Inspirated

I was invited to BBC’s Islamabad studios today to participate in their World Have Your Say program regarding Sony’s Playstation Network being hacked. It was really fun, and while I was a little nervous about going on-air live on BBC World Service I tried to explain the difference between PSN and console-homebrew hackers as well as the importance of educating the users about their security. You can listen to the podcast directly or use the player below to stream the audio:

After a day of extensive Wireshark voyeurism I was finally able to connect to PSN on my 3.55 custom firmware through my Fedora box. This guide documents the procedure I used.

Requirements

The PC side of things:

• Fedora 14. Any other Linux distro or even Windows machines can work, but since my primary OS is Fedora that’s what the guide shall be focusing on.
• Internet connectivity on a separate interface than the one you’ll be connecting PS3 on. For example, my laptop connects through internet wirelessly while the PS3 is connecting to laptop through Ethernet.

The console side of things:

• A custom firmware installed without level 2 patch. kmeaw is recommended.

Basic familiarity with Linux can be helpful. Please note that the guide requires you to mess with the flash memory of your PS3. If you aren’t paying attention you can end up with a FUBAR clinker.

Setting up the firewall

On Fedora, go to “Administration” > “Firewall” and provide the root password. In “Trusted Services”, enable the following:

In “Other Ports”, click on “Add” and select port 8888 for tcp.

Setting up a shared connection between Fedora and PS3

On Fedora:

1. Connect to your wireless network.
2. Right click on the Network Manager icon in the system tray and click on “Edit Connections”.
3. Under the “Wired” tab, click on “Add”.
4. Under the “IPv4 Settings” tab, select “Shared to other computers” as the method.
5. Ensure that the “Connect automatically” box is checked.
6. Click on apply.

On PS3:

1. Under XMB, go to “Settings” > “Network Settings” > “Internet Connection Settings”.
2. Select “Custom”.
3. Select “Wired Connection”.
4. Select “Auto-Detect for operation mode.
5. Select “Automatic” for IP Address Setting.
6. Select “Do Not Set” for DHCP host name.
7. Select “Automatic” for DNS Setting.
8. Select “Automatic” for MTU.
9. Select “Do Not Use” for Proxy Server.
10. Select “Enable” for UPnP.
11. Connect the Ethernet cable and test the connection.

At this point, you should get the following result:

Obtain IP Address: Succeeded
Internet Connection: Succeeded
(A system software update is required. Go to [Settings] > [System Update] and perform the update.

To verify everything is working correctly, go to “System” > “Network Settings” >”Settings and Connection Status List”. You should see the following:

IP Address: 10.42.43.10
Subnet Mask: 255.255.255.0
Default Router: 10.42.43.1

Similarly, if you right click on the Network Manager icon in Fedora and click on “Connection Information”, you’ll see the following information for the shared connection:

IP Address: 10.42.43.1
Broadcast Address: 10.42.43.255
Subnet Mask: 255.255.255.0

As one last step for verification launch the Internet Browser on PS3 and see if it works.

Installing the proxy server

1. Login as root.

   $ su -

   $ su -

2. Download Charles for Linux.

   $ wget http://www.charlesproxy.com/assets//release/3.5.2/charles.tar.gz

   $ wget https://www.charlesproxy.com/assets//release/3.5.2/charles.tar.gz

3. Extract the tarball:

   $ tar xvzf charles.tar.gz

   $ tar xvzf charles.tar.gz

4. Change into the binary directory for Charles and add execute permissions to the launcher script:

   $ cd charles/bin/ $ chmod a+x charles.sh

   $ cd charles/bin/ $ chmod a+x charles.sh

5. Launch Charles:

   $ ./charles.sh

   $ ./charles.sh

6. Cancel the Firefox proxy configuration dialog. It isn’t needed for PS3.
7. Go to “Tools” > “Proxy Settings” and ensure the HTTP Proxy is listening on port 8888.

On PS3:

1. Launch “Settings” > “Network Settings” > “Internet Connection Settings” again.
2. Use the same settings as before but under “Proxy Server” specify 10.42.43.1 as the address and 8888 as the port number.
3. Test the connection. Charles should display a prompt about PS3 accessing the Internet, select “Allow”.

Just like before, ensure you can use the Internet Browse on PS3.

Finding the addresses of authorization and update servers

Restart your PS3 and try to sign in on PSN. Under the “Structure” tab in Charles you’ll see a server your console has communicated with during the process. For example, the “authentication” server is https://auth.np.ac.playstation.net:443/. In the list you’ll find the “update” server for your console (which differs from region to region). In my case, the update server was https://feu01.ps3.update.playstation.net/. Fire a console and find the IP addresses for both of these servers:

$ dig auth.np.ac.playstation.net

; <<>> DiG 9.7.2-P3-RedHat-9.7.2-5.P3.fc14 <<>> auth.np.ac.playstation.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8848
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;auth.np.ac.playstation.net. IN A

;; ANSWER SECTION:
auth.np.ac.playstation.net. 2893 IN A 199.108.4.73

;; Query time: 46 msec
;; SERVER: 203.82.48.3#53(203.82.48.3)
;; WHEN: Mon Feb 14 00:45:40 2011
;; MSG SIZE rcvd: 60

$ dig feu01.ps3.update.playstation.net

; <<>> DiG 9.7.2-P3-RedHat-9.7.2-5.P3.fc14 <<>> feu01.ps3.update.playstation.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16539
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;feu01.ps3.update.playstation.net. IN A

;; ANSWER SECTION:
feu01.ps3.update.playstation.net. 3600 IN CNAME a01.cdn.update.playstation.org.edgesuite.net.
a01.cdn.update.playstation.org.edgesuite.net. 54582 IN CNAME playstation.sony.akadns.net.
playstation.sony.akadns.net. 300 IN CNAME a192.d.akamai.net.
a192.d.akamai.net. 20 IN A 195.95.193.10
a192.d.akamai.net. 20 IN A 195.95.193.100

;; Query time: 952 msec
;; SERVER: 203.82.48.4#53(203.82.48.4)
;; WHEN: Mon Feb 14 00:49:07 2011
;; MSG SIZE rcvd: 203

Jot down the server names and their IP addresses:

Configuring the proxy server

In Charles:

1. Goto “Proxy” > “Reverse Proxies” and add two entries like this:

   
   (Click on the thumbnail for larger version.)

2. Download a spoofed ps3-updatelist.txt.
3. Goto “Tools” > “Map Local” and add the following entry (“Local Path” should point to the ps3-updatelist.txt you downloaded in the previous step):

   
   
   (Click on the thumbnails for larger version.)

4. Goto “Tools” > “Rewrite”, check “Enable Rewrite” and add a new set.
5. Use the following settings for location:

   

6. And the following for rules:

   
   (Click on the thumbnail for larger version.)

7. The rewrite settings should now look like this:

   
   (Click on the thumbnail for larger version.)

8. Go to “Proxy” > “Proxy Settings” > “SSL” and add the entry auth.np.ac.playstation.net in locations table.

Rebuilding Network Manager to mask PSN IPs

This can be a PITA for Linux newbies. Network Manager uses dnsmasq but hardcodes the configuration. Leaving us without any way of affecting the shared connection’s behavior without recompiling the RPM. If people are really having trouble with this part I’ll upload the patched RPMs.

1. Login as root:

   $ su -

   $ su -

2. Install build dependencies for Network Manager:

   $ yum-builddep NetworkManager

   $ yum-builddep NetworkManager

3. Download and install the source RPM for NetworkManager:

   $ yumdownloader --source NetworkManager

   $ yumdownloader --source NetworkManager

4. Install the source RPM:

   $ rpm -ivh NetworkManager-0.8.1-10.git20100831.fc14.src.rpm

   $ rpm -ivh NetworkManager-0.8.1-10.git20100831.fc14.src.rpm

   This will create a rpmbuild directory under the home directory for root.

5. Go to the SOURCES directory and download the patches:

   $ cd ~/rpmbuild/SOURCES/ $ wget https://inspirated.com/uploads/nm-applet-remove-dialog-sep.patch $ wget https://inspirated.com/uploads/nm-psn-access.patch

   $ cd ~/rpmbuild/SOURCES/ $ wget https://inspirated.com/uploads/nm-applet-remove-dialog-sep.patch $ wget https://inspirated.com/uploads/nm-psn-access.patch

   The first patch is a minor bugfix which causes compile errors. The second patche spoofs the authentication server’s IP address to 10.42.43.1 instead of 199.108.4.73. If you got a different IP address for auth.np.ac.playstation.net earlier with the dig command edit the second patch accordingly.

6. Download and build the spec file:

   $ cd ~/rpmbuild/SPECS/ $ wget https://inspirated.com/uploads/NetworkManager.spec $ rpmbuild -ba NetworkManager.spec

   $ cd ~/rpmbuild/SPECS/ $ wget https://inspirated.com/uploads/NetworkManager.spec $ rpmbuild -ba NetworkManager.spec

   If everything goes fine, the built RPMs shall appear in ~/rpmbuild/RPMS/<arch> directory.

7. Install the RPM:

   $ cd ~/rpmbuild/RPMS/x86_64/ $ rpm -Uvh --force NetworkManager-0.8.1-10.git20100831.fc14.x86_64.rpm

   $ cd ~/rpmbuild/RPMS/x86_64/ $ rpm -Uvh --force NetworkManager-0.8.1-10.git20100831.fc14.x86_64.rpm

8. Restart Network Manager:

   $ service NetworkManager restart

   $ service NetworkManager restart

Installing the spoofed certificate on PS3

The spoofed certificate Charles uses to intercept SSL traffic is in the docs directory of the tarball (charles-proxy-ssl-proxying-certificate.crt). Rename it to CA02.cer, put it on a USB stick and then head over to your console.

1. Install the AsbestOS installer and Comgenie’s Awesome Filemanager.
2. Restart your PS3, launch the AsbestOS installer.
3. The installer shall quit with an error about lack of level 2 access, press X to exit to XMB.
4. Launch Comgenie’s Awesome Filemanager. You’ll see a new device called /dev_rwflash which is providing read/write support to PS3’s internal flash.
5. Move to /dev_flash/data/cert, backup CA02.cer on your USB drive and replace it with the Charles certificate.
6. Restart your PS3.

Gluing it all together

So far:

• Fedora is sharing the Internet connection with PS3.
• PS3 is using Charles as the proxy server.
• Charles is all set to replace ps3-updatelist.txt as well as rewrite authentication headers.
• NetworkManager is patched to mask the authentication server’s IP address to 10.42.43.1.
• The CA02.cer certificate on PS3’s flash has been replaced by Charles’ spoofed certificate.

Try signing in to PSN now. You should see ps3-updatelist.txt file being mapped to the local version and 03.55 being replaced with 03.56 in the auth.np.ac.playstation.net header. If everything goes according to plan, this will be the result:

(Click on the thumbnail for larger version.)

One of the common issues gamers are facing in transferring their backups between their PS3 and PC is the filesize limits for FAT32 filesystems (which happens to be the only one recognized by Backup Manager on external USB drives). Fortunately, a workaround exists for transferring >4GB files to PS3 from USB storage. First of all, you’ll need Comgenie’s Awesome Filemanager. Once you’ve got it up and running you can split any large file in the following manner:

Big.file
Big.file.1.part
Big.file.2.part
Big.file.3.part

Comgenie’s package comes with a file-splitter which splits following the pattern mentioned above. However, the utility runs only on Windows or Wine integrated with Mono. Fellow *nixers can use the handy split to the same effect. Here’s a shell script which I wrote for automating this task:

ps3split.tar.gz

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

#!/bin/sh
 
if [ "$#" -lt "1" ]
then
    echo "Usage: ps3split inputfile"
    exit 1
fi
 
if [ "$(readlink -f .)" == "$(dirname "$(readlink -f "$1")")" ]
then
    echo "Cannot split files in the same directory as original"
    exit 1
fi
 
split --verbose \
      --bytes=4294967295 \
      --suffix-length=1 \
      --numeric-suffixes \
      "$1" "$(basename "$1").part."
 
old="$(basename "$1").part.0"
new="$(basename "$1")"
echo "renaming file \`$old\` -> \`$new\`"
mv "$old" "$new"
 
for old in $(basename "$1").part.*
do
    new=`echo $old | sed 's/^\(.*\).part.\(.\)$/\1.\2.part/'`
    echo "renaming file \`$old\` -> \`$new\`"
    mv "$old" "$new"
done

Use the script by providing it the path of a file you want to split:

[krkhan@orthanc ps3split]$ ./ps3split /mnt/bluray/PS3_GAME/USRDIR/TEKKEN.psarc

creating file `TEKKEN.psarc.part.0′
creating file `TEKKEN.psarc.part.1′
renaming file `TEKKEN.psarc.part.0` -> `TEKKEN.psarc`
renaming file `TEKKEN.psarc.part.1` -> `TEKKEN.psarc.1.part`

Transfer all the splitted files to your external harddisk and then copy the first part (`TEKKEN.psarc` in this case) using Comgenie’s Filemanager. It will automatically recognize the subsequent parts and join them together on the internal harddisk of PS3. I’ve tested the script on Tekken 6 and Red Dead Redemption and it worked flawlessly for both.

Paraphrasing the definition from The Devil’s Dictionary which was the primary motivation behind the blog name Inspirated:

“PIRACY, n. Commerce without its folly-swaddles, just as God made it.” — Ambrose Bierce

PS3, meet backups. Backups, meet PSGrooPIC:

(Click on the thumbnail for larger version.)

After Wii’s launch in UK, even I had started to see it as the potential console leader as it had beaten Xbox 360’s launch sales with a significant margin (105,000 vs. 71,000). Quite surprisingly, Playstation 3 surpassed Wii’s sales with almost twice that margin by selling 165,000 units within the first two days of the console’s release. If that wasn’t enough, from one million machines shipped across Europe, more than half (600,000) have already been sold. The figures have clearly overthrown predictions about Playstation 3’s demise in Europe due to the launch delay.

Things will only get better for the PS3 fans as there will be plenty of GOTY quality games out for them before 2008. Games like Metal Gear Solid 4: Guns of the Patriots and Devil May Cry 4 are sure to satisfy customers about their money’s worth. If you are also into casino games, there are a variety of online slots games that can be played on different websites. The phenomenon of PS3’s success can also be used to explain the apparent win of Blu-ray in high-def format war. According to PC Advisor, Blu-ray discs have not only surpassed the 100,000 milestone in sales, but have also ‘accounted for approximately 70 percent of the high-definition market since the first week in January’.

Microsoft’s monopolizing tactics surely don’t work in all fields of technology.