BadHTAB is a hardware–software hypervisor (LV1) exploit for Sony PlayStation 3. Originally invented by geohot for Linux, it works by briefly pulling certain RAM signals to ground during a hypervisor HTAB invalidation—causing the write to be skipped and leaving an entry valid. This grants full read/write access to a small region of hypervisor memory, which can later be manipulated for complete memory control.
This GameOS-ported exploit runs on every PS3 model with PS3HEN, bringing CFW-only features to non-CFW consoles for the first time ever.
Warning: Success rate is low (~5–10%). Requires soldering, patience, and skill. Not for daily-driver consoles.
Note: Not persistent—must rerun after every reboot.
Firmware: Supports 4.70 or later.
- BadHTAB — Software side, delivered as a
.pkgfor PS3 - ps3pulldown2 — Hardware side, a Raspberry Pi Pico (RP2040) glitcher over USB
After a successful run:
hvcall 114 everywhere— Map any memory region without restriction- New HVCalls:
lv1_peek(34)/lv1_poke(35)/lv1_exec(36) - Dump LV1 memory — Write hypervisor RAM to file
- Boot custom
lv2_kernel.fself— Load any LV2 kernel in FSELF format - Boot OtherOS — Launch Petitboot to restore Linux/OtherOS
Note: Using “Boot LV2/OtherOS” removes the new HVCalls (besides 114); you can reinstall them via HVCall 114.
// lv1_peek(34)
// in: r3 = addr
// out: r3 = value
// lv1_poke(35)
// in: r3 = addr, r4 = value
// out: r3 = 0
// lv1_exec(36)
// in: r3–r8 = args, r9 = addrRequirements & Wiring
- Raspberry Pi Pico (RP2040)
- 0.1 mm magnet wire
- Soldering tools
Solder two pull-down wires from the PS3 RAM resistors to the Pico:
- Identify the two target resistors (e.g. RQ7 and RQ8 on the PS3 service manual or by tracing after desoldering).
- Solder one end of each wire to those resistors.
- Solder the other ends to the Pico’s GPIO15 and GPIO16 (bottom-most pins).
- Reassemble PS3 enough to power on safely.
- Hold BOOTSEL and plug Pico into PC → new drive appears.
- Copy
ps3pulldown2.uf2from Releases onto the Pico drive. - Remove Pico, reinsert into PS3’s USB port.
Tips:
- Keep wires off any metal.
- Test on a naked PS3 (no case) for easy access—HDD light blink verifies boot.
- Super Slim power buttons are fragile—consider shorting pins with a screwdriver.
BadHTAB .pkg & Configuration
- Install
BadHTAB.pkgfrom Releases.
Dump LV1 Memory
- Create an empty file at
/dev_hdd0/BadHTAB_doDumpLv1.txt- (For 240 MB dump, use
BadHTAB_doDumpLv1_240M.txt)
- (For 240 MB dump, use
- Run the exploit.
Boot Custom LV2 Kernel (FSELF)
- Convert
lv2_kernel.self→lv2_kernel.fself:make_fself.exe -u lv2_kernel.elf lv2_kernel.fself
- Place an empty
/dev_hdd0/BadHTAB_doLoadLv2Kernel_Fself.txt. - Copy
lv2_kernel.fselfto/dev_flash/sys/lv2_kernel.fself. - Graceful shutdown, then run exploit.
Tip: Use
/dev_blind/(via webman MOD) to write to/dev_flash/if full. Removeps1emu/ps2emu/pspemuto free space.
Boot OtherOS (Petitboot)
- Place empty
/dev_hdd0/BadHTAB_doOtherOS.txt. - Copy
dtbImage.ps3.fself(from ps3-petitboot-kexec-patched) to/dev_flash/sys/dtbImage.ps3.fself. - Graceful shutdown, then run exploit.
-
Plug Pico into a PS3 USB port.
-
Launch BadHTAB pkg.
-
Beep = status indicator; log at
/dev_hdd0/BadHTAB.txt.- One triple-beep = exploit started.
- Pico LED will blink; you’ll hear periodic beeps.
- If beeps stop or PS3 powers off → glitch failed → reboot & retry.
- Successful glitch: triple-beep, pause, then multiple triple-beeps.
- HVCalls are patched; configured action (dump/kernel/OtherOS) runs.
- If not booting LV2/OtherOS → 5 s long beep → exploit ends → back to XMB.
- Auto-reboot on crash
- UART0 for Pico, UART1 for PS3 SB_UART
- PSU standby & ribbon-connector monitoring
- 4 status LEDs (error/yellow/green/blue)
- Optional HDD activity monitoring
- SYSCON UART enables
Mullion CXR713*: w 7202 02 Mullion CXR713120: w 4202 02 Mullion CXR714*: w 4202 02 Sherwood SYSCON: w 1202 02Warning: Do not enable extra UART outputs or glitch will crash on XMB return.
PS3 → Pico wiring summary
| Signal | PS3 Pin/Source | Pico GPIO |
|---|---|---|
| pulldown1 (RQ7) | RAM resistor | 15 |
| pulldown2 (RQ8) | RAM resistor | 16 |
| pwr_on_ribbon (PS3 3.3 V) | Power Ribbon connector | 10 |
| sb_uart_rx (PS3 SB_TX) | Southbridge UART TX | 5 |
| psu_always_on | PSU 5VSB pin 1 | vsys |
| psu_standby | PSU ACDC_STBY pin 3 | 18 |
| hdd_activity (Optional) | HDD LED anode | 22 |
PSU PCB BOARD PS3 PCB BOARD
CN101 CNxxx
┌────────────┐ ┌────────────┐
│ 1 2 3 4 │ │ 4 3 2 1 │
│[ ][ ][ ][ ]│ │[ ][ ][ ][ ]│
└────────────┘ └────────────┘
│ │ │ │ │ │ │ │
│ │ │ └── ACN_DET │ │ │ └── ACN_DET
│ │ └──── ACDC_STBY │ │ └──── ACDC_STBY
│ └────── GND │ └────── GND
└──────── 5VSB └──────── 5VSB
Pico status LEDs
| Color | GPIO |
|---|---|
| Error | 6 |
| Yellow | 2 |
| Green | 21 |
| Blue | 27 |