Welcome to PS3Hax, your official PS3 hacks, PS3 Homebrew, and PS3 Downloads scene. Check back daily to keep up with the latest PS3 Hacks and drop by our forums for more PS3 Hacks discussions.
  • Posted by , on 29/10/2014 , @ 10:11pm


    Apparently there was a little confusion about this release earlier. Rebug had accidentally announced it on their site and then retracted it when we first reported on this story. It has since been re-announced over at rebug.me and we’re sorry for any misunderstandings that there may have been. It wasn’t our intention to create any tension within the community, we only wanted to share the good news we’ve all patiently waited for.

    With the good news, Rebug has also officially announced the two new team members we’ve been hearing about. Honestly, I don’t think many of us are too surprised by who they are, but we would like to congratulate and thank Habib & Joonie because we probably wouldn’t have seen this release without them. Of course, a big thanks goes out to everyone that has been involved in the making of this latest Rebug release. Many folks had surely assumed we wouldn’t see anymore from the team, and it’s certainly exhilarating to not only see a new Rebug release, but to see new talent added to the team.

    As always, Rebug has a very comprehensive list of features, changes, fixes, etcetera; so we’re only going to cover some of the big ones:


    • Dual LV2 Kernels CEX/DEX
      (Swap your EID0/LV2 kernel using Rebug Toolbox in seconds)
    • ALL Retail functions available in CEX mode
      (No need to install different firmware)
    • ALL Debug functions available in DEX mode
      (No need to install different firmware)
    • ProDG Connectivity in DEX mode
    • QA Token compatibility
    • OtherOS++ support enabled
      (Use Rebug Toolbox to Boot OtherOS with different LV1 patches)
    • Latest Version Spoof files
      (PSN/SEN Enabled for REBUG 4.21.1 and higher)
    • Package Manager
      (Replacement for the standard ‘Install Package Files’ option)


    • Rebug Toolbox 02.xx.xx
      (Install included Rebug Toolbox or higher for full compatibility)


    • LV1: Disable System Integrity Check
    • (Safe to use with mismatched COREOS/SYSCON versions or if PS3 is not QA enabled)
    • LV1: Undocumented function 114
      (Allow mapping of protected memory)
    • LV1: Skip all ACL Checks
      (Needed to allow booting of OtherOS)
    • LV1: Peek and Poke support
      (Unused LV1 call 182 and 183)
    • LV2: Peek and Poke support
      (LV2 Syscall 6 and 7)
    • LV2: Peek and Poke support for LV1
      (LV2 Syscall 8 and 9)
    • LV2: LV1 CALL System call
      (LV2 Syscall 10)
    • VSH: Allow Unsigned act.dat and *.rif files
    • VSH: Disable Unlinking/Deleting of act.dat


    • Fake Save Data Owner
    • (Use Game Saves from ANY Owner)
    • Lock/Unlock Trophies
    • Cinavia protection disabled

    Cobra 7.02

      • Auto-Boot: Plugin System (sprx)
      • ISO Suppport: PS1/PS2/PS3/PSP/DVD/BluRay
      • Network Support: PS1/PS3/DVD/BluRay
      • PS3 games with files > 4GB on external USB HDD (FAT32)
      • Blu Ray Movie region free functionality
      • NTFS HDD Support
      • PS2 ISO Support for BC (HW) / non-BC (SW) Consoles
      • Syscall 11 – Toolbox CEX/DEX Support

    *PS2 Support on Internal HDD ONLY: dev_hdd0/PS2ISO/

    Cobra 7.02 PS2 Features (4.65 Cobra)

    PlayStation 2 on NON-BC Consoles

      Software (SW) Emulation:Support for PS2 ISOs in non BC consoles was removed in Cobra 4.30 (usb), due tops2_softemu missing. It has been re-enabled now by hacking of ps2_netemu. You can use it in the same way as before, just load an ISO and launch from disc icon, Cobra core takes care of rest. No need for encrypted isos, isos patched with limg sectors, etc. Just your normal PS2 isos dumped from discs. However, there is no support for optical discs in ps2_netemu.
      Note: Don’t forget to set the memory cards in XMB, in the old memmory card utility for PS/PS2, as ps2_netemu won’t let you assign them in game.

    PlayStation 2 on BC Consoles

      Hardware (HW) Emulation:
      PS3 Models:
      CECHC, CECHE, CECHA, and CECHB Backwards Compatible (BC) Consoles will still use their respetive emulators(ps2_emu, ps2_gxemu), which have much better compatibility and also support optical discs, original or backup.

    General Cobra Plugin Information

    Support for plugins at boot time:

    • The number of vsh plugins has been increased from 1 to 7 slots.
    • Slot 0 is reserved for use for iso plugins (netiso.sprx and rawseciso.sprx).
    • Slots 1-6 are for boot plugins.

    Plugins are loaded in the following way:

    • text file: /dev_hdd0/boot_plugins.txt shall contain a plugin path per line.

    How to Install a Plugin:

    • Copy plugin_name.sprx to you internal ps3 hdd (ex: /dev_hdd0/).
    • Create or Edit boot_plugins.txt in the root of the hdd (/dev_hd00/boot_plugins.txt) and add a line for the new plugin. (Assuming you placed the sprx also in the root of the disk, add: /dev_hdd0/plugin_name.sprx). Add a new line for each plugin.
    • Then Reboot PS3 Console!

    In the event of a bad plugin that crashing the system and causes a pseudo-brick
    A Safety System has been designed:

    • Enter PS3 Recovery Mode and select the option “Rebuild database“. The recovery process, emer_init.self, will mount dev_hdd0 for a short moment, Cobra core will detect that and it will delete boot_plugins.txt.
    • Cobra core won’t load vsh plugins when there is not VSH: like for example, in recovery and update modes.

    For more information on the extensive list of features with this release check out the Official Rebug 4.65.1 Cobra release announcement below, and don’t forget to thank these guys.

    MD5sum: 24edec72160f35b387843d53fc17df2f REBUG_4.65.1_REX_PS3UPDAT.PUP
    MD5sum: 1e3bf35fcfec29ab8528e2d6d4ec680e REBUG_4.65.1_D-REX_PS3UPDAT.PUP


  • Posted by , on 13/10/2014 , @ 11:17am


    Well, the title pretty much says it all. Previously you needed to either be on 3.55, or Linux via OtherOS to toggle QA on/off, but Thanks to Smhabib you can now easily do it on 4.21+.
    Habib Toolbox with QA Toggle is available below, along with the QA Toggle standalone source code for those wishing to learn from it or port/build it for other purposes/versions.

    Okay, Smhabib has been pretty busy lately, lets go over some of the details.
    Habib Toolbox 1.02.02 was recently released, and I was a little preoccupied with some things yesterday so I’m sorry if I’m late on anything. Something I hadn’t specifically mentioned but I had briefly listed with the download links at the bottom of the page, is that currently Habib Toolbox is only built for 4.65. There was a little confusion about that in the forums, but it’s only meant for 4.65 Cobra CFWs.

    With his Toolbox release, Smhabib also released the source code he used to toggle the QA Token in Habib Toolbox. He specified that the method would work with 4.21+, but that the code might need to be adjusted. I guess this is where some of the confusion was, I should have been more specific with my original draft of this article. To be fair though, all of this was outlined in the release notes below and discussed within the forums.

    Now, apparently there was a bug with Habib Toolbox 1.02.01 preventing the console from being QA Flagged if it hadn’t previously been flagged before. With the release of Habib Toolbox 1.02.02, this was rectified.

    Also with this update Smhabib has provided us with a QA Toggle pkg for 4.21+ (links below).
    Before updating this article, I decided to give it a go on my Rogero 4.46 Cobra and it worked superbly.
    My system had already been QA flagged; I ran Habib’s 4.21+ QA Toggler, the screen went black for maybe 20seconds and then returned to XMB. I tested the QA button combo, and the QA Token was indeed removed/disabled.
    I ran QA Toggle again, there was another brief black screen and I was returned to XMB. This time when I did the QA button combo, the Debug Menu returned.

    Smhabib’s Announcement:

    since 4.xx(prolly 3.56+) sony protected the qa thing with ecdsa and we cant access it through UM in the gameos(preventing token from being written)

    so i just started once to look around qa.i was able to do it on 3.55 but not on 4.xx.
    now what i did to make that working was that i accessed HV scm through dm using VUART(packet id=0x900C) and wrote the token.this can be done from linux easily but we want from gameos right?
    sooooo I SUCCEEDED!!!
    this has been ported to habib toolbox and is bumped to v1.02.01 with many new features:
    1.lv1 dump
    2.lv2 swap from dev_flash or usb000
    3.toggle qa

    now i also made a standalone version with UGLY UNCLEANED SOURCE with all the **** i have tried past this week almost
    standalone version can be easily updated by updating around 7 offsets(6 lv1 and 1 lv2 for hvsc redirect)


    happy studying and using!!!!

    1.main.c offsets
    2.lv1_hvcall.c offset(lv2)

    this has been tested on 2 consoles and so far no problem is there BUT we dont make any guarantees
    this works on 4.65 but can be ported easily

    UPDATE #1:
    FW INDEPENDANT!!!!!!(unless sony makes GREAT changes)
    on a “non supported fw” it takes 20 seconds to qa
    tested on 4.65 cobra/non-cobra and 4.60 cfw
    if for some reason it doesnt work on some fw then it requires porting offsets.
    and its for 4.21+ cfw only
    how lucky i am to have syscall 11

    UPDATE #2:(2014-10-13)
    ITS FOR 4.65 ONLY!!!!!


    toolbox 1.02.02
    src for standalone is in there
    changelog for toolbox:
    1,fixed token writing of qa
    2.fsm toggle is in there for you(normal 3.55 diag can be used to exit)

    changelog for standalone:
    1.fixed token writing for qa

    p.s i might make this fw independant in future

    do note that toolbox is for habib 4.65 cobra toggle version and any 4.65 cobra edition

    its now fw independant for 4.21+
    for any reason if this doesnt work with the upcoming releases, porting is required
    tested on 4.65 and 4.60

    Habib Toolbox v1.02.02 for 4.65 & QA Toggle Source Code:
    MD5sum: 254fa16d26cf21ff965977f6e6caab72

    QA Toggle 4.21+ & Source Code:
    MD5sum: 5325fe9b9a7b231765dba368bb28f687

    For those with no use for the raw QA Toggle Source Code,
    Here are some Direct Links to the Install PKGs found in the archives above.
    Habib Toolbox 1.02.02 pkg for 4.65:
    MD5sum: ccb5f0e0af8fcb771f560bd9561b1e7f

    QA Toggle 4.21+ standalone pkg:
    MD5sum: 9620e68506d9bf50286af438587752d5

    Source Thread