BadWDSD qCFW: custom firmware on Slim CECH-25xx and 30xx and every Super Slim (modchip)

A Raspberry Pi Pico soldered to the board brings custom firmware (qCFW, based on Evilnat 4.93 PEX) to the models software cannot reach. Soldering required, and the chip stays in for every boot.

For: Slim CECH-25xx and 30xx, and every Super Slim (NOR and eMMC) · updated Oct 29, 2026 · not sure? check your PS3

Before you start

Back up the flash first. The authors warn that without a backup the console may be permanently bricked.
This is soldering work: four signal wires on NOR consoles, five on eMMC ones, plus power (5 V or 3.3 V) and ground. The README asks for about 55 ohms on CMD and CLK, thin magnet wire for signals and never for power. If you have not soldered before, ask someone who has.
On eMMC Super Slims, a flash dump reads as incomplete until the first boot with the chip: dump again after it. The authors say eMMC consoles never reach a 100 percent boot success rate.
Do not switch qCFW to DEX mode: firmware installs are then blocked.
qCFW cannot be updated in place: to update, go back to OFW or HFW, then install qCFW again.
On eMMC Super Slims, install firmware from Safe Mode (error 80029c9c otherwise), and go back to HFW before you change the hard drive.

Steps

Get your PS3 onto HFW 4.93.1 with PS3HEN 3.6.0 or later: PS3HEN.
Copy a fresh qcfw folder from qCFW qcfw-20260915-6 (the -6 file, not the older -2) to a USB stick, and use the PS3's rightmost USB port. Delete any older folder first; never copy over it.
Enable HEN, then Network, Hybrid Firmware Tools, qCFW Options, Install Stagex. It must say Success before you fit the chip.
Fit the Raspberry Pi Pico (RP2040, or an RP2040-Zero) as the README shows for your board, and flash the .uf2 file to it.
Wait for the chip's LED to stay lit, then switch on. A triple beep means the exploit worked.
Enable HEN, then Install qCFW. It takes 10 to 20 minutes. If it asks you to reinstall the firmware and try again, do that once only.

Files

File, and how to check it	From
qCFW qcfw-20260915-6 173.2 MB SHA-256 `6507263531a1acfb8e4e253e49b3c4cce6e61336dbe538c128326b00c6f82b7d` as listed by GitHub (the release page's digest), checked by Brewology on Oct 29, 2026	GitHub (aomsin2526/BadWDSD) release page	Get it

Brewology does not host these files; each link goes to the site that publishes it. To check a download on a PC: certutil -hashfile FILE MD5 on Windows, md5sum FILE on Linux, md5 FILE on a Mac (SHA256 in place of MD5 for the longer hash).

Then

webMAN MOD 1.47.50d: game launching, fan control, network play and update blocking.
Apollo Save Tool 2.4.0: save management.

Sources

BadWDSD README · qcfw-20260915-6 release notes · ConsoleMods buying guide (archived)

Something here out of date, or a hash that does not match? Tell us in the forum and we fix the page.

Other ways in

PS3HEN 3.6.0 on HFW 4.93.1

For: every PS3 model, from any official firmware or an older HFW

Evilnat 4.93 CFW (Cobra 8.5) with the 4.93 Flash Writer

For: original (fat) PS3s, Slim CECH-20xx and 21xx, and CECH-25xx with MinVer 3.56 or lower