• PS3 Remote Play Reverse Engineered!

    PS3 Hacks , 24.04.2009

    A hacker by the name “Dashhacker” has claimed to fully reverse the PSP to PS3 connection (remote play),broke the  authentication system , and promises a API very soon. Hackers such as RichDevX & Kid101Skater have attempted this in the past but were unable to do so fully.




    So what does this allow us to do? We will now be able to access the PS3 from ANYWHERE besides the PSP such as PC, iPhone, PDA via internet!

    A very interesting discovery and cool feature many of us can take advantage of.

    We will give you updates on this latest project when they become available.

    [VIA]

    Tags: , , , , , ,

    Discuss in Forums (37)

  • 37 Comments

    1. GregoryRasputin
      04-24-2009
      03:58 PM
      1

      Another claim by so called hackers without an ounce of proof,if this proves real,well done Dashhacker,if its a pile of rubbish,shame on you.

    2. tech3475
      04-24-2009
      04:05 PM
      2

      Recommendation:
      Please only report verified claims.

    3. kid101skater
      04-24-2009
      04:22 PM
      3

      Ok, well some news to clear up.

      Ps3 and psp remote play is not reversed, there is no evidence or proof stating that it has been reversed by the so called dev.

      I spent a long time working on the premo auth for ps3 and psp remote connectivity and the psp basicly is synced with your email address and psp's identification numbers, as well as some encryptions to a server to connect with your ps3. Ps3 is a native server that once the two have authorized a preferred private connection it will stream data from native:/ (native being the ps3.) the authorization codes with a total of 3 are very complicated and will mess up a server connection if alterd.

      Just saying that the dev most likely taken the work we have previously done, and got stuck on because it would not go further than freezing the connection, even with all the information gatherd from the dumps and connection information.

      So either proof or it 100% fake because i know how that system is ran with the connection and there was no available way to reauthenticate all the information to allow access.

      Thanks,
      kid101skater

    4. RichDevX
      04-25-2009
      01:44 AM
      4

      I've worked on remote play in the past, as kid101skater and my goals were different, so I believe that he has reversed the authentication as that's where I stopped.

      Here's a little info for the first set of challenges. Packets captured by jimp
      http://ps3.jim.sh/remoteplay/
      take a look at http://ps3.jim.sh/remoteplay/session.dat

      PREMO-PSPID: EGVdxcfAdNjw/eJ2d0GFcA==
      PREMO-UserName: amltcA==
      PREMO-SIGNIN-ID: amltQGp0YW4uY29t

      the above are encoded with base64

      PREMO-UserName = jimp

      PREMO-SIGNIN-ID = jim@***** will leave out just incase of bots

      So now that leaves PREMO-PSPID, which is actually the OpenPSID (unique ID for each machine)

      PREMO-PSPID = 0x10 0x65 0x5D 0xC5 0xC7 0xC0 0x74 0xD8 0xF0 0xFD 0xE2 0x76 0x77 0x41 0x85 0x70

      After a request is made, with the appropriate values, the ps3 will return session information along with PREMO-Nonce, which is designed so only the psp which is registered with the ps3 may reply with the correct response.

      PREMO-Nonce: M82JAIf9cAIC2JcrZzv9tg==

      PREMO-Nonce = 0x33 0xCD 0x89 0x00 0x87 0xFD 0x70 0x02 0x02 0xD8 0x97 0x2B 0x67 0x3B 0xFD 0xB6

      So what do we know about PREMO-Nonce, well it's 16 bytes (128 bits). At first I thought it was a computed MD5, although I'm skeptical that it involves hardware assisted encryption, due to the asm screenshot. The psp must return PREMO-Auth(base64 encoded) as the last authentication challenge. Although this is an amazing step forward, the content encryption algorithm must be reversed as well. Then we'll be able to decode the streams and be able to use remote play on different devices.

      Anyways, congrats to Dashhacker, keep up the good work.
      PS. Perhaps he reversed the content encryption as well

    5. jaasumbra
      04-25-2009
      04:55 AM
      5

      what happened to RichDevX's reply? I can only see it, when entering the thread from the front page? thats odd..

      EDIT:

      Works now thanks.

      I hope there's more to it than just hype..!!

    6. Ps3Rips
      04-25-2009
      08:58 AM
      6

      I can see it fine, and I used the "new posts" link

    7. GregoryRasputin
      04-25-2009
      09:18 AM
      7

      Originally Posted by Ps3Rips View Post
      I cna see it fine, and I used the "new posts" link
      Thats becasue your a moderator

    8. LeeZer
      04-25-2009
      09:22 AM
      8

      it'd be good to be able to access my ps3 from other devices. all my movies on my phone whenever i wanted them.

    9. Ps3Rips
      04-25-2009
      09:40 AM
      9

      I also looked into remote play back in 2008, with a another security researcher and we both came up the following.
      From what we gathered, the PS3, uses a 4 way EAPOL hand shake.
      Also the Ps3 wireless device by default uses
      PS3 WPA PSK AES-CCM

      You can change the key to one of your choice, if you use a psp to first link the two devices.
      Once remote play is turned on the PS3 then becomes an access point. (with the above encryption)

      To use a PC or mobile phone it would have to complete the EAPOL handshake.

      I don't think they have reversed anything, and I think they have made the announcement way too early in their research. Many groups and people have made this mistake in the past.

      I'm guessing at most they have grabbed the 4 way handshake and think they have cracked or reversed something, either that or they have grabbed the same information as in the session.dat above.
      I'd love for it to be something different and new, however I'm guessing that this thread already contains more information than they know and I have my doubts about their "reversing" as its called..

    10. Ihatecompvir
      04-25-2009
      05:00 PM
      10

      Awesome. I hope I can access my PS3 anywhere. What exactly does remote play let you do?

    11. MohammadAG
      04-25-2009
      05:03 PM
      11

      Originally Posted by Ihatecompvir View Post
      Awesome. I hope I can access my PS3 anywhere. What exactly does remote play let you do?
      Read your previous sentence. The answer is there
      [spoiler]It lets you access your PS3 using a PSP[/spoiler]

    12. dashhacker
      04-26-2009
      07:20 PM
      12

      Ps3 and psp remote play is not reversed, there is no evidence or proof stating that it has been reversed by the so called dev.
      Yes, Remote Play has been reverse-engineered. Entirely. Of course, you don't have to believe me, but a full API (with source-code) is on the way. Then, you can argue with that if you like.
      Just saying that the dev most likely taken the work we have previously done, and got stuck on because it would not go further than freezing the connection, even with all the information gatherd from the dumps and connection information.
      No. I've looked a no other "work" to date... because, simply, there isn't any. I'm fully capable of dumping network traffic on my own. There is NO published work on the *disassembly* that is required to reverse-engineer the authentication system used by Remote Play. HINT: flash0:/vsh/modules/premo_plugin.prx

      All "secrets" lay within that module. Study MIPS 3000 instruction set, learn psplink. Use prxdecryptor and prxtool to disassemble...

      This took me just over 1 week to do.
      So either proof or it 100% fake because i know how that system is ran with the connection and there was no available way to reauthenticate all the information to allow access.
      You don't know what you're talking about. 100% proof will be available very soon, including source code.
      At first I thought it was a computed MD5
      As did I, but it turns out that there isn't a single instance where an MD5 hash is used (for authentication or otherwise). Initially I assumed that the Nonce was used as it is in HTTP digest authentication... not so. Remote Play implements an entirely proprietary authentication system.
      The psp must return PREMO-Auth(base64 encoded) as the last authentication challenge. Although this is an amazing step forward, the content encryption algorithm must be reversed as well.
      Correct. The content encryption was significantly easier to determine than the authentication hash. Content encryption uses the Nonce XOR'd with a secret key. Every 4th audio frame is encrypted (the rest are clear), and only the video key-frames are encrypted (default: every 30).

    13. Frantz
      04-26-2009
      09:41 PM
      13

      Great work
      dashhacker!
      I can't wait to see your masterpiece in action! I hope that's soon! Congratulations!

    14. Gloris
      04-27-2009
      03:31 AM
      14

      so, in theory, would it now be possible to link 2 ps3's?

      say, i have a whole load of movies or tv shows or music on my ps3 at home, but then i goto my girlfriends house....could we access those files from her ps3 using this exploit?

    15. screwingates
      04-27-2009
      07:18 AM
      15

      Good work Dash.I'll be anticipating this release.It will be great for you to prove all these **** talkers wrong.Good for you sir.

      Screwingates

    16. GregoryRasputin
      04-27-2009
      07:31 AM
      16

      Originally Posted by screwingates View Post
      It will be great for you to prove all these **** talkers wrong.

      The PS3 has been plauged with fakes,so you cant blame people for being negative,it would perhaps be better,if these reverse engineers would keep their efforts/progress lo key untill something was actually released,there would be no **** talking

    17. dashhacker
      04-28-2009
      06:35 AM
      17

      Official project updates can be found here:
      http://www.ps3-hacks.com/forums/viewtopic.php?id=7666

    18. enohand
      04-28-2009
      07:24 AM
      18

      nice mang, keep us updated

    19. SCE
      04-30-2009
      05:37 PM
      19

      Just what Kid101skater says:

      Hello everyone!

      Well some truth is to be known about the current statements about the Rumors that dashhacker has reversed the PSP remote play functions. Well all good and dandy but there is some news to be said about it.



      Back when I was working on E-Premo I did alot of research in the dumps of the ram. And there are a few things that the PSP and the ps3 needed to get to connect.

      * ps3_name
      * ps3_mac
      * ps3_keytype

      Anyways. They got this with 2 little pluggins from the PSP itself.

      * flash0:/vsh/resource/npsignin_plugin.rco
      * flash0:/vsh/module/npsignin_plugin.prx

      Reversing those can also get you some basic information, and thats most likely what he did and tried to make a big hype about it.

      Being the fact they have now upgraded the remote play a bit it may be a bit more advanced. They use 3 different keys based off the base64 algorythm *spelling*. Anyways it has to do with alot of signin and auth over an http network as the PS3 acts like a server on port 9293. And it runs off multiple information off the flash and relates it as Native: . It also works with certs, and UID (uniqueId).

      There were also some sha keys as well and I never got to the point of figuring out where they came to use, but I'm sure they pull a point in authorizing everything.

      Anyways, to basicly emulate the remote play you would have to fully emulate the PSP and use the stock remote play function as creating your own remote play will not correctly or even allow you to connect with the PS3.

      Thanks. Kid101skater

    20. dashhacker
      04-30-2009
      10:01 PM
      20

      Anyways, to basicly emulate the remote play you would have to fully emulate the PSP and use the stock remote play function as creating your own remote play will not correctly or even allow you to connect with the PS3.

      Thanks. Kid101skater
      You clearly have NO idea what you're talking about. Stop embarrassing yourself. Spending more time hacking than posting drivel may yield you success.

    21. thefoolnz
      04-30-2009
      10:25 PM
      21

      Originally Posted by SCE View Post
      Just what Kid101skater says:
      it would seem like sour grapes to me, on your part, someone else may have succeeded we you have not, give them a break.

      also stop quoting other peoples work, quote your own, but you may have worked on it also, but how you present it here it sounds more like kid101skaters efforts not yours!


      I for one hope dashhacker has found/stumbled onto something because at least it is a step in the right direction!

      keep up the good work dashhacker!

    22. SCE
      05-01-2009
      04:41 PM
      22

      Originally Posted by thefoolnz View Post
      it would seem like sour grapes to me, on your part, someone else may have succeeded we you have not, give them a break.

      also stop quoting other peoples work, quote your own, but you may have worked on it also, but how you present it here it sounds more like kid101skaters efforts not yours!


      I for one hope dashhacker has found/stumbled onto something because at least it is a step in the right direction!

      keep up the good work dashhacker!
      Dude, I have just quoted the words. What is wrong with you?

    23. $n!pR
      05-01-2009
      10:28 PM
      23

      This working now? A little update would be nice...

    24. jaasumbra
      05-02-2009
      05:44 AM
      24

      Originally Posted by $n!pR View Post
      This working now? A little update would be nice...
      http://www.ps3-hacks.com/forums/viewtopic.php?id=7666

      he already posted the official update-thread. You can check there for updates.

    25. Frantz
      05-02-2009
      08:02 AM
      25

      See, there is the problem, why the hackers can't work together man, why when someone finds something another comes and bang, shoot him, why this kid101skater didn't email dashhacker and said, bro' i'm here for you, want problems do you have, can I help, and another one will come and another.... until we get this mentality and loose the present one ps3 will stai as it is, now this is the real answer to the question: WHY THE HELL PS3 ISN'T HACKED! Here is your answer!

    26. braders1986
      05-02-2009
      03:09 PM
      26

      'Frantz' Just nailed the head on the pin with the answer, I completly agree with what you just said there mate and as a hacker of psp a few years back your reason is spot on from my perspective, I just wish people could lend a hand now and again instead of just trying to compete all the bloody time and also reason I stop hacking

    27. NeoSabin
      05-02-2009
      07:29 PM
      27

      Please stay on topic.

    28. chucklesjh
      05-02-2009
      08:15 PM
      28

      I'm pretty effin' excited here. I've been watching that updates thread since it was posted, just waiting for that OS X beta

    29. grimlord
      05-03-2009
      05:56 AM
      29

      So we will be able to play PS1 games, using PS3, on any computer that is connected to the PS3? That is a cool thing.
      But, I wonder will it be able to do the same with PS3 and PS2 games. You see, my monitor does not have a VGA input, so I can’t connect my PS3 to it. Will I be able to play my PS3 games remotely too (on my PC monitor), or will I just be limited to PS1 games (the original PSP function)?
      Well, I don't have a PSP so, I don't have a slightest idea what are the things that we can do with the remote play. In any case, I hope that this program can let us extend them to a wider range of capabilities...

    30. lance_79
      05-03-2009
      10:11 AM
      30

      I think this only works with remote play games support.

    31. LOGAN5
      05-05-2009
      10:51 AM
      31

      Dashhacker post update here...
      http://www.ps3-hacks.com/forums/viewtopic.php?id=7666






      LOGAN5

    32. ajpowerranger
      05-08-2009
      07:58 AM
      32

      This sounds pretty cool. I don't know much about the properites that can be gained from remote play but is there anyway this could lead to any hacks for the ps3? or is it just something cool you can do with the ps3?

      Someone mentiond in the thread that the psp could act as a chip on the drive like what happended with the 360 to log all the data which eventually lead to the drive hack. Of course all this is just theory because like must ps3 things it will probably lead to bugger all lol

    33. MohammadAG
      05-08-2009
      08:22 AM
      33

      Originally Posted by ajpowerranger View Post
      This sounds pretty cool. I don't know much about the properites that can be gained from remote play but is there anyway this could lead to any hacks for the ps3? or is it just something cool you can do with the ps3?

      Someone mentiond in the thread that the psp could act as a chip on the drive like what happended with the 360 to log all the data which eventually lead to the drive hack. Of course all this is just theory because like must ps3 things it will probably lead to bugger all lol
      This will not lead to any hack. Remote play simply allows you to access the PS3 using the PSP.
      The video output is encoded and sent to the PSP over Wi-Fi or the internet. This API (if it even exists) allows the PS3 to be accessed using any device.
      I don't think the PSP could be used as a chip because it was released before the PS3

    34. Frantz
      05-08-2009
      10:22 AM
      34

      I just hope that will not be necessary internet on my ps3 'coes I never made it, I mean I need a router but I can't get it now, If the ps3 will work on my laptop monitor heal yeah I would run to Antartica to get one ) I mean I hope wi-fi or some cable will do the work, maybe d@$hhacker will explain the method we can connect, we need cables, wlan or a hardware, I don't really understand it, and maybe we can read a list by him, we can do this, we can I don't know, stream files, send, receive, play psone games, connect the ps3 to a monitor and the method we can do that, again cables/wifi... so on!

    35. ajpowerranger
      05-08-2009
      10:28 AM
      35

      You could also use a 360 controller....if you wanted! would be good if your playing with one of those people who says they lost because there not use to the ps3 controller.

    36. ajpowerranger
      05-08-2009
      06:56 PM
      36

      Well the Mac OSX version as just been relased http://www.ps3-hacks.com/2009/05/08/...os-x-released/

      Pc version as to wait about a week.

    37. jaasumbra
      05-16-2009
      05:24 AM
      37

      Source and Windows version now released.
      You can get the Windows version here:
      http://www.ps3-hacks.com/file/73

      There seems to be some problems with getting it work in vista, but hey at least it's a start