Easier & Improved method to bypass version check

[Rex_VF5]

Hi!

On this forum I have read the way to overcome the firmware version check. However the guide is confusing and in my opinion bit overcomplicated for the aimed target. It requires setting up 2 things to work: Ettercap (or some DNS spoofer) and WEB server (this isn't very clear from the guide or is relying on the web server provided by the author).

Also the method is too heavyweight and not very reliable: if (for any reason) your PS3 asks any other file from the firmware hosts the whole thing will fail as you do not have them.

So I decided to simplify and improve it a bit. My approach is using a HTTP proxy to fool PS3 - so the first improvement is that you only need to setup one program. I used Proxomitron that is free but specific for Windows (and no longer developed but suits nicely) - you can get it http://www.proxomitron.info/files/index.html There is an open source alternative Proximodo http://proximodo.sourceforge.net/ that should work cross-platform but I haven't tested it.

So let's get back to the thing. The idea is to run all the communication through Proxomitron (it is HTTP proxy so there should be no problem) unchanged. Only when PS3 asks about available version, we'll forge the answer the way we want. Proxomitron supports this nicely and it can even be done more than 1 way but the easiest one is like this: when someone asks for the version file we'll return the spoofed one residing on our filesystem (i.e. second and third improvement: no need to setup web server and we only spoof this very specific file - all the rests comes unchanged from original servers).

Here's how the rule looks like:

Code: Select all

In = FALSE
Out = TRUE
Key = "URL: PS3 firmware check hack [OUT]"
URL = "*.ps3.update.playstation.net/update/ps3/list/eu/ps3-updatelist.txt$RDIR(http://file//C:/ps3-updatelist.txt)"

See what this means? For any OUTgoing request to *ANY* of the update sites (without the need to list them one by one) for version check file we'll just return the file stored on local filesystem (in my config it's C:\ps3-updatelist.txt). Easy as that. You can get a working content of such file from here for example: http://208.68.92.162/update/ps3/list/eu ... telist.txt

I have tested this and could setup a PSN account with 2.00 firmware and System update says I have the latest version ;-) To make it easier for you I have prepared config file that has everything required enabled (all the other rules are disabled). It is configured to accept connections from any IP address and listens on port 8080. So what you need to do is just:

• Download Proxomitron from here http://www.proxomitron.info/files/download/ProxN45j.zip end extract it somewhere
• Replace the file default.cfg with the one provided below
• Download the ps3-updatelist.txt from here http://208.68.92.162/update/ps3/list/eu ... telist.txt and save it to C:\ (modify the path in .cfg file if you want it elsewhere)
• Run Proxomitron
• Setup PS3 to use host where you run Proxomitron as HTTP proxy, port 8080

Voila!

Here's the default.cfg file contents (I removed all the default rules that we do not need):

Code: Select all

##
## Proxomitron Config File
##

[Global]
Enable = TRUE
FreezeGIF = FALSE
FilterHTML = FALSE
FilterHeadersOut = TRUE
FilterHeadersIn = FALSE
EnableProxy = FALSE
EnableAutoRun = FALSE
ForceTextures = FALSE
NoTextures = TRUE
SysTray = TRUE
Promiscuous = TRUE
UseSSLeay = FALSE
CloseLocal = TRUE
PriorityBoost = TRUE
BypassURL = "$LST(Bypass)"
AccessRange = 0.0.0.0-255.255.255.255
Port = 8080
MaxCapURL = 999

[WinSizes]
Win.00 = 638:377:1042:672
Win.01 = 638:377:1042:672
Win.02 = 395:328:1284:721
Win.03 = 626:503:973:667
Win.04 = 88:108:488:371
Win.05 = 596:363:1083:653
Win.06 = 5:41:473:139
Win.07 = 5:146:473:252

[Blocklists]
List.Bypass = "..\Lists\Bypass List.txt"
List.AdList = "..\Lists\URL Killfile.txt"
List.NoImages = "..\Lists\Kill Images.txt"
List.CookieList = "..\Lists\AllowCookies.txt"
List.AdKeys = "..\Lists\Keyword list.txt"
List.AliasList = "..\Lists\URL Alias List.txt"
List.MIME-List = "..\Lists\MIME Fix List.txt"

[HTTP headers]
In = FALSE
Out = TRUE
Key = "URL: PS3 firmware check hack [OUT]"
URL = "*.ps3.update.playstation.net/update/ps3/list/eu/ps3-updatelist.txt$RDIR(http://file//C:/ps3-updatelist.txt)"


[Patterns]

[Proxies]
 OpenLog = TRUE

[natron]

I'm not sure if this has been raised in any of the other threads that discuss using solutions like this, but I just wanted to point out a potential risk.

If you are allowing interaction with Sony update servers, this trick will only work as long as Sony does not decide to change the way their updates are performed. I do not know how Sony has behaved in the past and if this is at all a risk, but if they so choose, they could force ps3's using this solution to update.

Good work though, this is a more elegant solution, albeit possibly more risky.

[Rex_VF5]

I'm not sure if this has been raised in any of the other threads that discuss using solutions like this, but I just wanted to point out a potential risk.

If you are allowing interaction with Sony update servers, this trick will only work as long as Sony does not decide to change the way their updates are performed. I do not know how Sony has behaved in the past and if this is at all a risk, but if they so choose, they could force ps3's using this solution to update.

Good work though, this is a more elegant solution, albeit possibly more risky.

I do not see why you see it as more risky. They just cannot change it easily without changing the code in your PS3. And that cannot be done without you upgrading the firmware. So I think until you update, you're on the safe side...

Also - for update URLs the requests will never get to Sony - the Proxomitron will intercept and redirect them (transparently) to local file. Only all the rest of the requests go unchanged.

[crossfader_killa]

I made the mods in the DEFAULT.CFG but once it's done, how can I make a connexion between the proxomitron and the PS3?

I can execute the proxomitron icon from the ProxN45J folder but when I m on the GUI are there some other things to modify or the select before launch?

Thanks,

[Rex_VF5]

I made the mods in the DEFAULT.CFG but once it's done, how can I make a connexion between the proxomitron and the PS3?

I can execute the proxomitron icon from the ProxN45J folder but when I m on the GUI are there some other things to modify or the select before launch?

Thanks,

In PS3 you need to setup proxy: Settings->Network Settings->Internet Connection Settings and there in the wizard select Use Proxy=Yes and set the proxy address to be host where you're running Proxomitron, port 8080 unless you changed it in default.cfg. That way all the requests PS3 makes go through that proxy.

[Matrixdub]

Will this allow PS3s <1.60 run applications like Folding@Home or do those applications need the firmware modifications that come with v1.60?

[Rex_VF5]

Will this allow PS3s <1.60 run applications like Folding@Home or do those applications need the firmware modifications that come with v1.60?

Probably not. I have upgraded Folding@Home when I got my PS3. Now even with the hack deployed it refuses to work saying it needs firmware upgrade. I suspect Folding@Home application checks the firmware version locally - i.e. asks system what firmware version it is running.

[natron]

I do not see why you see it as more risky. They just cannot change it easily without changing the code in your PS3. And that cannot be done without you upgrading the firmware.

This is the part that I question. Code loaded from Sony online or any other Sony servers could potentially force an update if Sony chose to implement it. It's possible they've locked themselves out of only producing updates via the known method, but I doubt it given the complexity of these types of systems.

This is a general IT security best practice and not worth debating much. There are too many if's to gauge the real risk of it occuring, but this approach is vulnerable.

You have to treat all code from Sony as untrusted. You are attempting to blacklist the 1 type of code that you've identified as bad, but are allowing all else to run in the assumption that it is all good. I question the assumption that Sony cannot slip "bad" code (something that forces an update) via "good" code (Sony online or something).

[Rex_VF5]

Now I see what you mean - something like M$ is doing - updating without your consent ;-) Well it is possible. However if it is so the original method is "unsecure" to almost the same extent. It only hijacks and redirects servers that are so far known only to provide updated firmware. All the rest goes unchanged. So if this method is not more secure it is at least more elegant ;-)

[Akta77]

I have also done a little guide in the PS3RSX Binary support thread using Linux with squid & Apache (note that i'am pretty sure we can just use squid with the right rule but no time to RTFM :) )

Regards

[fuktop13]

Will this allow PS3s <1.60 run applications like Folding@Home or do those applications need the firmware modifications that come with v1.60?

Probably not. I have upgraded Folding@Home when I got my PS3. Now even with the hack deployed it refuses to work saying it needs firmware upgrade. I suspect Folding@Home application checks the firmware version locally - i.e. asks system what firmware version it is running.

I don t think it check the version locally ,coz i just remplace the "http://deu01.ps3.download.playstation.n ... dtinfo.cui" per a blank file name "updtinfo.cui " on my pc and folding run without ask for update.
The problem : i can t connect to the folding server "www.k2.cbe-world.com:443" .


Folding log connexion :

Code: Select all

[29/12/2007 16:36:48] www.k2.cbe-world.com:443
[29/12/2007 16:36:47] www.k2.cbe-world.com:443
[29/12/2007 16:36:45] www.k2.cbe-world.com:443
[29/12/2007 16:36:45] www.k2.cbe-world.com:443
[29/12/2007 16:36:43] www.k2.cbe-world.com:443
[29/12/2007 16:36:32] http://deu01.ps3.download.playstation.net/download/ps3/eu/fah/updtinfo.cui -> C:\Users\Administrateur\Desktop\updtinfo.cui
[29/12/2007 16:36:29] a0.ww.np.dl.playstation.net:443
[29/12/2007 16:34:40] http://feu01.ps3.update.playstation.net/update/ps3/list/eu/ps3-updatelist.txt -> C:\Users\Administrateur\Desktop\ps3-updatelist.txt

[Ps3Rips]

Thanks for a nice guide.

Just a bit of advice for security.

In your new config file you should change

Code: Select all

AccessRange = 0.0.0.0-255.255.255.255 

to read

Code: Select all

AccessRange = 192.168.1.1-192.168.1.255

This way anyone who is scanning for Open Proxies won't find your machine.

Using the original setting could open up your machine to all kinds of stuff. Unless you have a decent firewall.

This is a quote from the Proxomitron manual.

The "Access" Tab

This allows you to allow PCs other than your own to access Proxomitron. Just specify a starting and ending IP address rage to allow in.

BEWARE This is dangerous! Allow access only if you have a good reason too (and preferably a good firewall to boot). In most cases it's better to just run multiple copies of Proxomitron on each PC.

If you do, you may want to disable URL commands so remote users can't cause trouble. Keep in mind URL commands you can load files remotely or change the current config - make sure they're only available to PCs you control. At the very least be sure to create a custom Prefix to use before all URL commands. This can act as a simple password since no URL command will work unless it's preceded with the prefix you choose.

http://www.proxomitron.info/45/help/CfgT3.html

[moreno]

by doing this..

is it possible to play some games online? like UT3?

[Rex_VF5]

I don t think it check the version locally ,coz i just remplace the "http://deu01.ps3.download.playstation.n ... dtinfo.cui" per a blank file name "updtinfo.cui " on my pc and folding run without ask for update.

Very nice indeed!!! I will check that.

The problem : i can t connect to the folding server "www.k2.cbe-world.com:443" .


Folding log connexion :

Code: Select all

[29/12/2007 16:36:48] www.k2.cbe-world.com:443
[29/12/2007 16:36:47] www.k2.cbe-world.com:443
[29/12/2007 16:36:45] www.k2.cbe-world.com:443
[29/12/2007 16:36:45] www.k2.cbe-world.com:443
[29/12/2007 16:36:43] www.k2.cbe-world.com:443
[29/12/2007 16:36:32] http://deu01.ps3.download.playstation.net/download/ps3/eu/fah/updtinfo.cui -> C:\Users\Administrateur\Desktop\updtinfo.cui
[29/12/2007 16:36:29] a0.ww.np.dl.playstation.net:443
[29/12/2007 16:34:40] http://feu01.ps3.update.playstation.net/update/ps3/list/eu/ps3-updatelist.txt -> C:\Users\Administrateur\Desktop\ps3-updatelist.txt

I think I know what the problem is: port 443 is HTTPS port usually. Proxomitron does not support this - better said it supports this when you do some stuff "SSLeay" I think. I will investigate this more.

[Rex_VF5]

by doing this..

is it possible to play some games online? like UT3?

I don't know. I have setup my PSN account with a country, where PSN shop is not available so I don't know what lies behind the door ;-) I'll have to create another account to check that. This hack only fools update procedure inside PS3 to think it has got the latest firmware...

[Rex_VF5]

Just a bit of advice for security.

In your new config file you should change

Code: Select all

AccessRange = 0.0.0.0-255.255.255.255 

to read

Code: Select all

AccessRange = 192.168.1.1-192.168.1.255

This way anyone who is scanning for Open Proxies won't find your machine.

Using the original setting could open up your machine to all kinds of stuff. Unless you have a decent firewall.

This is a quote from the Proxomitron manual.

The "Access" Tab

This allows you to allow PCs other than your own to access Proxomitron. Just specify a starting and ending IP address rage to allow in.

BEWARE This is dangerous! Allow access only if you have a good reason too (and preferably a good firewall to boot). In most cases it's better to just run multiple copies of Proxomitron on each PC.

If you do, you may want to disable URL commands so remote users can't cause trouble. Keep in mind URL commands you can load files remotely or change the current config - make sure they're only available to PCs you control. At the very least be sure to create a custom Prefix to use before all URL commands. This can act as a simple password since no URL command will work unless it's preceded with the prefix you choose.

http://www.proxomitron.info/45/help/CfgT3.html

You're right about security - this is potentially dangerous. However you're completely wrong about what should be there. Your suggested range

Code: Select all

AccessRange = 192.168.1.1-192.168.1.255

is mostly doomed to be non-working unless that is the IP range being used on specific man's network. It is the privat erange being used quite widely but it for sure won't work for everyone (in my opinion will fail with most).

[Rex_VF5]

I don t think it check the version locally ,coz i just remplace the "http://deu01.ps3.download.playstation.n ... dtinfo.cui" per a blank file name "updtinfo.cui " on my pc and folding run without ask for update.

Very nice indeed!!! I will check that.

Not working here. It doesn't even go to the Internet. The think is that before I updated firmware to 2.00 (and later 2.01) I let the F@H update to whatever it wanted to. I think that binary contains check for latest firmware that is executed locally.