Custom firmware, also known as aftermarket firmware, is an unofficial new or modified version of firmware created by third parties on devices such as

video game console A video game console is an electronic device that outputs a video signal or image to display a video game that can be played with a game controller. These may be home consoles, which are generally placed in a permanent location connected to ...

s and various embedded device types to provide new features or to unlock hidden functionality. In the video game console community, the term is often written as custom firmware or simply CFW, referring to an altered version of the original

system software System software is software designed to provide a platform for other software. Examples of system software include operating systems (OS) like macOS, Linux, Android and Microsoft Windows, computational science software, game engines, search engin ...

(also known as the official firmware or simply OFW) inside a video game console such as the PlayStation Portable,

PlayStation 3 The PlayStation 3 (PS3) is a home video game console developed by Sony Computer Entertainment. The successor to the PlayStation 2, it is part of the PlayStation brand of consoles. It was first released on November 11, 2006, in Japan, November ...

, PlayStation Vita/

PlayStation TV The PlayStation TV (abbreviated to PS TV), known in Japan and other parts of Asia as the PlayStation Vita TV or PS Vita TV, is a microconsole, and a non-handheld variant of the PlayStation Vita handheld game console. It was released in Japan on ...

, PlayStation 4, Nintendo 3DS and Nintendo Switch. Installing custom firmware typically requires bootloader unlocking.

Video game consoles

Custom firmware often allow homebrew applications or

ROM image A ROM image, or ROM file, is a computer file which contains a copy of the data from a read-only memory chip, often from a video game cartridge, or used to contain a computer's firmware, or from an arcade game's main board. The term is frequen ...

backups to run directly within the game console, unlike official firmware, which usually only allow signed or retailed copies of software to run. Because custom firmware is often associated with software piracy,

console manufacturer A video game console is an electronic device that outputs a video signal or image to display a video game that can be played with a game controller. These may be home consoles, which are generally placed in a permanent location connected to a ...

s such as Nintendo and

Sony , commonly stylized as SONY, is a Japanese multinational conglomerate corporation headquartered in Minato, Tokyo, Japan. As a major technology company, it operates as one of the world's largest manufacturers of consumer and professiona ...

have put significant effort into blocking custom firmware and other third party devices and content from their game consoles.

PlayStation Portable, PlayStation 3 and PlayStation Vita/PlayStation TV

Custom firmware is commonly seen in the PlayStation Portable handhelds released by Sony. Notable custom firmware include M33 by Dark_AleX as well as those made by others such as the 5.50GEN series, Minimum Edition (ME/LME) and PRO. Custom firmware is also seen in the

console. Only early "Fat" and Slim (CECH-20xx until early CECH-25xx) models are able to run custom firmware. Slim (late CECH-25xx and CECH-30xx) and Super Slim models can only run HEN (Homebrew Enabler), which has functionality similar to a custom firmware. There is also ODE (Optical Drive Emulator), HAN (etHANol) and HFW (Hybrid Firmware) for the PS3. The PlayStation Vita/

has eCFW, meaning custom firmware for PSP running in the PSP emulator of the PS Vita/PS TV. These eCFWs include ARK, TN-V and more recently, Adrenaline, which includes more features since it was hacked from the native side. In 2016 a Team called Molecule released HENkaku (a HomeBrew Enabler, which has functionality similar to a custom firmware) for PlayStation Vita/PlayStation TV, which alters the PS Vita's/PS TV's firmware on version 3.60, which allows creating a custom firmware on the console. The team behind the original HENkaku has also released taiHEN. taiHEN is a framework on which the newest version of HENkaku runs. It is a way to load plugins at the system level like the user was used to on the PSP allowing them to change/add function to their console. Enso is a bootloader vulnerability of the PS Vita/PS TV that makes HENkaku permanent and allows to run it on the boot so the PS Vita/PS TV has a full CFW with HENkaku Enso. Users on 3.60 can also update to 3.65 without losing HENkaku Enso.

Nintendo 3DS

The modding scene of the Nintendo 3DS primarily involve custom firmware (software which patches the official firmware "on the fly"), which requires an exploit to obtain control of the ARM9, the 3DS' security coprocessor, and, secondarily, flash cartridges, which emulate an original game cart (which can be solely used to play untouched game cart ROM backups). The current most widely used CFW is Luma3DS, developed by Aurora Wright and TuxSH, which allows unsigned CIA (CTR Importable Archives) installation, includes open-source rewritten system firmware modules, and exception handling for homebrew software developers. Other past and abandoned CFWs included Gateway (a proprietary CFW locked to a flash cartridge via DRM and the first publicly available one), Pasta, RxTools (the first free and widely used one), Cakes CFW (the first open source CFW, which used a modularized approach for patches and was the inspiration for the following ones), ReiNAND, which Luma3DS was originally based on, and Corbenik; as of now the only custom firmware still currently being developed is Luma3DS (previously known as AuReiNAND). 3DS CFWs used to rely on "EmuNAND"/"RedNAND", a feature that boots the system from an unpartitioned space of the SD card containing a copy of the 3DS' NAND memory. These EmuNANDs could protect the 3DS system from bricking, as the usual system NAND was unaffected if the emuNAND is no longer functioned properly or was otherwise unusable. EmuNANDs could also be updated separately from the usual system NAND, allowing users to have the latest system version on the EmuNAND while retaining the vulnerable version on the system NAND; thus making online play and Nintendo eShop access possible on outdated 3DS system versions. EmuNANDs were obsoleted by the release of arm9loaderhax, a boot-time ARM9 exploit that allowed people to safely use SysNAND and update it, as CFWs started patching the OS' update code so that official updates wouldn't remove the exploit. However, this exploit required a downgrade to a very early system version to get the console's unique OTP, necessary for the installation. On May 19, 2017 a new exploit basis called sighax was released, replacing arm9loaderhax and allowing users to get even earlier control of the system, granting code execution in the context of the bootROM and thus a cleaner environment, with no downgrades or OTP required. Boot9Strap, a user-friendly version of sighax, was released. At the same time, another bootROM exploit called ntrboot was announced, which allows people to use a backdoor present in the bootROM to get full system control on any 3DS console regardless of the firmware version (as the bootROM can't be updated), only requiring a modified DS flash cartridge and a magnet. The initial release was on August 12, supporting the AceKard 2i and R4i Gold 3DS RTS cartridges.

Nintendo Switch

Currently, several custom firmwares for the Nintendo Switch console exist: Atmosphère, ReiNX and SX OS. The differences between them are largely inconsequential; Atmosphère remains in active development and is free and open-source software. ReiNX bases much of its code off Atmosphère but with some modifications to runtime components and a different bootloader, while SX OS is closed source and paid, but largely based on Atmosphère code despite assertions to the contrary. Nintendo has made the Switch environment much more secure than previous consoles. Despite this, there exist notable bugs which lead to user exploits. Of these, the

Nvidia Tegra Tegra is a system on a chip (SoC) series developed by Nvidia for mobile devices such as smartphones, personal digital assistants, and mobile Internet devices. The Tegra integrates an ARM architecture central processing unit (CPU), graphics proc ...

stack bug () is the most well-exploited. It leverages the Recovery Mode (RCM) of the Switch unit in order to push unsigned/unverified payloads, in turn granting the user access to

arbitrary code execution In computer security, arbitrary code execution (ACE) is an attacker's ability to run any commands or code of the attacker's choice on a target machine or in a target process. An arbitrary code execution vulnerability is a security flaw in softw ...

. This vulnerability has been further leveraged by users within the Switch hacking scene to reverse-engineer the firmware, leading to two other notable exploits: Nereba and Caffeine. While RCM is a hardware exploit, Nereba and Caffeine are software exploits and rely on the console being at or below specific firmware versions in order to make use of the exploits. RCM, being hardware related, merely relies on the console being vulnerable to that particular exploit and does not have a firmware requirement or range. Due to Nvidia's disclosure of CVE-2018-6242, Nintendo was forced to address the vulnerability, and during late 2018 began manufacturing and distributing units which have been hardware patched and are unable to access the RCM vulnerability. Any unit manufactured during or after this time is likely to be hardware patched, including the Switch Lite and the newer "red box" Switches, and any unit which is hardware patched and running a relatively recent firmware is unlikely to be able to access custom firmware at this time or in the future due to the unusually secure software environment of the Switch.

Android

The practice of replacing the system partition of the Android operating system, usually mounted as read-only, with a modified version of Android is called "flashing a ROM". The procedure requires unlocking the

bootloader A bootloader, also spelled as boot loader or called boot manager and bootstrap loader, is a computer program that is responsible for booting a computer. When a computer is turned off, its softwareincluding operating systems, application code, an ...

(typically by exploiting vulnerabilities in the operating system), is generally not supported by device manufacturers, and requires some expertise. However, since about 2015 Example: the 2015 G4 is the first LG phone for which the bootloader can be unlocked. several manufacturers, including LG, Motorola, OnePlus, Google

Xiaomi Corporation (; ), commonly known as Xiaomi and registered as Xiaomi Inc., is a Chinese designer and manufacturer of consumer electronics and related software, home appliances, and household items. Behind Samsung, it is the second largest m ...

, and Sony support unlocking the bootloader (except on devices that are locked by some carriers). This bypasses secure boot, without the need for exploits. The "custom ROMs" installed may include different features, require less power, or offer other benefits to the user; devices no longer receiving official Android version updates can continue to be updated.

Other devices

Various other devices, such as

digital camera A digital camera is a camera that captures photographs in digital memory. Most cameras produced today are digital, largely replacing those that capture images on photographic film. Digital cameras are now widely incorporated into mobile devices ...

wireless router A wireless router is a device that performs the functions of a router and also includes the functions of a wireless access point. It is used to provide access to the Internet or a private computer network. Depending on the manufacturer and mode ...

s and

smart TV A smart TV, also known as a connected TV (CTV), is a traditional television set with integrated Internet and interactive Web 2.0 features, which allows users to stream music and videos, browse the internet, and view photos. Smart TVs are a techn ...

s, may also run custom firmware. Examples of such custom firmware include: *

Rockbox Rockbox is a free and open-source software replacement for the OEM firmware in various forms of digital audio players (DAPs) with an original kernel. It offers an alternative to the player's operating system, in many cases without removing the or ...

for portable media players *

iPodLinux iPodLinux is a µClinux-based Linux distribution designed specifically to run on Apple Inc.'s iPod. When the iPodLinux kernel is booted it takes the place of Apple's iPod operating system and automatically loads Podzilla, an alternative GUI ...

for iPod portable media players * CHDK and

Magic Lantern The magic lantern, also known by its Latin name , is an early type of image projector that used pictures—paintings, prints, or photographs—on transparent plates (usually made of glass), one or more lenses, and a light source. Because a si ...

for Canon digital cameras * Nikon Hacker project for Nikon EXPEED DSLRs *

Coreboot coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware (BIOS or UEFI) found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and r ...

and Libreboot for computers * Many third-party firmware projects for wireless routers, including: ** LibreWRT project for Ben Nanonote, Buffalo WZR-HP-G300NH and other computers with minimal resources **

OpenWrt OpenWrt (from ''open wireless router'') is an open-source project for embedded operating systems based on Linux, primarily used on embedded devices to route network traffic. The main components are Linux, util-linux, musl, and BusyBox. All ...

, and its derivatives such as DD-WRT ** RouterTech, for ADSL gateway routers based on the Texas Instruments AR7 chipset (with the Pspboot or

Adam2 Disintegrin and metalloproteinase domain-containing protein 2 or Beta-fertilin is an enzyme that in humans is encoded by the ''ADAM2'' gene. Function This gene encodes a member of the ADAM (a disintegrin and metalloprotease domain) family. Me ...

) * Cable Hack and Sigma for

uncapping Uncapping, in the context of cable modems, refers to a number of activities performed to alter an Internet service provider's modem settings. It is sometimes done for the sake of bandwidth (i.e. by buying a 512kbit/s access modem and then altering ...

cable modems, but with dubious legality * Firmware that allows DVD drives to be region-free *

SamyGO The SamyGO project is publishing an Custom firmware, aftermarket firmware of smart TVs by Samsung. It consists of a forum which contains various methods for Rooting (Android), rooting the smart TVs. Features The project has implemented NFS and S ...

, modified firmware for

Samsung The Samsung Group (or simply Samsung) ( ko, 삼성 ) is a South Korean multinational manufacturing conglomerate headquartered in Samsung Town, Seoul, South Korea. It comprises numerous affiliated businesses, most of them united under the ...

smart TVs

References

{{Embedded systems Homebrew software Video game development