone's?
  
  • NO
    • Reason #1: Its incomplete and while it can work it can also damage your PS3, there are various clones out there and some seem to be even more riskier then other's. A few of the brick reports (here) & (here)
    • Reason #2: There are rumors of Console ID's getting stolen through the process, this is unconfirmed but something that user's should be aware of that possibility, There have been reports of malicious code in some of the clones.
  
  What other's are saying about the Clone's?
  
  • bguerville: "Any Toolset alternative you may find out there is leaked, only partially working and generally untrustworthy."
    
  • Aldostools: "That site "works" because the script is based on an old unofficial dump of bgtoolset.The problem is that the script is only considering the happy path. Some exceptions are not considered and may result in a bricked console. It is like playing Russian roulette: You're free to play it if you want, but because 5 chambers are empty doesn't mean that you can't end finding the bullet." Other insights from Aldo (1)
    
  • Mr. Mario: "Have seen yet another person using an unofficial Toolset report they did all the steps, but now when they boot up their console it just has a black screen then turns off. Don't have any other details aside from what they described, but across multiple sites I've been seeing more bricks pop up from using these unofficial Toolsets."
  
  I am on 4.89 OFW but i do not want to use these clone's? What are my options?
  
  • Use the PS3HEN jailbreak (while not as feature rich as CFW, its has plenty of cfw features most user's will not see a difference (other's may) but its a great alternative until the official toolset is back online.
  
  Can i use the DNS Trick to access the official Toolset and is it safe?
  
  • bguerville mentioned a DNS trick but warned it would not last due to the SSL certs expiring,The certs have expired.
    • post (Aug 2) Until the ps3xploit domain issues are resolved, PS3 Toolset users wishing to access the site might still be able to do so using a custom Cloudflare DNS in the PS3 network settings.. .....
    • post (Aug 11) Yes, you should still be able to use that DNS trick temporarily however iirc the SSL certificate should expire soon and it won't be able to auto renew itself with the domain DNS servers reset the way they are, the ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com site should no longer be accessible whenever that happens, I don't recall the exact date though.
    • post (Aug 30) : Custom DNS usage is no longer in order, more likely to create problems than solve them for most users. To access the PS3 Toolset old domain, custom Cloudflare DNS won't help, SSL certificates could not be renewed without a functional domain so I removed ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com entries from CF.
    • There is no SAFE DNS Method
  
  

PS3 CFW vs PS3HEN
https://www.psx-place.com/threads/ps3-cfw-vs-ps3hen-comparing-ps3-exploits.38774/​

 

[STLcardsWS]

Hopefully this help answer some questions and provides some insight current status as it has got really confusing i am sure for some user's That is all we know, the toolset will be back but user's will have to be patient.

I wanted to give a bit of overview on the subject. If you see something wrong or want to add something
Please let me know @bguerville and @esc0rtd3w

 

[NiQ]

Hopefully this help answer some questions and provides some insight current status as it has got really confusing i am sure for some user's That is all we know, the toolset will be back but user's will have to be patient.

I wanted to give a bit of overview on the subject. If you see something wrong or want to add something
Please let me know @bguerville and @esc0rtd3w

The custom DNS posted on reddit is 100% real deal and not a clone. I can show you proof if you need.

 

[DeViL303]

The custom DNS posted on reddit is 100% real deal and not a clone. I can show you proof if you need.

Proof is always good, so go for it.

 

[RoboKing's Cosmos]

Should I uninstall Rebug and update back to EvilNat or stay on Rebug for now?

 

[STLcardsWS]

The custom DNS posted on reddit is 100% real deal and not a clone. I can show you proof if you need.

Proof is always good, so go for it.

This is very telling and why we should listen to the owner of the files and the person who designed and know how the toolset actually works.

Custom DNS usage is no longer in order, more likely to create problems than solve them for most users

So proof is not what is really the only thing that is needed .
What we need is for bguerville to say its good to use. because that is the only person who can give us an accurate answer to use this or not. There was something that made him make such a statement so i personally would not dismiss it..

I have seen several DNS methods and different IPs used, also a simple visual of a version number is not conformation as that can easily be edited. The one you are talking about could be connecting to the real one (or is not), but does not mean its safe if connecting to the real one. We can assume everything is okay, but that would simply be an assumption.

bguerville warned about the clones as well, and he was right about the bricks we would see, just makes sense to listen to his other concerns or wait until he can clarify.

 

[NiQ]

Proof is always good, so go for it.

Here you go -
Historical A records for ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com - SecurityTrails

This is a website that tracks history of DNS records. Think of it as the DNS equivalent of archive.org's wayback machine. It's incredibly thorough and has virtually every website I've tried. The website requires login to see record history but it's free and you can just get a password from bugmenot. You can see that throughout its history, ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com only had two associated IP address. The first is the Cloudflare IP address that no longer works, the second is the IP that the custom DNS from reddit redirects to. You can even add it to your local hosts file on your computer and check for yourself. And we're talking about DNS records from several months to several years ago, way before this whole mess started. This is not a clone (unless someone managed to create a clone of the website on the same IP address as the real one), it's the real website.

This is very telling and why we should listen to the owner of the files and the person who designed and know how the toolset actually works.



So proof is not what is really the only thing that is needed .
What we need is for bguerville to say its good to use. because that is the only person who can give us an accurate answer to use this or not. There was something that made him make such a statement so i personally would not dismiss it..

I have seen several DNS methods and different IPs used, also a simple visual of a version number is not conformation as that can easily be edited. The one you are talking about could be connecting to the real one (or is not), but does not mean its safe if connecting to the real one. We can assume everything is okay, but that would simply be an assumption.

bguerville warned about the clones as well, and he was right about the bricks we would see, just makes sense to listen to his other concerns or wait until he can clarify.

I never claimed that it's safe or not safe. The only thing I know is that it's the actual website, on bguerville's own server, and not a clone at all.

Should I uninstall Rebug and update back to EvilNat or stay on Rebug for now?

You can update directly from Rebug to Evilnat without having to go through OFW at all, and you can also return to rebug by setting the QA flag. As long as it's from CFW to another CFW that's no problem, just make sure not to go back to OFW (or HFW for that matter) or you'll need to wait or use an unofficial method if you want to install CFW again.

 

[puddii]

So by the time I got a PS3 and wanted to jailbreak it, the PSXploit site was already down, then the psx-place forums went down. Not knowing any better, I used bgtoolset on a site someone mirrored on their own server through a link from reddit. I jailbroke two PS3s with this link. Both were on OFW 4.89, and both worked. I would not recommend doing this or using any site off of reddit for anyone else, I was only alerted to the danger recently.

 

[DeViL303]

This is a website that tracks history of DNS records. Think of it as the DNS equivalent of archive.org's wayback machine. It's incredibly thorough and has virtually every website I've tried. The website requires login to see record history but it's free and you can just get a password from bugmenot. You can see that throughout its history, ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com only had two associated IP address. The first is the Cloudflare IP address that no longer works, the second is the IP that the custom DNS from reddit redirects to. You can even add it to your local hosts file on your computer and check for yourself. And we're talking about DNS records from several months to several years ago, way before this whole mess started. This is not a clone (unless someone managed to create a clone of the website on the same IP address as the real one), it's the real website.

For me that does not prove its "100%" the real website.

All that tells us is IP info, we have no way to know if the website is complete, has been edited, can access all files or has all functions working. I think when you say words like "100% real deal" and "it's the real website" you are really stretching it.

Now afterwards you say, "I never claimed it was safe".. So really you just had proof that the IP Address that the site once used is still active with at least some of the required files accessible, would that be more accurate?

 

[Coro]

You can even add it to your local hosts file on your computer and check for yourself.

as i said in the other thread, if this ip was any good, then i should be able to just type that number into address bar and it should work. but it does not work!

if all the "dns trick" does is redirect ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com to that ip, then how does it work if the ip itself does not work?

** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com is being redirected somewhere else by the dns servers. you type in the site address and it loads so people think that it is real.

 

[NiQ]

as i said in the other thread, if this ip was any good, then i should be able to just type that number into address bar and it should work. but it does not work!

if all the "dns trick" does is redirect ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com to that ip, then how does it work if the ip itself does not work?

** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com is being redirected somewhere else by the dns servers. you type in the site address and it loads so people think that it is real.

It doesn't work because if you type the IP address your computer doesn't send the necessary host header. Most websites these days need it. You can't browse to psx-place.com using its IP either.

 

[NiQ]

For me that does not prove its "100%" the real website.

All that tells us is IP info, we have no way to know if the website is complete, has been edited, can access all files or has all functions working. I think when you say words like "100% real deal" and "it's the real website" you are really stretching it.

Now afterwards you say, "I never claimed it was safe".. So really you just had proof that the IP Address that the site once used is still active with at least some of the required files accessible, would that be more accurate?

Well, I believe that the chances of someone actually getting access to the very same IP address that the site used to be on and then using it for a clone website, all while there's no official DNS record, is close are nil.
This is definitely the real website. Whether it's still completely functional and risk-free is not something I know. The only decent way of knowing that is following the reddit and checking how it ended for people who did use it.

Again - The only thing it does prove is that this isn't some Russian clone.

 

[DeViL303]

Again - The only thing it does prove is that this isn't some Russian clone.

I wonder if instead of "it's real website" and "100% real deal" you had said something like "The only thing I know is its not a Russian clone" in the FIRST place, then maybe I would not have had to ask you to prove it, and you would not have had to provide your "proof" that proves nothing about it being "real" .

Now we know what you really meant to say was "I can prove nothing, but I have a theory that it's 100% the real website, but I have no evidence for that"

This is why you did not show the proof in your initial statement here. Instead saying "I can show proof". This was very obvious and the whole reason I asked you for it.

 

[kostirez1]

as i said in the other thread, if this ip was any good, then i should be able to just type that number into address bar and it should work. but it does not work!

if all the "dns trick" does is redirect ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com to that ip, then how does it work if the ip itself does not work?

** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com is being redirected somewhere else by the dns servers. you type in the site address and it loads so people think that it is real.

This claim is built on a completely false assumption that the web server would send you a certificate for ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com just by visiting its IP address. This is not the case however, and never was. If the web server would ever do this, the common name field of the certificate wouldn't match the expected value - IP in this case. The browser has no other option than to reject the certificate as invalid. In order to solve this issue, and other issues from hosting multiple websites at the same IP, the SNI extension was added (https://en.wikipedia.org/wiki/Server_Name_Indication). This allows the browser to specify which domain it expects a certificate for and gives a web server ability to choose and send the right one.

It is true that some servers do a default redirect from unencrypted HTTP site to the encrypted one, with the right domain. But since ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com used to be hosted at shared hosting company, this is not the case. That's why only a placeholder page loads referring to MochaHost.

Well, I believe that the chances of someone actually getting access to the very same IP address that the site used to be on and then using it for a clone website, all while there's no official DNS record, is close are nil.

Consider another thing. Even if the attacker got the right server at the right company, how would he be able to get a valid certificate for it? Are we going to pretend that there's an exploit in Let's Encrypt's infrastructure that allows you to get a backdated certificate for an arbitrary domain without any checks? Together with fake certificate transparency entries at Google https://crt.sh/?id=6716453476? Or does he have an ability to bruteforce a private key that matches exactly the one the real website had? Why is he using this trillion dollar exploit to make a fake ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com website instead of stealing baking information and pushing out malware through OS update servers?

I'm not claiming that @bguerville still has access to his account at MochaHost, but it's simply a fact that it is the same server that hosted ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com till the moment it was taken down from Cloudflare authoritative servers. He also never said he lost the access, only that he prefers users not to visit it with an expired certificate (not a fake nor self-signed one!). Which is absolutely understandable, as most users accept any security related warning anyway, without checking the values.

 

[GuilloteTesla]

A server's IP that hosts web content and services does not work the same as a DNS server. They send different packets and comunicate in their own way over IP. They even use different protocols (web servers use TCP while DNS use UDP by default, and falls back to TCP when the packet is big).

A web server's IP address can be public and all, but is not guaranteed to work in a web browser for example, or even as a public API (the endpoint could require auth tokens, specific headers, content type, etc.).

The DNS on the other hand, acts like a phone book of IP addresses, taking all the web requests and redirecting them to the corresponding web server IP if it's mapped (even adding TSL, custom HTTP headers, query params, or just a plain redirect to a completely different URI: i.e. you type www.somewebsite.com in your browser -> DNS server recieves your request -> the domain name is resolved to 130.45.6.1/web/jhonny/site1). Think of it as some kind of "man-in-the-middle" that transforms the requests.

Here is a simple video showing how DNS works:

So, by putting a web server's IP in the PS3 Network DNS config and trying to reach out to it via the browser will not work (unless the web server has a DNS service integrated but that's an edge case).

If you put a web server's IP directly in your browser, then it may be able to reach to the server but you won't get a HTTP 200 OK response, getting a HTTP 4xx error response instead (because of missing auth token, headers, SSL, other data, in the web request packet).

 

[DeViL303]

I'm not claiming that @bguerville still has access to his account at MochaHost, but it's simply a fact that it is the same server that hosted ** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com till the moment it was taken down from Cloudflare authoritative servers

Jeez, idk why so many 2022 noobs popping out of nowhere want to defend using this server.. wtf.


The dev who created the exploit, and setup the server, who knows 100 times more than any of you, says not to use it, its not safe, you guys, who know F%$# all, want to tell everyone its 100% legit. why?

 

[kostirez1]

Jeez, idk why so many 2022 noobs popping out of nowhere want to defend using this server.. wtf.

Zero arguments against and immediately attempting to personally attack me. A true PSX-Place legend right there, unable to participate in a debate like a human.

The dev who created the exploit, and setup the server, who knows 100 times more than any of you, says not to use it, its not safe, you guys, who know F%$# all, want to tell everyone its 100% legit. why?

First off, you have no rights to judge our knowledge. Second of all, look at yourself first. All of your posts here spread fear without any factual reasons as to why it's wrong. Give us at least something instead of "I think someone else thinks it's bad, and you don't have any street cred to be trusted".

And yes, I know what @bguerville has said and also mostly understand why. I'm not pretending like I know everything, but you probably do, so please enlighten us. I'm also not going to participate in any cult like "This guy = good, anyone else = bad". Pretending like someone has a monopoly to speak about some topic. If we ever want progress, we cannot build our community on top of lies or attacking newcomers.

 

[DeViL303]

First off, you have no rights to judge our knowledge.

Well I just did judge your knowledge.. So that ship has sailed, you don't have to like it.

And yes, I know what @bguerville has said and also mostly understand why. I'm not pretending like I know everything, but you probably do, so please enlighten us. I'm also not going to participate in any cult like "This guy = good, anyone else = bad". Pretending like someone has a monopoly to speak about some topic. If we ever want progress, we cannot build our community on top of lies or attacking newcomers.

Never said I knew everything, but I will trust the devs word over a random new account any day of the week.

 

[RoboKing's Cosmos]

I deleted my PayPal account because of the $2,500 fine for misinformation they can do. But at least my donation got through to @LuanTeles before that. "Apparently PayPal is tired of losing customers so they're now keeping them hostage. Forcing you to call customer service instead of just doing it online."

 

[DeViL303]

I deleted my PayPal account because of the $2,500 fine for misinformation they can do. But at least my donation got through to @LuanTeles before that. "Apparently PayPal is tired of losing customers so they're now keeping them hostage. Forcing you to call customer service instead of just doing it online."

Same here, got rid of mine 24 hours ago. Scumbags to try sneak that in when they know no one normally has time to read all that crap.