Post: Working on DNS bypass
02-09-2011, 03:23 PM #1
(adsbygoogle = window.adsbygoogle || []).push({}); Since I can't reply yet to other related posts I'll start a new.
(Mods, you can move this if you want)

Things I've done so far:

Used own dns to fake following domain names:
cdn.update.playstation.net
np.stun.playstation.net
ps3.update.playstation.net
dl.playstation.net
vo.llnwd.net

They all point to my own server (apache)

Also configured squid to redirect You must login or register to view this content. to my server, since for some reason the ps3 does bypass my dns the 2nd time it tries.

I use following ps3-updatelist.txt:

    
cat /var/www/update/ps3/list/eu/ps3-updatelist.txt
# EU
Dest=85;CompatibleSystemSoftwareVersion=3.5500-;
Dest=85;ImageVersion=0000b99c;SystemSoftwareVersion=3.5500;CDN=https://xxx.xxx.xxx.xxx/PS3UPDAT.PUP;CDN_Timeout=30;


This is the access.log from squid when I boot the ps3:
    
1297264108.259 0 xxx.xxx.xxx.xxx TCP_DENIED/302 442 GET https://feu01.ps3.update.playstation.net/update/ps3/list/eu/ps3-updatelist.txt - NONE/- text/html
1297264108.268 0 xxx.xxx.xxx.xxx TCP_MEM_HIT/200 630 GET https://xxx.xxx.xxx.xxx/update/ps3/list/eu/ps3-updatelist.txt - NONE/- text/plain
1297264111.669 738 xxx.xxx.xxx.xxx TCP_MISS/200 3455 CONNECT auth.np.ac.playstation.net:443 - DIRECT/199.108.4.73


This is what happens if you logon manually after boot:
    
1297264214.516 3 xxx.xxx.xxx.xxx TCP_MISS/404 683 GET https://xmb.dl.playstation.net/xmb/ps3/AD..1WSfwnwPwNFaQCpP5bBETOc_/music2/xil.xml - DIRECT/xxx.xxx.xxx.xxx text/html
1297264215.084 2 xxx.xxx.xxx.xxx TCP_MISS/404 683 GET https://xmb.dl.playstation.net/xmb/ps3/AD..1WSfwnwPwNFaQCpP5bBETOc_/video2/xil.xml - DIRECT/10.252.19.1 text/html
1297264215.894 2 xxx.xxx.xxx.xxx TCP_MISS/404 679 GET https://xmb.dl.playstation.net/xmb/ps3/AD..1WSfwnwPwNFaQCpP5bBETOc_/tv/xil.xml - DIRECT/xxx.xxx.xxx.xxx text/html
1297264216.773 731 xxx.xxx.xxx.xxx TCP_MISS/200 3455 CONNECT auth.np.ac.playstation.net:443 - DIRECT/199.108.4.73 -
1297264218.164 740 xxx.xxx.xxx.xxx TCP_MISS/200 3455 CONNECT auth.np.ac.playstation.net:443 - DIRECT/199.108.4.73 -
1297264218.581 23 1xxx.xxx.xxx.xxx TCP_MISS/504 0 CONNECT nsx.sec.np.dl.playstation.net:443 - DIRECT/xxx.xxx.xxx.xxx -
1297264223.784 0 xxx.xxx.xxx.xxx TCP_DENIED/302 442 GET https://feu01.ps3.update.playstation.net/update/ps3/list/eu/ps3-updatelist.txt - NONE/- text/html
1297264223.794 0 xxx.xxx.xxx.xxx TCP_MEM_HIT/200 631 GET https://xxx.xxx.xxx.xxx/update/ps3/list/eu/ps3-updatelist.txt - NONE/- text/plain


PS3 comes up with update message.
When saying yes, it come's back saying my ps3 is up to date.

I also blocked all ports except 80 and 443 for the ps3 before boot, but then nothing works.

Blocking all but 80 and 443 after boot results in a longer attempt to logon, but then fails with error 80710092

So something is communicating over a non standard port with sony.

I'll try to change my network so I sniff the traffic, as now the ps3 is connected over wireless and wireshark runs on the wired part.

BTW:
anyone an idea what this link does:
You must login or register to view this content.

BTW2: As I read in many other posts here, if you don't know what yo are talking about, don't bother reply-ing Winky Winky (Like someone posted an ip address is only in this format xxx.xxx.xx.x /facepalm)
(adsbygoogle = window.adsbygoogle || []).push({});

The following user thanked penguin_be for this useful post:

gameoverrg
02-10-2011, 03:20 PM #11
TheGuyWhoHakz
Pokemon Trainer
Originally posted by be View Post
I think I found out how they check the current fw.
Just thinking out-loud and still needs to be confirmed but I can't do it at current location.

Based on this:


The fw version is in the browser header of the PS3, so all they need to do at the authentication server is read that header.

If this is really the case, we need to change the browser header in the cfw 3.55

Modifying the header via proxy can't be done I think, due to ssl


Cant someone write a 3.55 CFW which disguises the headers?
02-10-2011, 04:21 PM #12
zxz0O0
Are you high?
Originally posted by be View Post
On what port is that tcp connection?


59593. There are also some connections on 59594. And that nsx url is indeed for the PSN News.
02-10-2011, 04:52 PM #13
Originally posted by TheGuyWhoHakz View Post
Cant someone write a 3.55 CFW which disguises the headers?


That is in my opinion a bigger aim than writing a cfw 3.56
(Only if I'm correct in my assumption)
Writing a cfw that is easily patched and can fool the ps3 system.
Just like it's done on the wii

---------- Post added at 11:30 AM ---------- Previous post was at 11:28 AM ----------

Originally posted by zxz0O0 View Post
59593. There are also some connections on 59594. And that nsx url is indeed for the PSN News.


Sure that is not an inbound port in reply to an outgoing http or https request?

What happens if you block those ports?

---------- Post added at 11:52 AM ---------- Previous post was at 11:30 AM ----------

OK, confirmed!

HTTP_X_PS3_BROWSER:3.10 (WP;system=3.55)


Can someone go with his 3.56 ps3 to You must login or register to view this content. and post the results.

In the meanwhile I'll try to figure out how to modify this header with squid
02-10-2011, 10:01 PM #14
Aspire.
The future is in your hands
You realise once you have made a succesful DNS bypass, Once you release it to the public, Sony will end up blocking it, so in the end your hard working goes to waist unless you can make another one really quickly.

The following user thanked Aspire. for this useful post:

Gloxin
02-11-2011, 07:20 AM #15
Goal is to find as much as possible.

Don't forget Sony can't do anything drastic. They have to make sure that current games are still playable.
02-11-2011, 07:49 AM #16
alchybear
< ^ > < ^ >
maybe in the cfw 3.55 with the access to dev_flash we now have to it with asbestos 1.4 with congeies file manager maybe JUST maybe we can edit the file that responds to these to say we are on 3.56, just as a note the file that is called version.txt does not SOLVE anything to it but maybe im missing somthin else out of it too
02-11-2011, 08:42 AM #17
I need the http headers for a ofw 3.56
02-11-2011, 12:54 PM #18
i hope you get this working!
02-11-2011, 09:43 PM #19
Since I'm not a coder (well used to be, but very long time ago) I'm not risking in fiddling in the flash. I've ended up with to many mobile phone bricks to brick my ps3 Smile

I'm thinking of a new approach now, and that's in faking the psn logon with your own webserver.
But again, the tricky part will be the ssl certificates and finding out what the ps3 sends and mostly expects to receive.

Copyright © 2026, NextGenUpdate.
All Rights Reserved.

Gray NextGenUpdate Logo