EVILNAT Install Guide

**RETRO™** · (Edited 09-26-2026, 06:16 PM by **RETRO™**.)

★ GUIDE: INSTALL EVILNAT 4.93 CEX – COBRA 8.5 ★
From official firmware, using HFW 4.93.1 and Flash Writer
Updated September 2026

A PS3 on official firmware can only take 4.93 EvilNat Cobra 8.5 if that console is CFW-capable. As of September 2026, bguerville's BG Toolset still does not support 4.93, so the working path is:

MinVerChk → HFW 4.93.1 → Flash Writer → Verified flash dump → Patch → EvilNat CEX update

Quote:⚠ READ THIS FIRST
Do this only on a console you own. Back up your saves first.

A wrong flash, or a power loss during the write, can brick the console so badly that Recovery Mode cannot fix it.

Legal & account warning: this modifies Sony system software and breaks the system software license. In some countries it is also an anti-circumvention issue. Signing into PSN on custom firmware can get the console and the account banned. Do not use CFW to run games you do not own.

▌ Order of Operations

Confirm the model, then run MinVerChk. Continue only if the minimum firmware is 3.56 or lower.
Install HFW 4.93.1 from a USB stick. (This is not EvilNat yet.)
With Flash Writer, dump the flash twice. The two files must match.
Check a dump in PyPS3checker on a PC. If it offers to patch the file, say No.
Patch on the PS3. Wait until the page says it is safe to restart.
Install EvilNat 4.93 Cobra 8.5 CEX (the standard build) from USB.
Turn on QA flags, then set a fan curve in webMAN MOD.

▌ STOP If Any of These Are True

Your model is a CECH-30xx Slim, or any Super Slim (CECH-40xx / 42xx)
Full CFW is impossible. Use PS3HEN instead. Do not follow this guide.
MinVerChk reports 3.60 or higher
Stop. A late CECH-25xx often fails this test.
The Blu-ray drive or the Bluetooth board is dead or missing
Only then use a noBD or noBT build. The normal build on a dead drive can leave the console unable to boot.
You cannot keep power stable for the whole flash write
Do not start. A mid-write power loss can brick the console past recovery.

▌ Which Consoles Can Take Full CFW

✔ Every Fat (CECHA through CECHQ).
✔ Every CECH-20xx and CECH-21xx Slim.
? CECH-25xx only if the minimum firmware is 3.56 or lower. The date code on the rear sticker is only a hint: early codes such as 0C through 1A sometimes pass, 1B and later usually do not. MinVerChk is the real test.
✘ CECH-30xx and every Super Slim: not this guide.

NOR or NAND?
Flash Writer asks whether the chip is NOR or NAND. Pick the one that matches the model. If the page and the sticker disagree, do not patch.

NAND (256 MB): CECHA, CECHB, CECHC, CECHE, CECHG
NOR (16 MB): Every other CFW-capable model, including CECHH and later Fats, and every compatible Slim

Model charts: psdevwiki – SKU Models

▌ What You Need

The PS3, preferably on a wired network.
A real DualShock 3 and a mini-USB cable. A DualShock 4 will not operate Safe Mode.
A USB stick of 32 GB or smaller, formatted MBR + FAT32. Not GPT. Not exFAT. Allocation unit 16 KB or 32 KB is fine. Rufus, or any FAT32 formatter, can force FAT32 on a larger stick if you have no smaller one.
A PC, to check the flash dump.
The files below, from the authors' own threads. Ignore reuploads and links dropped in video descriptions.

MinVerChk – » Download | Source page
HFW 4.93.1 – » Download | Source thread
Flash Writer for 4.93.1 HFW – » Download | Source thread
EvilNat 4.93 Cobra 8.5 CEX (standard build) – » Our EvilNat CFW downloads post | Source page
PyPS3checker (PyPS3tools) – » Download | GitHub page

Check every PUP against the MD5 printed in that same PSX-Place post. One widely published checksum for the HFW 4.93.1 file named PS3UPDAT.PUP is:

Code:
D5B1F953972D0FBBBA5981181D5DD086

If the thread shows a different hash, trust the thread. Reject the file if it does not match.

▌ Which EvilNat Build?

CEX – A normal retail console. This is the one to install.
PEX – Optional later. Extra debug-style menus. Not required for a first install.
D-PEX – Do not install this on a stock retail console.
noBD – Only if the Blu-ray drive is dead or has been removed.
noBT – Only if the Bluetooth / Wi-Fi board is dead or missing.
OC – Overclocked RSX. Extra heat, and it can kill the GPU. Skip it.

Cobra 8.5 is already inside these builds and is on by default.

Quote:Before you start: Copy your saves to a USB from Game → Saved Data Utility. Sign out of PSN. Set the date and time correctly.

▌ Prepare the USB Stick
The PS3 only sees a system update in this exact layout. The file name must be PS3UPDAT.PUP. If Windows is hiding file extensions, make sure you do not end up with PS3UPDAT.PUP.PUP.

Code:
USB root

└── PS3

    └── UPDATE

        └── PS3UPDAT.PUP

Use the rightmost front USB port for the whole process. That port is dev_usb000. On a Slim it is the port closest to the disc slot.

■ Step 1 – MinVerChk

Put only the MinVerChk PUP at PS3/UPDATE/PS3UPDAT.PUP.
On the PS3: Settings → System Update → Update via Storage Media.
It is not a firmware install. It prints the factory minimum version, then errors. That error is expected.
3.56 or lower: continue.
3.60 or higher: stop. Full CFW cannot be installed. Do not try to force the patch. PS3HEN is the other route, and it is a different install.

■ Step 2 – Install HFW 4.93.1
Official 4.93 does not have the old browser exploit. Hybrid firmware is 4.93 with that browser restored, so Flash Writer can run. It is a higher version than OFW 4.93, and it also installs over 4.90, 4.91 and 4.92.

Replace the USB contents with HFW, still at PS3/UPDATE/PS3UPDAT.PUP.
Settings → System Update → Update via Storage Media.
Let it install and reboot. Do not pull power.
If the XMB says the data is corrupted, the file failed the hash check, the name or path is wrong, or the stick is not MBR FAT32. Fix that. Do not keep installing a bad file.
If the XMB will not offer the update, use Safe Mode (see below) and choose 6. System Update only.

After the reboot, Settings → System Settings → System Information should show 4.93. It will not say EvilNat yet. That is correct.

■ Step 3 – Prepare the Browser
The PS3 browser cannot open many modern HTTPS sites (GitHub pages often fail with a certificate error). Use an http:// address published in EvilNat's Flash Writer thread. A mirror people use is:

Code:
http://writer.ps3.nz

If that mirror is down, host Flash Writer yourself: unzip it on a computer on the same network as the PS3, serve that folder (for example with the command below), allow the port through the PC firewall, and on the PS3 open http:// + the PC's LAN address + :8080. EvilNat's own notes recommend local hosting when the public page will not load.

Code:
python -m http.server 8080

On the PS3 browser:

Press Triangle → Tools. Turn JavaScript and cookies on.
Triangle → Tools → Home Page → Use Blank Page.
Triangle → Tools → Delete: cache, cookies, history, search history, and authenticated information.
Quit the browser fully (PS button → Quit), then open it again.
Press Start to open the address bar, enter the Flash Writer URL, and open it.

Initialization can take a couple of minutes, and the page can look frozen. Leave the controller alone. If it drops back to the XMB, quit the browser and try again. A few failures are normal. Wired Ethernet is more reliable than Wi-Fi.

■ Step 4 – Dump the Flash
You are still on HFW. Put the USB stick in the rightmost port. Empty the HFW update off the stick first so there is room, or use a second FAT32 stick.

On the Flash Writer page, initialize it. Do what the page says, including a second Start press if it asks.
Let it read the console. It should show the current firmware, that this is HFW, and the minimum firmware. If it says the console is not CFW-compatible, stop.
Set the USB device to /dev_usb000 when the stick is in the rightmost port.
Select NOR or NAND so it matches the model table above.
Dump the flash. Wait until it says the dump was saved. Do not reboot, do not pull the stick, and do not press buttons until that message.
Dump a second time. On a PC, compare the two files: same size and the same MD5. If they differ, the stick glitched. Use another stick and dump again.

NOR dumps are about 16 MB and are usually quick. NAND dumps are about 256 MB and can take several minutes. The file lands on the root of the stick, often named PS3FlashDump493OFW.bin.
Keep a copy of a good dump somewhere safe, permanently. It is the only backup of this console's flash.

■ Step 5 – Check the Dump on a PC
Open the dump in PyPS3checker.

Continue only if the result is OK and the log is clean: ROS0 and ROS1 valid, no red errors.
If it offers to patch the dump, choose No. Patching is done on the PS3 by Flash Writer, not by the PC tool.
If the check fails, do not patch. Dump again. A bad patch is how consoles get bricked.

■ Step 6 – Patch

Put the stick back in the rightmost port. The good dump can stay on it.
Reopen Flash Writer the same way as before.
Select the same USB port and the same NOR or NAND type.
Run its checks, then apply the patch.
Hands off the controller and the power button until the page says the patch succeeded and it is safe to restart.

NAND writes are often done in seconds. NOR takes longer. Longer is still a wait, not a reason to reboot early. If the tool aborts because of a hash mismatch, a bad chain, or an incompatible console, believe it. There is no safe "force" option.

■ Step 7 – Install EvilNat 4.93 Cobra 8.5

On the PC, download the CEX standard PUP from our EvilNat CFW downloads post (or take it from the EvilNat zip on the source page). Not noBD, not noBT, not OC, not D-PEX. Check its MD5 against the hash listed next to the download.
Delete the old PS3 folder on the stick and put the new file at PS3/UPDATE/PS3UPDAT.PUP.
Put the stick in the rightmost port.
Settings → System Update → Update via Storage Media.
Accept the update and let it finish. The first boot can take several minutes.

"The data is corrupted" at this stage almost always means the flash was not actually patched, or the PUP is the wrong file, misnamed, or failed its hash. Installing EvilNat before the patch fails for the same reason: the signature check is still the stock one.

Quote:Safe Mode – if Storage Media will not see the update

Power the console fully off.

Hold the power button. One beep means it turned on. Keep holding until a second beep, and it turns off. Release.

Hold power again. Wait through the first beep and the single second beep until you hear a double beep, then release.

Plug in the DualShock 3 with the cable and press the PS button.

Choose 6. System Update.

Do NOT choose 5. Restore PS3 System. That option formats the hard drive. Safe Mode option 6 is the only menu item you want here.

■ Step 8 – Confirm It, Then Turn On QA
System Information should name EvilNat and Cobra 8.5, not plain 4.93.

Turn QA flags on once, and leave them on. EvilNat recommends this: QA lets you install an older CFW later and avoids a class of update problems. On the XMB it is under the Network column → Custom Firmware Tools → the QA flag entry. Reboot after toggling it. The exact label is in the readme inside the CFW zip.
Install webMAN MOD from aldostools' own release, and set a dynamic fan curve. Stock fan control is why Fat and early Slim consoles cook themselves. Do that before anything else.
Cobra is already enabled. Leave it on. The readme in the zip is the source for the button combo that toggles Cobra at boot. Do not hold random buttons during startup until you have read it.
Do not install a Sony official update over the patched console unless you mean to leave CFW. An official update removes the patch. On 4.93 you would have to do HFW and Flash Writer again.

▌ Already on Custom Firmware?
You do not need HFW or Flash Writer. Put the EvilNat 4.93 CEX PUP on the stick as PS3/UPDATE/PS3UPDAT.PUP and update from the XMB, or from Safe Mode option 6. A console already on CEX, REX or PEX can take the matching 4.93 build.
From 4.92.2 EvilNat, some consoles can also take a later CFW from the online updater inside Custom Firmware Tools. A USB install is the predictable method. Official firmware 3.55 or lower is the other shortcut: the same USB update, with no exploit. That is rare now.

▌ If It Goes Wrong

MinVer 3.60 or higher, or "not compatible"
Stop. HEN only. Forcing a patch will not make this console CFW-capable.
HFW or CFW says the data is corrupted
Bad download, bad name or path, or the stick is not FAT32 MBR. On the CFW step it also means the patch never landed.
Flash Writer crashes back to the XMB
Quit the browser, clear it, try again. Try Ethernet, or host the page on your PC.
The two dumps do not match
Bad USB. Use a new stick and dump again. Do not patch.
PyPS3checker is not OK
Do not patch.
Black screen after a successful update with the wrong noBD or noBT build
Safe Mode, option 6, with the standard CEX PUP.
Black screen because power was lost during the patch, or the wrong chip type was flashed
Recovery will not fix this. It needs a hardware flash programmer and the verified dump.

▌ What This Guide Does Not Cover
After CFW, package installs show up under Game → Install Package Files. Cobra is what homebrew and backup managers use. This guide stops at a working EvilNat install, QA flags, and a fan curve.
It does not cover loading games you do not own, license files, or copying another console's ID. Spoofing a console identity to get around a ban uses someone else's hardware ID. Don't.

Sources & Credits
Procedure and file locations follow Evilnat's 4.93 Cobra 8.5 release and the 4.93.1 HFW / Flash Writer notes on PSX-Place, as they stood in September 2026. BG Toolset was still not updated for 4.93, which is why this guide uses Flash Writer. Re-check those threads before you flash – hashes and mirror addresses change.

4.93 EvilNat (Cobra 8.5) • HFW 4.93.1 • PS3Xploit Flash Writer 4.93 HFW • MinVerChk • PyPS3tools • PS3 SKU Models

Custom firmware is installed at your own risk. We are not responsible for bricked consoles. This guide is not affiliated with Sony Interactive Entertainment or with Evilnat.