BadWDSD

This is a hardware modchip for Sony PlayStation 3. By using Raspberry Pi Pico (RP2040), It is possible for non-CFW compatible models to boot qCFW.

Supported models

All CECH-2500

All CECH-3000

CECH-4x00 with NOR flash

CECH-4x00 with eMMC flash is NOT supported

One way to know if your console is eMMC or not is enter safe mode. If you see Change system storage option, It is eMMC.

Other way is try to install Stagex. If it says Flash is not NOR then it is eMMC.

What is qCFW?

You still can't install CFW PUP, so new variant of CFW must be made. This is called quasi-CFW.

It is heavily based on Evilnat PEX CFW. And will support every feature except: Dumping eid_root_key and anything that needed it.

HDD Decryption is possible without root key. See Dumping HDD Key section

Cobra must be active at all times or some feature will not work properly.

qCFW quirks

For some unknown reason, When you turn on the console using wireless controller it won't sync.

Workaround has been implemented. If you turn the console on using wireless, it will always power cycle once before fully boot.

But controller sync will work fine.

Note on DEX mode

DEX mode is fully supported. But any kind of firmware installation or update is not possible while in this mode.

This means if you somehow need to reinstall the firmware such as corrupted HDD, you are stuck.

To recover, use BANKSEL pin on the modchip to go back to OFW.

Installation (Software)

FOR FIRST INSTALLATION, BACKUP FLASH FIRST!!!. IF SOMETHING GOES TOO WRONG AND YOU DON'T HAVE BACKUP, YOUR CONSOLE MAY BE PERMANENTLY BRICKED

Prepare the USB drive by DELETING old qcfw folder if existed, DO NOT OVERWRITE!! then download qCFW and extract it into your drive like this:

Install PS3HEN 3.4.1 FINAL or later
Plug your USB drive into RIGHTMOST USB port of your ps3
On XMB, Enable HEN then use Network -> Hybrid Firmware Tools -> qCFW Options -> Install Stagex option. It must show Success
If not already, Install the modchip by following Installation (Hardware) section
After modchip installed and power plugged in, wait until LED of modchip becomes solid. If it doesn't solid after a while, check SC_RX/SC_TX wire
Turn on the console. modchip LED should flash briefly with triple beep right after. This means exploit is successful. If your console keep turning off and on, check CMD/CLK wire and Stagex

!!! If modchip LED didn't flash briefly and console is GLOD, CMD/CLK resistor may be damaged !!!

You should be on XMB now. now Enable HEN then use Install qCFW option
If it tell you to reinstall firmware and try again, do it ONCE. (PS3 Firmware)
Your screen will appear frozen. it is installing. This process take 10-20 minutes. If something goes wrong during this step, you should be still able to recover by entering safe mode and reinstall firmware normally
Then it will reboot itself. you should be on qCFW and see Evilnat logo now.
!! You should "Sync date & time with internet" at least once after install to avoid issues such as XMB hangs !!
Congrats! qCFW installation is complete

From now on, modchip will be required to boot the console until you go back to OFW again

This can be done by reinstalling OFW/HFW firmware normally. Then after this you can disable or uninstall the modchip

If thing goes too bad to the point of not being able to enter safe mode at all, you can use BANKSEL pin instead.

If you flashed bad Stagex.bin or CoreOS.bin, see Recover from bad Stagex.bin or CoreOS.bin flash section.

Installation (Hardware)

Currently, Raspberry Pi Pico (RP2040) and RP2040-Zero are supported.

Only install modchip after Stagex is installed to console flash from above section. Otherwise it won't boot, if you already installed the modchip, You can use HOLD pin to temporary disable the modchip without unsoldering it.

Since I don't have 2500 and 3000 model to test, it must be done by other people. If you know the solder location please tell me. Thanks.

To flash .uf2 file (it is included in qCFW zip), simply connect modchip USB port into your PC while pressing BOOTSEL button. Then new drive will appear, simply drag .uf2 file into it.

You should see LED blinking. Flash successful and ready to use. You can disconnect it from your PC.

For signal, you only need to solder 4 wires that marked red (CMD, CLK, SC_RX, SC_TX). Other signal pin is optional. For power, you must solder 5V/3.3V and GND.

It is possible to power the modchip using external power as long as it is active during ps3 standby (GND must be soldered to motherboard!)

You should measure the resistance of CMD/CLK point. Resistance to ground should be around 55 ohm. If it doesn't then something is wrong.

Wiring guides

CMD/CLK wire should not be too thick. 0.1mm magnet wire RECOMMENDED

Success rate depends on quality of your soldering and wiring.

Keep all wire short as much as you can, GND is the most important one. and avoid routing to noisy area.

When done properly, success rate should be 100%.

Pin description

SIGNAL PIN:

CLK - XDR CLK signal

CMD - XDR CMD signal

SC_TX/SC_RX - Syscon UART signal

DEBUG - Optional modchip UART signal, for debugging and accessing syscon (baud 576000, NOT 57600!)

CONFIG PIN:

Short to ground to activate

HOLD - Disable the modchip without needing to remove power or unsolder

LITE - TODO

BANKSEL - Go back to OFW forcefully. It is equal to syscon command w 1224 00. Only use when absolutely needed. You can't turn on the console while this pin is shorted

Update qCFW

You can't update qCFW while on qCFW. you must go back to OFW first.

Simply reinstall firmware normally, then use Install qCFW option with updated files on USB again. No need to do anything else

When updating files on USB, delete whole qcfw folder first. Don't overwrite or it may causes problem.

Go back to OFW using PUP method (Recommended)

Always use this method when possible. Simply reinstall firmware as normal. No extra steps required.

If you want to uninstall the modchip, you can do so after this

Go back to OFW using BANKSEL pin

Avoid this unless absolutely needed.

DO NOT GO STRAIGHT TO THIS PIN WITHOUT TRYING TO BOOT THE CONSOLE WITHOUT MODCHIP FIRST!, IF IT SHUT IFSELF OFF, THEN YOU CAN FOLLOW BELOW

Unplug your console
Short BANKSEL pin to ground
Plug in your console, wait until modchip LED flashes very fast. Then it is successful. You can't turn on the console while this pin is shorted
Unplug your console and unshort the pin. If necessary remove or use HOLD pin to disable the modchip
Plug in your console again and turn it on, you will likely to get black screen. This is expected since dev_flash is still qCFW but you're on OFW now
Enter safe mode and reinstall firmware normally to get full recovery

Recover from bad Stagex.bin or CoreOS.bin flash

No worries, your console isn't really bricked. FIRST, disable the modchip then try to boot the console if it boots then all is good. If it shut itself off, Simply follow Go back to OFW using BANKSEL pin section above. But this time disable modchip before boot as well.

Downgrading

After booting the console with modchip, It is possible to downgrade the firmware up to 4.80. It can't be done in XMB. You must use safe mode.

OtherOS

It is different from CFW. Simply follow these steps.

Download dtbImage.ps3.zfself and put it into root of your USB drive
Plug your USB drive into RIGHTMOST USB port of your ps3
On XMB, use Network -> Custom Firmware Tools -> OtherOS Tools -> Install OtherOS (qCFW) option. It should show Success
Use Boot OtherOS (qCFW) option. It should enter petitboot r

BadWDSD

Install / Use

README

BadWDSD

Supported models

What is qCFW?

qCFW quirks

Note on DEX mode

Installation (Software)

Installation (Hardware)

Wiring guides

Pin description

Update qCFW

Go back to OFW using PUP method (Recommended)

Go back to OFW using BANKSEL pin

Recover from bad Stagex.bin or CoreOS.bin flash

Downgrading

OtherOS