PS3HEN and the long tail of console firmware support

Sixteen firmwares, sixteen binaries

PS3HEN is the PS3 Homebrew ENabler, and the current version named in the README is 3.6.0, with multi-firmware support added. The supported list is the specification of the project:

CEX OFW 4.80
CEX OFW 4.81
CEX OFW 4.82
DEX OFW 4.82
CEX HFW 4.83.1
CEX HFW 4.84.2
DEX HFW 4.84.2
CEX HFW 4.85.1
CEX HFW 4.86.1
CEX HFW 4.87.1
CEX HFW 4.88.1
CEX HFW 4.89.1
CEX HFW 4.90.1
CEX HFW 4.91.1
CEX HFW 4.92.1
CEX HFW 4.93.1

Two variables run through that list. The first is CEX against DEX, which are the two families of official firmware, and the second is OFW against HFW, official firmware against the hackable firmware that shipped on later production units. The older OFW releases are only covered at 4.80 through 4.82, while the HFW range carries the long tail up to 4.93.1.

The repository root is organised around exactly this. There is a separate binary for each firmware and a debug variant beside each one, so the naming runs from PS3HEN.BIN_CEX_480 through PS3HEN.BIN_CEX_493 and its DEBUG counterparts, plus PS3HEN.BIN_DEX_482_DEBUG and PS3HEN.BIN_DEX_484_DEBUG for the debug editions of the two DEX targets.

The audience is a console owner with a specific firmware revision who wants to run homebrew, and a homebrew developer who needs the tooling. The README also carries an explicit warning that custom firmwares can be used for testing but are not recommended to use.

The payload chain and the staged boot design

The repository layout describes the mechanism without a single line of documentation, which is the usual way these projects communicate.

There is a lv1/ directory and a lv2/ directory, which correspond to the two levels of the console's boot chain, and a payload/ directory that holds the code actually executed once the chain is unlocked. There is a stage0_file/ directory, which is where the first-stage file that gets written to the console lives, and a Hashcalc_new/ directory, which is consistent with the changelog entry in version 3.4.2 about adding a missing function call for 3k3y ISO decryption, since that work involves hashing and checking.

The henplugin/ directory holds the HEN plugin, and the changelog describes it as a separate concern from the payload, with its own entries, such as adding detection of BadWDSD via an LV1 peek check on HEN enable, and adding HEN restore functionality for a new package that supports HEN surviving an HDD reformat.

Then there are the directories a user interface needs: html/ for the on-screen interface, templates/ for its assets, and the debug/ directory for the debug builds. The project is written in C, and the presence of lv1 and lv2 as separate build targets is what a custom firmware project looks like from the inside.

The 3.6.0 changelog entry about the payload now allowing multiple kernel plugins to send debug output simultaneously is a good illustration of what this code actually is: not a single program, but a set of cooperating pieces that run at different points in the boot sequence.

The generator, the batch scripts and the local server

Building the per-firmware binaries is handled by a generator and a pair of Windows batch scripts.

There is a PS3HEN_GEN/ directory, and the 3.2.1 changelog records updates to PS3HEN_GEN and the addition of a makefile, credited to bucanero. Alongside it sit make_PS3HEN.bat and make_PS3HEN_debug.bat for the release and debug outputs, and clean_PS3HEN.bat for cleanup.

The generator exists because the payload has to be tailored per firmware. The changelog is a running record of that work: version 3.4.0 added a cellFsRename_symbol and updated cellFsMkdir_symbol offsets, which are the kernel symbol addresses the payload calls. Those offsets move between firmware revisions, so every new firmware version means new offsets, and the offsets are what the generator is there to patch.

There is also a server.py at the repository root, which alongside the html/ directory and templates/ suggests the interface is served locally rather than being a static file. That is a common shape for a project whose interface has to be edited and re-flashed repeatedly during development.

For a user rather than a developer, the practical entry point is the prebuilt binary for their firmware. The generator and the batch scripts are for the people who maintain the matrix, and the docs/ directory, with an Install section at the end of the README, is where the usage instructions live.

What the changelog says about how this project is maintained

The changelog is the most informative document in the repository, and it shows a particular way of working.

Every entry names a category, and the categories are consistent: HEN Global Changes, HEN Plugin Changes, Payload Changes and Resource Changes. That structure is itself informative, because it means the project is understood as four separate systems that have to be updated together when a new firmware arrives.

The contributor acknowledgements are worth noticing. Over the sixteen firmware entries, the credits go to a small set of recurring names, Joonie appearing on most of the HFW additions, alongside habib, aomsin2526, littlebalup, zecoxao, aldostools, Evilnat, LuanTeles and others. The 3.6.0 entry also credits aomsin2526 for eMMC support for qCFW, and names the new applications added to the Homebrew Apps menu, Apollo Save Manager, ArmetisPS3, IRISMAN, Movian, PKGi and PS3 ezRemote.

The Homebrew Apps menu itself is a recurring feature, with versions 3.5.0 and 3.4.0 both adding entries such as webmanMOD, multiMAN-MOD, ManagunZ and Rebug Toolbox, and 3.3.0 adding a Toggle 99 Percent Package Install/Delete option to HFW Tools Maintenance.

Automatic Updates are disabled by default as of version 3.2.2, with the option to toggle them back on through HFW Tools, which is a sensible default for a tool that modifies a console and would otherwise be making network requests on your behalf without being asked.

The limits, and the parts you should read before flashing

There are three things to understand before using this, and none of them are in the feature list.

The first is that the binary must match the firmware exactly. The project ships a separate binary per revision, and the changelog for 3.5.0 shows support for 4.93 CEX firmware being added as a global change. A mismatch is not a degraded experience, it is a console that does not boot, which is why the matrix is enumerated rather than approximated.

The second is the modified firmware question. The README says custom firmwares can be used for testing but is not recommended to use, and the 3.4.0 changelog records support for installing qCFW, the quasi custom firmware, for NOR 3000x and SS, plus new custom coldboot files for release, debug, usb and DEX.

The third is that the project itself offers the reversals. Version 3.2.2 added an Uninstall HEN option to HFW Tools Maintenance, along with a Disable Remapping On Next Reboot option, and version 3.4.0 added HEN restore functionality for a package that supports HEN surviving an HDD reformat, along with a create_default_dirs function for creating standard folders if missing on dev_hdd0.

The existence of an uninstall path and a remap disable switch is the clearest signal about the state of the console afterwards. Enabling HEN changes the boot chain and the file layout, and the project has grown the tooling to undo that, which tells you how much it changes and that the author considers reversibility part of the feature set.

Editorial conclusion

PS3HEN is a good fit for a homebrew developer or a console owner who needs their own hardware to run unsigned software and who can match the exact firmware revision, because the project ships a separate binary for every supported firmware and the changelog shows a team of contributors extending that matrix one release at a time. It is a poor fit if you are on an unsupported firmware or on a modified console, since the README says custom firmwares can be used for testing but are not recommended, and a poor fit if you expect a single download to work everywhere. Before using it, confirm your exact firmware revision against the supported list, and read the notes on what enabling HEN changes on the console, since the project also provides an uninstall option and a disable remapping on next reboot option for a reason.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. Project website
4. PS3Xploit/PS3HEN on GitHub
5. README