# webMAN MOD Stealth Features and IDPS/PSID Spoofing: Implementation Guide

> Learn how webMAN MOD stealth features and IDPS PSID spoofing work. This guide details Cobra PS3MAPI syscalls for masking custom firmware and bypassing detection.

- Repository: [Aldo Vargas/webman-mod](https://github.com/aldostools/webman-mod)
- Tags: how-to-guide
- Published: 2026-02-24

---

**webMAN MOD implements stealth capabilities and console identifier spoofing through Cobra/PS3MAPI syscalls that disable detection vectors and patch kernel memory to mask custom firmware presence.**

webMAN MOD provides sophisticated stealth mechanisms designed to hide the plugin from the PlayStation 3 system UI and spoof the console's unique identifiers. These features operate at the kernel level through the `SC_COBRA_SYSCALL8` interface, enabling users to bypass detection systems and run disc-based games tied to different consoles. This article examines the implementation details in the aldostools/webman-mod repository, analyzing how stealth mode conceals custom firmware activity and how IDPS/PSID spoofing modifies console identity data.

## How Stealth Mode Works in webMAN MOD

Stealth mode in webMAN MOD serves as a comprehensive evasion mechanism that removes digital fingerprints of custom firmware from the system. According to the source code in [`include/ps3mapi/stealth.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/stealth.h), stealth functionality encompasses three primary defense layers: hiding the plugin from XMB menus and process lists, disabling specific system calls used for firmware detection, and blocking PlayStation Network URLs that could expose the console's modified state.

### Hiding the Plugin and Blocking System Calls

The core stealth implementation resides in [`include/ps3mapi/stealth.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/stealth.h), which defines the syscall removal infrastructure. When activated, the system executes `remove_cfw_syscalls()`, a function that writes zero values into the syscall table entries associated with known custom firmware detection vectors. The code maintains a restoration capability through `restore_cfw_syscalls()`, allowing the plugin to reverse these modifications when stealth mode is disabled.

The implementation specifically targets `syscall 8` through `remove_cfw_syscall8()`, which is the primary Cobra/PS3MAPI syscall interface. By clearing this entry, external tools cannot query the kernel for custom firmware indicators. The header defines `SYSCALLS_UNAVAILABLE` as `0xFFFFFFFF80010003ULL`, representing the error code returned when blocked syscalls are invoked.

### PSN URL Blocking Mechanism

webMAN MOD maintains a table of blocked PlayStation Network URLs to prevent authentication leaks. The source defines `static u64 blocked_url[MAX_BLOCKED_URL][2]` and `u8 url_count` to track these entries. The function `restore_blocked_urls(bool notify)` handles writing these blocked addresses into LV1 (hypervisor) memory, effectively preventing the console from contacting Sony's servers that would expose the custom firmware presence.

### Stealth Folder Implementation

When stealth mode is active, webMAN MOD redirects game scanning to a hidden directory defined in [`include/init/paths.h`](https://github.com/aldostools/webman-mod/blob/main/include/init/paths.h) as `MM_ROOT_STL "/dev_hdd0/tmp/game_repo/main"`. This stealth folder remains invisible to standard XMB scans, ensuring game content remains accessible to webMAN while hidden from the default system browser.

### Activation Flow

The stealth activation sequence begins in [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) when the configuration flag `webman_config->stealth` evaluates to true. The plugin executes:

```c
system_call_3(SC_COBRA_SYSCALL8, SYSCALL8_OPCODE_STEALTH_ACTIVATE, 0, 0);

```

The opcode `SYSCALL8_OPCODE_STEALTH_ACTIVATE` (defined as `0x3995` in [`include/ps3mapi/ps3mapi.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi.h)) triggers the kernel-level stealth extension (derived from the PSNPatch project) to set an internal flag. This flag initiates the cascade of `remove_cfw_syscalls()`, `remove_cfw_syscall8()`, and `restore_blocked_urls(false)` calls that sanitize the system's detectable state.

## IDPS and PSID Spoofing Implementation

IDPS (Initial Device Private Key) and PSID (PlayStation ID) spoofing allows webMAN MOD to masquerade as a different console by overwriting these unique identifiers stored in flash memory. This capability enables running disc-based games bound to specific console IDs and alters the console's network identity.

### Console Identifier Structure

The IDPS consists of two 64-bit values representing the console's unique hardware identity. webMAN MOD stores user-provided spoof values in `webman_config->vIDPS1` and `webman_config->vIDPS2`, with activation flags `webman_config->sidps` and `webman_config->spsid` controlling IDPS and PSID spoofing respectively.

### The spoof_idps_psid() Function

The primary spoofing logic resides in [`include/feat/idps.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/idps.h) within the `spoof_idps_psid()` function. The implementation follows this sequence:

1. **Hex Conversion**: User-provided string values convert to unsigned 64-bit integers via `convertH()`, populating `newIDPS[2]`.

2. **Validation**: The code performs a sanity check ensuring the IDPS follows the required format pattern:
   ```c
   if(((newIDPS[0] & 0xFFFFFFFFFFF0FF00ULL) == 0x0000000100800000ULL) && (newIDPS[1] != 0))
   ```

3. **Kernel Write**: For Cobra-enabled firmware, the system invokes:
   ```c
   system_call_4(SC_COBRA_SYSCALL8, 
                 SYSCALL8_OPCODE_PS3MAPI, 
                 PS3MAPI_OPCODE_SET_IDPS,
                 (u64)newIDPS[0], 
                 (u64)newIDPS[1]);
   ```

   The opcode `PS3MAPI_OPCODE_SET_IDPS` (defined as `0x0082` in [`include/ps3mapi/ps3mapi.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi.h)) instructs the kernel to overwrite the protected IDPS values.

4. **Legacy Fallback**: For firmware versions 4.53 and below, or when specific offsets are known (`idps_offset1` and `idps_offset2`), the code falls back to direct memory patching using `pokeq()` to write values directly to flash-derived memory locations.

### PSID Spoofing Parallels

PSID spoofing follows an identical pattern using `PS3MAPI_OPCODE_SET_PSID` (`0x0084`). The same validation, conversion, and fallback mechanisms apply, allowing simultaneous spoofing of both identifiers through the webMAN setup interface.

## Key Source Files and Architecture

Understanding webMAN MOD's stealth architecture requires familiarity with several critical source files that define the syscall interface and configuration handling.

### Core Header Files

**[`include/ps3mapi/stealth.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/stealth.h)** contains the stealth mode implementation including `remove_cfw_syscalls()`, `restore_cfw_syscalls()`, and the URL blocking table management.

**[`include/ps3mapi/ps3mapi.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi.h)** defines the essential opcodes for both stealth and spoofing operations:
- `SYSCALL8_OPCODE_STEALTH_ACTIVATE 0x3995`
- `PS3MAPI_OPCODE_SET_IDPS 0x0082`
- `PS3MAPI_OPCODE_SET_PSID 0x0084`

**[`include/feat/idps.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/idps.h)** implements the identifier spoofing logic through `spoof_idps_psid()` and supporting conversion functions.

**[`include/ps3mapi/ps3mapi_server.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi_server.h)** and **[`include/ps3mapi/ps3mapi.c`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/ps3mapi.c)** handle remote administration commands, processing `SETIDPS` and `GETIDPS` requests from HTTP or telnet interfaces and forwarding them to the kernel syscall interface.

### Configuration Integration

The main entry point in [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) initializes these features by checking `webman_config` flags during plugin startup. When users enable stealth or spoofing through the web interface (`/setup.ps3`), the configuration reload triggers the respective syscall sequences, applying changes without requiring system reboots.

## Practical Implementation Examples

### Enabling Stealth via HTTP Interface

Users can activate stealth mode remotely through the web interface:

```bash

# HTTP request to enable stealth

http://<ps3_ip>/setup.ps3?stealth=1

```

This updates `webman_config->stealth` and triggers:

```c
system_call_3(SC_COBRA_SYSCALL8,
              SYSCALL8_OPCODE_STEALTH_ACTIVATE,
              0, 0);

```

### Spoofing IDPS through Configuration

To spoof console identifiers, users submit hex values through the setup page:

```bash

# HTTP command format for IDPS spoofing

http://<ps3_ip>/setup.ps3?vIDPS1=001000000800ABCD&vIDPS2=001000000800EF01&sidps=1

```

Internally, this executes the spoofing routine in [`idps.h`](https://github.com/aldostools/webman-mod/blob/main/idps.h):

```c
u64 newIDPS[2] = { convertH("001000000800ABCD"),
                   convertH("001000000800EF01") };

system_call_4(SC_COBRA_SYSCALL8,
              SYSCALL8_OPCODE_PS3MAPI,
              PS3MAPI_OPCODE_SET_IDPS,
              newIDPS[0],
              newIDPS[1]);

```

## Summary

- **Stealth mode** operates through `SYSCALL8_OPCODE_STEALTH_ACTIVATE` (`0x3995`), which disables CFW syscalls via `remove_cfw_syscalls()`, blocks PSN URLs through the `blocked_url` table, and redirects game scanning to the hidden `MM_ROOT_STL` folder (`/dev_hdd0/tmp/game_repo/main`).

- **IDPS/PSID spoofing** is handled by `spoof_idps_psid()` in [`include/feat/idps.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/idps.h), which validates hex input through `convertH()`, checks the `0x0000000100800000ULL` pattern, and writes values using either `PS3MAPI_OPCODE_SET_IDPS` (`0x0082`) or direct memory pokes for legacy firmware.

- Both features depend on the **Cobra/PS3MAPI** syscall interface (`SC_COBRA_SYSCALL8`) and manipulate kernel-level data structures to mask the console's true firmware state and hardware identity.

## Frequently Asked Questions

### How does webMAN MOD hide itself from the XMB when stealth mode is enabled?

When stealth mode is activated, webMAN MOD executes the `SYSCALL8_OPCODE_STEALTH_ACTIVATE` syscall which removes the plugin from the list of loaded PRX modules and disables `syscall 8`, preventing system utilities from detecting the custom firmware. The plugin also redirects game scanning to the stealth folder defined as `/dev_hdd0/tmp/game_repo/main` in [`include/init/paths.h`](https://github.com/aldostools/webman-mod/blob/main/include/init/paths.h), keeping content accessible while invisible to standard XMB scans.

### What validation does webMAN MOD perform before applying IDPS spoofing?

Before writing new IDPS values, webMAN MOD validates the input through a bitwise pattern check in [`include/feat/idps.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/idps.h). The code verifies that `newIDPS[0] & 0xFFFFFFFFFFF0FF00ULL` equals `0x0000000100800000ULL` and that `newIDPS[1]` is non-zero. This ensures the spoofed IDPS follows the correct Sony console identifier format, preventing system instability from malformed values.

### Can stealth mode and IDPS spoofing be used simultaneously?

Yes, stealth mode and IDPS/PSID spoofing function independently and can operate concurrently. Stealth mode manages syscall visibility and network blocking through [`include/ps3mapi/stealth.h`](https://github.com/aldostools/webman-mod/blob/main/include/ps3mapi/stealth.h), while identifier spoofing modifies console-specific values through [`include/feat/idps.h`](https://github.com/aldostools/webman-mod/blob/main/include/feat/idps.h). Both features activate during plugin initialization in [`main.c`](https://github.com/aldostools/webman-mod/blob/main/main.c) when their respective configuration flags (`webman_config->stealth` and `webman_config->sidps`) are enabled.

### What is the difference between the PS3MAPI syscall method and direct memory patching for IDPS spoofing?

The PS3MAPI method uses `system_call_4` with `PS3MAPI_OPCODE_SET_IDPS` (`0x0082`) to request the kernel extension to handle the protected memory write, available on Cobra firmware. Direct memory patching via `pokeq()` serves as a fallback for legacy firmware versions 4.53 and below, or when specific flash offsets (`idps_offset1` and `idps_offset2`) are known, writing directly to the memory-mapped flash regions without kernel mediation.