Online Connections: Difference between revisions

From PS4 Developer wiki
Jump to navigation Jump to search
No edit summary
 
(8 intermediate revisions by the same user not shown)
Line 1: Line 1:
= Game Related =
= PS Store Activation =
 
== URLs ==
 
PS Store content activation is often refered to as NP KDC.
 
On PS3, PSP and PS Vita:
* https://commerce.np.ac.playstation.net/cap.m
* https://commerce.np.ac.playstation.net/cdp.m
* https://commerce.np.ac.playstation.net/kdp.m
 
On PS4, the servers files are:
* /tcap.m for acttype 1 and 3
* /tcdp.m for acttype 2 and 4
* /tkdp.m for acttype 5 and 6
 
Usage on PS3, PSP and PS Vita:
* cap should be Console Activation Point. Posting loginid, password (or epassword) and consoleid to tcap.m returns act.dat file.
* cdp = Console Deactivation Point. Same as cap but the console removes the act.dat from the console after this is executed.
* kdp = ?Key Download/Drop Point?. RIF files are obtained from here
 
= Image =
 
Sony servers provide an API to convert any image available on internet to another file format. Here is an example:
<pre>
https://image.api.np.km.playstation.net/images/?format=png&w=4096&h=2160&image=https://pbs.twimg.com/profile_images/785892918645129216/1bmhzm0t.jpg
</pre>
<pre>
https://image.api.np.km.playstation.net/dis/images/?format=png&w=4096&h=2160&image=https://pbs.twimg.com/profile_images/785892918645129216/1bmhzm0t.jpg
</pre>
 
Supported arguments are:
* image (mandatory): URL to the image
* format: "png" or "jpg"
* w: width in pixel. It is limited to 4096.
* h: height in pixel. It is limited to 2160.
 
The maximum size may be 8847360 pixels (4096 times 2160).
 
= Game =


PlayStation 4 games and applications induce connection to internet to download updates, be downloaded in the case of contents bought on the PlayStation store, and some specific games use more connections for online gaming or diverse additional contents.
PlayStation 4 games and applications induce connection to internet to download updates, be downloaded in the case of contents bought on the PlayStation store, and some specific games use more connections for online gaming or diverse additional contents.
Line 55: Line 94:
Example of a single non-cumulative update PKG:
Example of a single non-cumulative update PKG:
* http://gs2.ww.prod.dl.playstation.net/gs2/ppkgo/prod/CUSA00001_00/4/f_3b8e420561f0b85ff65ac428a15092895f3131e8c4cfd63b1547b32adb6d8370/f/IP9100-CUSA00001_00-PLAYROOM00000000-A0102-V0100.pkg
* http://gs2.ww.prod.dl.playstation.net/gs2/ppkgo/prod/CUSA00001_00/4/f_3b8e420561f0b85ff65ac428a15092895f3131e8c4cfd63b1547b32adb6d8370/f/IP9100-CUSA00001_00-PLAYROOM00000000-A0102-V0100.pkg
* http://gs2.ww.prod.dl.playstation.net/gs2/ppkgo/prod/CUSA00001_00/9/f_ef965b581d35637dabc96366f29f1f0ece58c8fa9158b0eb7de9407ae72272e8/f/IP9100-CUSA00001_00-PLAYROOM00000000-A0107-V0100.pkg
Example of a single Delta Package update PKG:
Example of a single Delta Package update PKG:
* http://gs2.ww.prod.dl.playstation.net/gs2/ppkgo/prod/CUSA00135_00/21/f_06da3b33d65c72bc25dac70c5d3c5669addbe50a94e87cc644e5b9471101303f/f/EP1018-CUSA00135_00-BATMANARKHAMKNHT-A0118-V0100-DP.pkg
* http://gs2.ww.prod.dl.playstation.net/gs2/ppkgo/prod/CUSA00135_00/21/f_06da3b33d65c72bc25dac70c5d3c5669addbe50a94e87cc644e5b9471101303f/f/EP1018-CUSA00135_00-BATMANARKHAMKNHT-A0118-V0100-DP.pkg
Line 98: Line 138:
http://pls.patch.station.sony.com/patch/sha/
http://pls.patch.station.sony.com/patch/sha/
</pre>
</pre>
== Rocket League ==
See [[Bugs]].
== Final Fantasy XIV: A Realm Reborn ==
The game Final Fantasy XIV: A Realm Reborn tries to download an update patch before starting the game, instead of the official PKG way. It is yet to be confirmed which version of the game is affected, and if there is a demo available.
It uses HTTP not HTTPS so can be hijacked using a proxy or DNS. The signatures are maybe unverified.
=== vercheck.dat ===
The game executable downloads a file named vercheck.dat from
<pre>
https://web.archive.org/web/20171226083441/http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/ffxivpatch/02cbcb27/ffxivpatch/02cbcb27/vercheck.dat
</pre>
The content looks like a network transmission header:
<pre>
--477D80B1_38BC_41d4_8B48_5273ADB89CAC
Content-Type: application/octet-stream
Content-Location: ffxivpatch/02cbcb27/metainfo/D2014.04.02.0000.0000.http
X-Patch-Length: 62171712
62171712 62915700 3 3 2017.12.06.0000.0001 http://patch-dl.ffxiv.com/boot/02cbcb27/D2017.12.06.0000.0001.patch
--477D80B1_38BC_41d4_8B48_5273ADB89CAC--
</pre>
and from the URL
<pre>
https://web.archive.org/web/20171209090142/http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/?time=2014-04-04-11
</pre>
we have an older version dumped:
<pre>
--477D80B1_38BC_41d4_8B48_5273ADB89CAC
Content-Type: application/octet-stream
Content-Location: ffxivpatch/02cbcb27/metainfo/D2014.04.02.0000.0000.http
X-Patch-Length: 62171712
62171712 62915700 3 3 2017.11.24.0000.0001 http://patch-dl.ffxiv.com/boot/02cbcb27/D2017.11.24.0000.0001.patch
--477D80B1_38BC_41d4_8B48_5273ADB89CAC--
</pre>
as well as from
<pre>
https://web.archive.org/web/20170104080948/http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/?time=2014-04-04-11
</pre>
where the version is even older:
<pre>
--477D80B1_38BC_41d4_8B48_5273ADB89CAC
Content-Type: application/octet-stream
Content-Location: ffxivpatch/02cbcb27/metainfo/D2014.04.02.0000.0000.http
X-Patch-Length: 55610720
55610720 56493172 3 3 2016.12.08.0000.0001 http://patch-dl.ffxiv.com/boot/02cbcb27/D2016.12.08.0000.0001.patch
--477D80B1_38BC_41d4_8B48_5273ADB89CAC--
</pre>
The vercheck.dat file contains the URL to download the .patch file.
* https://web.archive.org/web/*/http://patch-bootver.ffxiv.com/*
* http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/?time=2014-04-04-11
* http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/ffxivpatch/02cbcb27/ffxivpatch/02cbcb27/vercheck.dat
* http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/ffxivpatch/02cbcb27/vercheck.dat
=== patch file ===
The patch is in ZIPATCH format. The patch may be RSA signed, but maybe the downloader executable or the checker is vulnerable to buffer overflows or other vulnerabilities.
* https://web.archive.org/web/*/http://patch-dl.ffxiv.com/*
=== Tools for patch file download and analysis ===
* https://xiv.dev/data-files/zipatch
* http://ffxivclassic.fragmenterworks.com/wiki/index.php/ZiPatch_File_Structure
* https://project-novum.github.io/game-patching/zipatch/
* https://project-novum.github.io/game-files/executables/ffxivboot/
* https://project-novum.github.io/game-patching/patching/
* https://github.com/Project-Novum/NovumZiPatchExplorer
* https://github.com/goatcorp/FFXIVQuickLauncher/blob/19c603de1ec038136bdb14d65924bd525131d3fb/src/XIVLauncher.Common.Tests/PatchAcquisitionTests.cs
* https://github.com/goatcorp/XIVLauncher.Core/issues/23


= TV and Video Service Applications =
= TV and Video Service Applications =


See also [[Media Services]].
See also [[Media Services]] and [[Internet Browser]].


As on the PS3, [http://www.psdevwiki.com/ps3/Online_Connections#TV.2FVideo_Services TV/Video_Services] can be directly installed to the console, seperately from browsing the PS store.
As on the PS3, [http://www.psdevwiki.com/ps3/Online_Connections#TV.2FVideo_Services TV/Video_Services] can be directly installed to the console, seperately from browsing the PS store.


As a side reference, on PlayStation 3 (WebMAF), the user-agent of TV & Video applications used to be mostly <code>"Mozilla/5.0 (PlayStation 3) AppleWebKit/531.3 (KHTML, like Gecko) SCEE/1.0 Nuanti/2.0</code> whilst on PS4 it is mostly <code>Mozilla/5.0 (PlayStation 4) AppleWebKit/531.3 (KHTML, like Gecko) SCEE/1.0 Nuanti/2.0</code>.
As a side reference, on PlayStation 3 (WebMAF), the user-agent of TV & Video applications used to be mostly <code>"Mozilla/5.0 (PlayStation 3) AppleWebKit/531.3 (KHTML, like Gecko) SCEE/1.0 Nuanti/2.0</code> whilst on PS4 it is mostly <code>Mozilla/5.0 (PlayStation 4) AppleWebKit/531.3 (KHTML, like Gecko) SCEE/1.0 Nuanti/2.0</code>.
== SnagFilms ==
See [[Bugs]].
== VidNow ==
See [[Bugs]].


= Commerce related =
= Commerce related =
Line 298: Line 425:
* [http://www.wireshark.org/ WireShark]
* [http://www.wireshark.org/ WireShark]
* [http://www.charlesproxy.com/ CharlesProxy]
* [http://www.charlesproxy.com/ CharlesProxy]
* Archive.org wayback machine allows to list every file it has archive for a specific subdomain by going to <code>https://web.archive.org/web/*/<DOMAIN>/*</code>. The same can be achieved in command line by installing the [https://github.com/akamhy/waybackpy waybackpy] python library and typing <code>waybackpy --url <DOMAIN> --user_agent "ua" --known_urls > <DOMAIN>.txt</code>.


= Guides =
= Guides =

Latest revision as of 23:57, 24 December 2024

PS Store Activation[edit | edit source]

URLs[edit | edit source]

PS Store content activation is often refered to as NP KDC.

On PS3, PSP and PS Vita:

On PS4, the servers files are:

  • /tcap.m for acttype 1 and 3
  • /tcdp.m for acttype 2 and 4
  • /tkdp.m for acttype 5 and 6

Usage on PS3, PSP and PS Vita:

  • cap should be Console Activation Point. Posting loginid, password (or epassword) and consoleid to tcap.m returns act.dat file.
  • cdp = Console Deactivation Point. Same as cap but the console removes the act.dat from the console after this is executed.
  • kdp = ?Key Download/Drop Point?. RIF files are obtained from here

Image[edit | edit source]

Sony servers provide an API to convert any image available on internet to another file format. Here is an example: 

https://image.api.np.km.playstation.net/images/?format=png&w=4096&h=2160&image=https://pbs.twimg.com/profile_images/785892918645129216/1bmhzm0t.jpg

https://image.api.np.km.playstation.net/dis/images/?format=png&w=4096&h=2160&image=https://pbs.twimg.com/profile_images/785892918645129216/1bmhzm0t.jpg

Supported arguments are:

  • image (mandatory): URL to the image
  • format: "png" or "jpg"
  • w: width in pixel. It is limited to 4096.
  • h: height in pixel. It is limited to 2160.

The maximum size may be 8847360 pixels (4096 times 2160).

Game[edit | edit source]

PlayStation 4 games and applications induce connection to internet to download updates, be downloaded in the case of contents bought on the PlayStation store, and some specific games use more connections for online gaming or diverse additional contents.

Game Description JSON[edit | edit source]

Format:

Example:

Game Update Description XML[edit | edit source]

Contains link to the Delta Package if it exists, the PlayGo Manifest XML and the Description JSON.

Format:

Example:

Game Update Description JSON[edit | edit source]

Contains links to the chunks of PKG files for the non-cumulative patch.

Format:

Example:

PlayGo Manifest XML[edit | edit source]

Contains information on how the package should be downloaded and installed.

Format:

Example:

Game Update PKG[edit | edit source]

Format:

  • http://gs2.ww.prod.dl.playstation.net/gs2/ppkgo/prod/<NP Title ID>/<Some number>/f_<Hash>/f/<Content ID>-A<Application Version>-V<Version><Suffix>.pkg
  • It can be derived from the JSON url by removing ".json" and appending "<Suffix>.pkg".
  • Suffix can be blank or "-DP" for a Delta Package (i.e. a Cumulative Patch) or "_n" where n is a decimal digit representing the chunk number.

Example of a single non-cumulative update PKG:

Example of a single Delta Package update PKG:

Example of chunks of non-cumulative update PKG:

Additional Content JSON[edit | edit source]

Format:

Example:

Additional Content PKG[edit | edit source]

Format:

Example:

Additional Content PKG Digest[edit | edit source]

Format:

Example:

Planet Side 2[edit | edit source]

The Planet Side 2 game on PS4 hosted some files on a server owned by Sony. Most URLs had the prefix 

http://pls.patch.station.sony.com/patch/sha/

Rocket League[edit | edit source]

See Bugs.

Final Fantasy XIV: A Realm Reborn[edit | edit source]

The game Final Fantasy XIV: A Realm Reborn tries to download an update patch before starting the game, instead of the official PKG way. It is yet to be confirmed which version of the game is affected, and if there is a demo available.

It uses HTTP not HTTPS so can be hijacked using a proxy or DNS. The signatures are maybe unverified.

vercheck.dat[edit | edit source]

The game executable downloads a file named vercheck.dat from 

https://web.archive.org/web/20171226083441/http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/ffxivpatch/02cbcb27/ffxivpatch/02cbcb27/vercheck.dat

The content looks like a network transmission header: 

--477D80B1_38BC_41d4_8B48_5273ADB89CAC
Content-Type: application/octet-stream
Content-Location: ffxivpatch/02cbcb27/metainfo/D2014.04.02.0000.0000.http
X-Patch-Length: 62171712

62171712	62915700	3	3	2017.12.06.0000.0001	http://patch-dl.ffxiv.com/boot/02cbcb27/D2017.12.06.0000.0001.patch
--477D80B1_38BC_41d4_8B48_5273ADB89CAC--

and from the URL 

https://web.archive.org/web/20171209090142/http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/?time=2014-04-04-11

we have an older version dumped: 

--477D80B1_38BC_41d4_8B48_5273ADB89CAC
Content-Type: application/octet-stream
Content-Location: ffxivpatch/02cbcb27/metainfo/D2014.04.02.0000.0000.http
X-Patch-Length: 62171712

62171712	62915700	3	3	2017.11.24.0000.0001	http://patch-dl.ffxiv.com/boot/02cbcb27/D2017.11.24.0000.0001.patch
--477D80B1_38BC_41d4_8B48_5273ADB89CAC--

as well as from 

https://web.archive.org/web/20170104080948/http://patch-bootver.ffxiv.com/http/ps4/ffxivneo_release_boot_eu/2014.04.02.0000.0000/?time=2014-04-04-11

where the version is even older: 

--477D80B1_38BC_41d4_8B48_5273ADB89CAC
Content-Type: application/octet-stream
Content-Location: ffxivpatch/02cbcb27/metainfo/D2014.04.02.0000.0000.http
X-Patch-Length: 55610720

55610720	56493172	3	3	2016.12.08.0000.0001	http://patch-dl.ffxiv.com/boot/02cbcb27/D2016.12.08.0000.0001.patch
--477D80B1_38BC_41d4_8B48_5273ADB89CAC--

The vercheck.dat file contains the URL to download the .patch file.

patch file[edit | edit source]

The patch is in ZIPATCH format. The patch may be RSA signed, but maybe the downloader executable or the checker is vulnerable to buffer overflows or other vulnerabilities.

Tools for patch file download and analysis[edit | edit source]

TV and Video Service Applications[edit | edit source]

See also Media Services and Internet Browser.

As on the PS3, TV/Video_Services can be directly installed to the console, seperately from browsing the PS store.

As a side reference, on PlayStation 3 (WebMAF), the user-agent of TV & Video applications used to be mostly "Mozilla/5.0 (PlayStation 3) AppleWebKit/531.3 (KHTML, like Gecko) SCEE/1.0 Nuanti/2.0 whilst on PS4 it is mostly Mozilla/5.0 (PlayStation 4) AppleWebKit/531.3 (KHTML, like Gecko) SCEE/1.0 Nuanti/2.0.

SnagFilms[edit | edit source]

See Bugs.

VidNow[edit | edit source]

See Bugs.

Commerce related[edit | edit source]

PS Store Content Icons[edit | edit source]

Format:

Example:

Remarks:

  • 00_09_000 represents the version of the Chihiro/Kamaji PS Store.

Unsorted[edit | edit source]

ps4-eb servicelist.xml[edit | edit source]

It is a white/black list for unknown usage.

Content: 

 <?xml version="1.0" encoding="UTF-8"?>
 <servicelist version="1.0" platform="ps4">
   <service name="SNS001" default="allow">
   </service>
   <service name="SNS002" default="allow">
   </service>
   <service name="SNS003" default="allow">
   </service>
   <service name="SNS004" default="allow">
   </service>
   <service name="SNS005" default="deny">
     <allow country="jp"/>
   </service>
   <service name="SYS001" default="allow">
     <deny country="de"/>
   </service>
 </servicelist>

ps4-eb applaunchlink.xml[edit | edit source]

It is a white/black list for unknown usage.

Content: 

 <?xml version="1.0" encoding="UTF-8"?>
 <applaunchlink version="1.0">
   <system_info min_system_ver="01.700.000"/>
   <title_black_list>
   </title_black_list>
 </applaunchlink>

Network connections by the System[edit | edit source]

User-agent Header Host
btest/1.0 libhttp/1.50 (PlayStation 4) POST /networktest/post_128 HTTP/1.1

GET /networktest/get_2m HTTP/1.1

post.net.playstation.net

get.net.playstation.net

Download/1.00 libhttp/1.50 (PlayStation 4)
Download/1.00 libhttp/1.61 (PlayStation 4) 		GET /update/ps4/list/us/ps4-updatelist.xml HTTP/1.1
GET /update/ps4/list/eu/ps4-updatelist.xml HTTP/1.1 		fus01.ps4.update.playstation.net
feu01.ps4.update.playstation.net
SystemLogger/1.0 (PlayStation 4 1.501) libhttp/1.50 (PlayStation 4)
SystemLogger/1.0 (PlayStation 4 1.610) libhttp/1.61 (PlayStation 4) 		GET /update/ps4/list/us/ps4-updatelist.xml HTTP/1.1
GET /update/ps4/list/eu/ps4-updatelist.xml HTTP/1.1 		fus01.ps4.update.playstation.net
feu01.ps4.update.playstation.net
close /update/ps4/image/2014_0528/sys_ce90f2e9274e4614ffde6934e08e4b6e/PS4UPDATE.PUP?dest=eu /update/ps4/image/2014_0528/rec_7f84e2f63d1f6a5b4348bb528b35f2d7/PS4UPDATE.PUP?dest=eu deu01.ps4.update.playstation.net
CONNECT ps4updptl.eu.np.community.playstation.net:443 ps4updptl.eu.np.community.playstation.net
PS4TitleMetadata/1.00 libhttp/1.50 (PlayStation 4) GET /tmdb2/CUSA00080_00_4ED0D1374CB128AC8E277C9A3145505220D6D93A/CUSA00080_00.json HTTP/1.1

GET /tmdb2/CUSA00129_00_44DB6A4F9C773AF95F0D697E14652EABC80BAEFB/CUSA00129_00.json HTTP/1.1
GET /tmdb2/CUSA00001_00_C32A667A087A40C2AD1889435907AA4B0D9DBA1F/CUSA00001_00.json HTTP/1.1

tmdb.np.dl.playstation.net
Mozilla/5.0 (PlayStation 4 1.51) AppleWebKit/536.26 (KHTML, like Gecko) CONNECT themis.dl.playstation.net:443 HTTP/1.1 themis.dl.playstation.net:443
Mozilla/5.0 (PlayStation 4 1.51) AppleWebKit/536.26 (KHTML, like Gecko) CONNECT sf.api.np.km.playstation.net:443 HTTP/1.1 sf.api.np.km.playstation.net:443
CONNECT asm.np.community.playstation.net:443 HTTP/1.1 asm.np.community.playstation.net
Mozilla/5.0 (PlayStation 4 1.51) AppleWebKit/536.26 (KHTML, like Gecko) CONNECT artcdnsecure.ribob01.net:443 HTTP/1.1 artcdnsecure.ribob01.net:443
Mozilla/5.0 (PlayStation 4 1.51) AppleWebKit/536.26 (KHTML, like Gecko) CONNECT api-p014.ribob01.net:443 HTTP/1.1 api-p014.ribob01.net:443
Mozilla/5.0 (PlayStation 4 1.51) AppleWebKit/536.26 (KHTML, like Gecko) CONNECT apicdn-p014.ribob01.net:443 HTTP/1.1 apicdn-p014.ribob01.net:443
CONNECT it-prof.np.community.playstation.net:443 HTTP/1.1 it-prof.np.community.playstation.net
CONNECT ps4updptl.eu.np.community.playstation.net:443 HTTP/1.1 ps4updptl.eu.np.community.playstation.net
CONNECT fswitch.dl.playstation.net:443 fswitch.dl.playstation.net

nonretail:

Port usage[edit | edit source]

ps3 side reference

Generic Port usage[edit | edit source]

Protocol Port(s) Usage Remarks
UDP 1-1023 System reserved local ports
TCP 80 PSN Shop / USB/BT headsets http web
TCP 443 PSN Shop https web ssl
TCP 1935 PSN generic
TCP/UDP 3478 Session Traversal Utilities for NAT / Simple Traversal of UDP Through NAT (STUN)
TCP/UDP 3478-3480 NP matching 2 utility default PSN Generic / PS Home
TCP 4000 groupMessaging Crossplatform Integration
TCP 8540-8579 System reserved local ports
TCP 8550 Deci Daemon
TCP over UDP-P2P 9293-9310 System reserved local ports
UDP-P2P virtual 32768-49999 Ephemeral ports
UDP-P2P virtual 32768-65535 System reserved local ports
TCP 49152-65535 Ephemeral ports
TCP over UDP-P2P 49152-65535 Ephemeral ports
UDP 49152-65535 Ephemeral ports
TCP over UDP-P2P 40000-65535 System reserved local ports

PlayStation 4 Discovery and Wake-up Utility[edit | edit source]

See PlayStation 4 Discovery and Wake-up Utility.

Tools[edit | edit source]

Guides[edit | edit source]



Reverse Engineering
Bootprocess  ·  BootLogo  ·  DataBases  ·  Disc Identification/Serialization Data  ·  Files on the PS4  ·  IOCTL  ·  Libraries  ·  Partitions  ·  Syscalls  ·  Kernel Patches  ·  sealedkey / pfsSKKey  ·  VTRM  ·  Bugs  ·  Vulnerabilities  ·  SBL  ·  Devices  ·  Registry  ·  Build Strings  ·  QA Flagging  ·  Strings  ·  Hardware Info
Dumps & Strings
Dumps
Strings
Communication
USB
Wifi/LAN
Keys, Commands & Digests
Emulation
General
Compatibility Lists
System Modules
Retrieved from "http://www.psdevwiki.com/ps4/index.php?title=Online_Connections&oldid=294720"