PS3 [Research] Quick Preview - Loading Whats New locally from /PS3/WSCREEN/

LuanTeles said:
@DeViL303

I'm trying to test if i can make a custom Recently Played server with Homebrews but, i'm not understanding what to replace

This entry does not contains any data inside of it, it will only show a blank xml ( if the xml exists, otherwise error 404)

https://nsx.sec.%s.dl.playstation.n...Yr/p/NSXWSV/NSXWSV-%s_00-WHATSNEW00000001.xml

the seconds %s is GAME ID


And this one is supposed to have the xmls

http://tmdb.%s.dl.playstation.net/tmdb/%s_%s/%s.xml , but i can't figure out what is the last variable
Click to expand...
I don't know.

For that last one you could try capture the full URL/traffic with a proxy as it's not https.
 
Last edited:
LuanTeles said:
@DeViL303

I'm trying to test if i can make a custom Recently Played server with Homebrews but, i'm not understanding what to replace

This entry does not contains any data inside of it, it will only show a blank xml ( if the xml exists, otherwise error 404)

https://nsx.sec.%s.dl.playstation.n...Yr/p/NSXWSV/NSXWSV-%s_00-WHATSNEW00000001.xml

the seconds %s is GAME ID
Click to expand...

Not sure I understand this question, That one the second %s is the country code. They are not blank if the country supports whats new.

Example
https://nsx.sec.np.dl.playstation.n...c/NSXWSV/NSXWSV-PN.P3.US-WHATSNEW00000001.xml
 
I am kind of interested in this URL

http://xmb-e.dl.playstation.net/xmb/l?env=%s&serv=%s&cc=%s

The reason I am interested in this is that the server is "xmb" and "dl" and it has these interesting entries in the sprx which probably refer to variables in the xml it downloads, afaik we have no examples of this xml and I do not know how to get the ps3 to access this URL.


upload_2021-4-17_6-8-29.png



This might be something that was never enabled. It would be interesting if we could somehow force the ps3 to use this URL and find out the full URL via proxy, I would like to see the xml.

If anyone wants to take a look in IDA it might be worth a look. We need to know what serv=%s & cc=%s are meant to be.


EDIT: weirdly if we add "np" into the URL for the environment it does download a 0kb empty file.

http://xmb-e.dl.playstation.net/xmb/l?env=np&serv=%s&cc=%s
 
Last edited:
DeViL303 said:
I am kind of interested in this URL

http://xmb-e.dl.playstation.net/xmb/l?env=%s&serv=%s&cc=%s

The reason I am interested in this is that the server is "xmb" and "dl" and it has these interesting entries in the sprx which probably refer to variables in the xml it downloads, afaik we have no examples of this xml and I do not know how to get the ps3 to access this URL.


View attachment 32991


This might be something that was never enabled. It would be interesting if we could somehow force the ps3 to use this URL and find out the full URL via proxy, I would like to see the xml.

If anyone wants to take a look in IDA it might be worth a look. We need to know what serv=%s & cc=%s are meant to be.


EDIT: weirdly if we add "np" into the URL for the environment it does download a 0kb empty file.

http://xmb-e.dl.playstation.net/xmb/l?env=np&serv=%s&cc=%s
Click to expand...


I was looking at it too, but i couldn't find anything about it and it does not have a file extension ( so i gave up) , only thing i got is from

https://www.psx-place.com/threads/help-blocking-some-sony-servers-without-access-to-router.9302/

It looks like the PS3 is actively connecting to it, but I think it is related to the old PS Store? due to having categories.

Later i will try to find how the old store worked and try to use it.
 
Last edited:
aldostools said:
In https://www.psdevwiki.com/ps3/Keys#TMDB_Key says this:


The first %s is np, the second and fourth %s are the same string (title_id + _00). The third %s is the tmdb key.
Click to expand...

I wonder why it needs the TMDB key, it would be much easier to just search for the environment and GAMEID.xml

Luckly @xps3riments last dump, has the keys , so just a server change will work, but we can also make it with only 2 %s

http://servername.com/ps3/tmdb/%s/tmdb/%s.xml so only the enviroment and ID.xml will be needed

So it will not need to calculate a TMDB key for Homebrews.
 
LuanTeles said:
I wonder why it needs the TMDB key, it would be much easier to just search for the environment and GAMEID.xml
Click to expand...

Keys (like MD5, SHA1, HMAC, etc.) in the URLs are used to prevent unauthorized access to other content in the same repository.
If the key is not included, it would be easy to access any XML just providing the game id.

The key acts like a password for static content that don't use a web service that performs a session authentication.
 
Last edited:
Quick note, if someone wanted to enable What's New without connecting to PSN, for example if they are not on the latest FW version or the server was down. All they need to do is use xregistry.sys editor to fill in these 3 fields.

upload_2021-4-30_0-49-54.png


So if you wanted you can factory reset the console, fill in those 3 fields like in the example above and Whats New works like normal. Might be handy for people modding the item or if the server that handles this goes down.
 
Last edited:
Something strange happened here, i made some items to show on specific dates and it used to work fine.

But yesterday it was supposed to show a special for Mother's Day, so I checked and found no problem, so I changed the time and date of the console to an earlier date that triggered a special item in the past, but no success o_O .

I'm spending a lot of time trying to figure out what can happened, and this is my current test xml

<nsx ver="1.0" rev="1305" lt-id="131" anno="" min-sys-ver="">
<spc id="33537" rep="t" multi="o" anno="csxad=0">

<mtrl id="0" from="2021-05-10T00:00:00.000Z" lastm="2021-05-10T23:59:59.000Z" until="2021-05-11T00:00:00.000Z" anno="emergency=1">
<desc>Happy Mother's Day
For all the bravest women of our lives.</desc>
<url type="2">http://dl.dropboxusercontent.com/s/bj47gsiholmcyp6/mother's_day.jpg</url>
<url type="73">http://dl.dropboxusercontent.com/s/u710k617onb57fl/mother's_day.swf</url>
<cntry agelmt="0">all</cntry>
<lang>all</lang>

</mtrl>
</spc>
</nsx>
Click to expand...

The system says "This service is not available on your contry/region" so it means that the system is not reading the "From" date right, but it is completely right ( As fair as i know)


EDIT: DEBUG SETTINGS , debug ad clock was set to on
 
Last edited:
DeViL303 said:
Wow, Nice one, I had just figured out it is looking for swf, SWF, XML and xml when i changed the path to hdd I started getting some extra debug output.

View attachment 20352

That is working, message brings a title on XMB. Also now with the xml working that also allows the swf to work if it exists, this is very cool.

I have just tried picks, urgent and new like this and they work too.

Code: 
<picks>1</picks>
<urgent>0</urgent>
<new>1</new>

An item can only be either new or urgent as the symbol shows in the same place.

View attachment 20354


Only issue I have now is that those psns type links do not work on Rebug for some reason. They just show a no entry symbol, always have. Hopefully I can unlock http/psvp/psgm type links too somehow.
Click to expand...


@DeViL303 when you changed the path to hdd, were your images loaded? here only the xml is working from the hdd.

even recent played games images are not showing

this works

/dev_usb%03u/widgets

but

/dev_hdd0/widgets and /dev_hdd%01u, the images and swf not work
 
Last edited:
@DeViL303
If we were able to modify XML files & add custom files on /dev_hdd0 or any other ps3 partition on OFW, could the "what's new" feature for instance be made to work & load a local custom swf? If not, do you know any feature that could be made to load a local swf on OFW through XML customisation?
 
bguerville said:
@DeViL303
If we were able to modify XML files & add custom files on /dev_hdd0 or any other ps3 partition on OFW, could the "what's new" feature for instance be made to work & load a local custom swf? If not, do you know any feature that could be made to load a local swf on OFW through XML customisation?
Click to expand...
Local, not that I know of. The only way I know of to load local SWF is via the Quick Preview option. This requires the DEX explore_plugin.sprx.

I guess that comes under "& add custom files on /dev_hdd0 or any other ps3 partition" , so it is possible in a way.
 
DeViL303 said:
Local, not that I know of. The only way I know of to load local SWF is via the Quick Preview option. This requires the DEX explore_plugin.sprx.

I guess that comes under "& add custom files on /dev_hdd0 or any other ps3 partition" , so it is possible in a way.
Click to expand...
You mean if we replaced explore_plugin.sprx in /dev_flash with say the 4.84 DEX version on OFW 4.88, we could do it? OFW wouldn't complain?

Because if that is possible then we basically have an in to make all our exploits offline on OFW including those that current offline techniques cannot handle...
 
bguerville said:
You mean if we replaced explore_plugin.sprx in /dev_flash with say the 4.84 DEX version on OFW 4.88, we could do it? OFW wouldn't complain?

Because if that is possible then we basically have an in to make all our exploits offline on OFW including those that current offline techniques cannot handle...
Click to expand...
Yes, afaik it would be possible. The only issue I can see is the SWF would need to be loaded from USB as we couldn't modify the path in the sprx on OFW.

I have only tried normal SWFs like clocks and stuff, not sure if that would make a difference, afaik its a different plugin loading the SWF so that might need some investigation.

Slightly off topic, but I wish I could remember fully how I did this hack. I have tried to do it again since but had no luck. it was achieved with a category xml edit and a nsx (whats new) xml edit. No local SWF possible with this method, online only. No dex sprx required for this method.


With the hack shown in the above video we might be able to have a boot time hack like an auto HEN enabler, I remember it was possible to have the XMB boot up directly onto a SWF via an XML edit. BUT there was an issue, the SWF would only work when loaded from the internet, and it would not be initiated until I moved off the item and back onto it. With the right SWF there might be a workaround for that last issue, idk.
 
DeViL303 said:
Yes, afaik it would be possible. The only issue I can see is the SWF would need to be loaded from USB as we couldn't modify the path in the sprx on OFW.

I have only tried normal SWFs like clocks and stuff, not sure if that would make a difference, afaik its a different plugin loading the SWF so that might need some investigation.

Slightly off topic, but I wish I could remember fully how I did this hack. I have tried to do it again since but had no luck. it was achieved with a category xml edit and a nsx (whats new) xml edit. No local SWF possible with this method, online only. No dex sprx required for this method.


With the hack shown in the above video we might be able to have a boot time hack like an auto HEN enabler, I remember it was possible to have the XMB boot up directly onto a SWF via an XML edit. BUT there was an issue, the SWF would only work when loaded from the internet, and it would not be initiated until I moved off the item and back onto it. With the right SWF there might be a workaround for that last issue, idk.
Click to expand...


I tried to replicate it several times during this week again, and I failed
 
DeViL303 said:
Yes, afaik it would be possible. The only issue I can see is the SWF would need to be loaded from USB as we couldn't modify the path in the sprx on OFW.

I have only tried normal SWFs like clocks and stuff, not sure if that would make a difference, afaik its a different plugin loading the SWF so that might need some investigation.

Slightly off topic, but I wish I could remember fully how I did this hack. I have tried to do it again since but had no luck. it was achieved with a category xml edit and a nsx (whats new) xml edit. No local SWF possible with this method, online only.


With the hack shown in the above video we might be able to have a boot time hack like an auto HEN enabler, I remember it was possible to have the XMB boot up directly onto a SWF via an XML edit. BUT there was an issue, the SWF would only work when loaded from the internet, and it would not be initiated until I moved off the item and back onto it. With the right SWF there might be a workaround for that idk.
Click to expand...

That's the thing, by default both Flash player & the web browser have local files capabilities disabled BUT we know from the sdk that the Web browser utility support files offer an API call to set browser options before starting the browser & in those options you can enable local files support.
Maybe we should spy on that API call to see how those options are used & whether it may be possible to recreate the same conditions without the API call.

I am not 100% sure how it works for the Flash player, the sdk documentation for Flash is succinct, but I think the Flash player may also have some options to enable local file support, unless it's only enabled in DEX? I haven't really checked if there were differences between cex & dex flash player..
I suppose the quick preview feature could have provided some answers to that question if it manages to load local swf files.
 
I really do not know enough to help more here. I can set up to xmls for loading specific SWFs from USB or from a web server if required. You probably know but iirc its the faust_widget.sprx that loads these SWFs via whats new, TBH I don't know if that is normal or different compared to loading them via the web browser(?). A couple of years ago before BG Toolset was released I did mention the possibility of loading your flash based exploits from What's New to @esc0rtd3w in passing, he said something about it being possible alright but I think he said they would need to be ported or written differently. I might have that bit wrong.

As for loading local files via SWF, I can't help there. I remember @xp3riments looked into online SWFs for a while, like audio players, internet radio etc, he might be able to help more, not sure.
 
DeViL303 said:
I really do not know enough to help more here. I can set up to xmls for loading specific SWFs from USB or from a web server if required. You probably know but iirc its the faust_widget.sprx that loads these SWFs via whats new, TBH I don't know if that is normal or different compared to loading them via the web browser(?). A couple of years ago before BG Toolset was released I did mention the possibility of loading your flash based exploits from What's New to @esc0rtd3w in passing, he said something about it being possible alright but I think he said they would need to be ported or written differently. I might have that bit wrong.

As for loading local files via SWF, I can't help there. I remember @xp3riments looked into online SWFs for a while, like audio players, internet radio etc, he might be able to help more, not sure.
Click to expand...
I will have a look at the faust_widget.sprx when I can.

@esc0rtd3w was probably correct, the PS3 Toolset is 80% html/js based & 20% actionscript based so to load it from the Flash player alone without using the browser at all is not possible & it's likely that faust_widget.sprx doesn't use the browser to render the swfs & if ever it does, which one does it use? Silk or webkit? To be confirmed of course..

What one might be able to do though is use what's new to get ROP capabilities & from there maybe try to launch the browser with local file support enabled or at worst rewrite the PS3 Toolset entirely in Actionscript.. Obviously the former would be simpler.. Lol But the latter could be a nice experience too at the end of the day, it's just a lot of work..
And if ever the feature used silk to render the swf, the PS3 Toolset could maybe be adapted to work on silk..
And beyond that, the PS3 Toolset is only one project among many possible projects, we could also work on something separate without GUI, as long as the hack is found to be 100% reliable.
In any case I think this possible way in with what's new should not be dismissed..
 
bguerville said:
@DeViL303
If we were able to modify XML files & add custom files on /dev_hdd0 or any other ps3 partition on OFW, could the "what's new" feature for instance be made to work & load a local custom swf? If not, do you know any feature that could be made to load a local swf on OFW through XML customisation?
Click to expand...

I don't think the SWF can be loaded from a local file, unless you embed it as an object encoded base64 data into the URL link that build a page using javascript. @lmn7 uses that method to load an offline ps3xploit enabler from XMB. If I recall correctly that XML link has a size limitation of about 16kb.

In the case of LINK.XML the maximum URL size is about 2kb.

According to pswiki the PS3_EXTRA can load ICON3.SWF but it would require a PS3 game mounted.
https://psdevwiki.com/ps3/Content_Information_Files#PS3_EXTRA
 
You must log in or register to reply here.

Similar threads

Back
Top