PlayStation 3

From HashNet Wiki
Jump to: navigation, search

The PlayStation 3 is a video game console created by Sony. This PlayStation console proceeded to use the Medius Networking Protocol for their first party studios to integrate into their games.


Medius

Medius (SCE-RT) continued to get updated past the PS2 era, although its usage was more limited to certain studios, it didn't stop it from evolving. As such, a new subserver was introduced (MAPS), larger RSA Key sizes were used, MUIS had newer packet IDs, and a underlying plugins system was created for Zipper Interactive's branch of Medius.

Medius Games

Medius App IDs

Medius App IDs are what each game uses to identify each other from what game it is for. Here is a list of known PS3 Medius App IDs:

Name AppID Region Version/Notes Medius Entry Point DNS/IP Medius Client Library Version
Warhawk (Retail Digital) 20044 NTSC v1.5 MUIS warhawk.ps3.online.scea.com v5155 - 3.02.200704101920
NBA 07 20244 NTSC v1.0 MUIS nba07.ps3.online.scea.com
Resistance: Fall of Man (Retail Disc) 20174 NTSC MUIS resistance.ps3.online.scea.com
F1 Championship Edition 20954 NTSC 1.0/1.10 MUIS f12006.ps3.online.scea.com 3.01.0001
Resistance 2: Public Beta (Retail Digital) 21743 PAL MUIS resistance2-pubeta.ps3.online.scea.com
MAG (Dev3) 20230 NTSC MAPS Modifiable
MAG Trial (Retail Digital) 20231 NTSC MAPS mag.ps3.online.scea.com
MAG Public Beta 22720 NTSC v1.3 MAPS mag.pubeta.ps3.online.scea.com
PlayStation Home (Dev) 20371 NTSC Dev 1.1.0

Eboot 1.83

MUIS sp-int

MUIS np

hubps3.online.scee.com

homeps3.online.scee.com

1.83 - 3.02.0000.200810102000

Calling All Cars (Retail Digital) 20623

20624

NTSC 1.0 MUIS* callingallcars.ps3.online.scea.com
Socom: Confrontation 21094 NTSC
PAIN 21914 NTSC Tries to retrieve eupdateManifestNPUA_2_0.bin, but doesn't exist.

As such no Online mode is available.

UI Update Server

Medius Update Server

download-prod.online.scea.com

pain.ps3.online.scea.com

Motorstorm SCEI - 21000

SCEE - 20364

SCEK - 21044

SCEA - 20764

NTSC MUIS motorstormps3.online.scee.com
Motorstorm Apocalypse 22500 NTSC 1.06 SVO

MUIS

motorstorm3ps3.ws.online.scee.com

motorstorm3ps3.online.scee.com

Starhawk (Dev) 22920 NTSC v0.00.360.0 (69268) Lan Release - Telemetry runs on port 10030 SVO

MUIS

Trending URL

Alternate MUIS Domains


QA

Press

Telemetry

blob117.scea.com (Hardcoded) starhawk.ps3.online.scea.com

blob025.scea.com

blob126.scea.com

blob127.scea.com

blob141.scea.com

bourbon-qa.ps3.online.scea.com

bourbon-press.ps3.online.scea.com

starhawk.telemetry.ps3.online.scea.com

Dev - 3.05.201109161400
Starhawk: Online Beta (Retail) 22930 NTSC/PAL BCET70036, version: v0.03.360.0 (85852) SVO

MUIS

starhawk.announce.online.scea.com

starhawk.ps3.online.scea.com

Killzone 3: Multiplayer Trial (Retail Digital) 23044 NTSC v1.01 MUIS killzone3ps3.online.scee.com
Killzone 3 (Retail Disc) 23044 NTSC MUIS killzone3ps3.online.scee.com
Killzone 2 21784 MUIS killzoneps3.online.scee.com
Wipeout HD (Retail) 23360 NTSC v2.51 MUIS

SVO

wipeout2048.muis.online.scee.com

wipeout2048.online.scee.com

Socom 4 (Dev1) 23430 NTSC Port is 10571 for this test server. MAPS blob022.scea.com
Socom 4 (Dev2) NTSC Possibly hardcoded IP, this build only is aimed for Singleplayer,

so it is likely the Online portion was cut out for this specific dev build. 

Even though entry port is 10060 implying SVO, it isn't SVO.

SOCOM 4 Version ABdev479248_RELEASE: compiled on Jan 11 2011 at 05:21:56

MAPS CHANGE_ME

Hardcoded Temp IP

Socom 4 (Dev3) 23430 NTSC Starts on port 10371.

SOCOM 4 Version ABprod484696_RELEASE: compiled on Jan 25 2011 at 04:47:12

MAPS blob027.scea.com
Socom 4 (Retail Disc) 23430 NTSC SOCOM 4 Version ABprod493473_TRUEGOLD : compiled on Feb 20 2011 at 16:21:07 MAPS socom4.ps3.online.scea.com
SOCOM 4 U.S. Navy SEALs Multiplayer Beta (Retail) 23433 NTSC 1.02 MAPS s4demo.ps3.online.scea.com
Buzz: Quiz Player (Retail Digital) 23624 NTSC V1.0 - Built On: Dec 8 2009 @ 15:28:19 Target Release - Unity 3 MUIS

SVO

buzzps3.online.scee.com

buzzps3.svo.online.scee.com

Buzz: Quiz World (Retail Digital) NTSC V1.0 - Built On: Aug 5 2009 @ 18:42:10 Target Release - Unity 3 MUIS/SVO buzzps3.online.scee.com 3.03.200908051600
Twisted Metal Demo (Retail) 24094 NTSC 1.00 MUIS twistedmetalxdemo.ps3.online.scea.com
Ratchet: Deadlocked HD (Retail) 24180 NTSC 1.00 MAS ratchetdeadlocked.ps3.online.scea.com
Ratchet & Clank: Up Your Arsenal HD (Retail) NTSC 1.00 MAS ratchetps3.ps3.online.scea.com
Hot Shots Golf: Out of Bounds! (Retail) NTSC 1.00 MUIS 3.02.0000
White Knight Chronicles (Retail) NTSC 1.00 - Contacts HTTP port 10095, Medius unrelated but uses Medius interally. shirokishius.ps3.online.scea.com

Medius Components

Medius servers are split into 9 major components with MAPS being Zipper Interactive Only:

Medius Authentication Server (MAS)

First server the client generally hits.

Allows users to login, authenticate and obtain a session token to login to the Medius Lobby Server. This server generally runs on port 10075.

Medius Universe Manager (MUM)

Keeps track of lobby rooms, game information, and players. This server generally runs on port 10076.

Medius Lobby Server (MLS)

Handles license agreement, announcements, global chat room, clans, create games, and join games. This server generally runs on port 10077 or sometimes 10078.

Medius Proxy Server (MPS)

Global chat room, clans, create games, and join games. This server generally runs on port 10078.

Distributed Memory Engine Game Server (DME)

The DME Game Server is a "Reliable UDP" server that handles connections between clients on a game's current status. Traditionally, the DME server runs on port 10073.

Medius Network Address Translation (NAT)

A UDP server used to give the client their IP Address.

Medius Universe Information Server (MUIS)

Server for providing the client with multiple other Medius stacks (MAS/MLS/MPS/DME). This server generally runs on port 10071.

SCE-RT View Online (SVO)

Formerly known as: "Sports View Online", this server ran to send/receive stats of players to web sources, announcements served to the client, or for customary assets by game developers.
Generally runs on port 10060 over HTTP, and port 10061 over HTTPS.

Medius Profile Server (MAPS*)

Customized Medius Branch Server acts as a "hybrid" between a MUIS*. Handles sending/receiving character list, and News/Eula to the client.
After successful handshake, asks for plugins.
Runs on TCP port 10073, and UDP port 10072 OR 10074. 

Zipper Interactive games only.

Medius Additional Components

Medius File System

Used to handle incoming/outgoing files between servers.

Medius Plugins

Customized Medius Branch Used to extend the functionality of servers (DME, MAPS, MAS, MLS. MPS, MUM), allowing for more flexibility to tweak the game further than vanilla Medius titles. 

Zipper Interactive games only.

Medius Protocol

This will be a detailed breakdown of each start of the server communication, and what each type is in each table, and for. Medius Messages will be broken down by each Request/Receive callback.

Medius Packet IDs

Generalized section for each underlying enum, char, int, uint types in Packet ID tables.

RT MSG Packet IDs

The RT Message Packet ID type is the first byte in each packet that define what type of packet this is. If it's encrypted it will have 0x80 added to the original Packet ID.

ID Name Description
0x00 RT_MSG_CLIENT_CONNECT_TCP Normal client connect request, contains Medius version and Game ID.
0x01 RT_MSG_CLIENT_DISCONNECT Normal client disconnect.
0x02 RT_MSG_CLIENT_APP_BROADCAST
0x03 RT_MSG_CLIENT_APP_SINGLE
0x04 RT_MSG_CLIENT_APP_LIST
0x05 RT_MSG_CLIENT_ECHO Heartbeat - 15000 ms/15 Seconds long.
0x06 RT_MSG_SERVER_CONNECT_REJECT Can send a Reject response (Instead of SERVER_CONNECT_ACCEPT_TCP) with a Reason converted to a Reject Reason ID in the Client
0x07 RT_MSG_SERVER_CONNECT_ACCEPT_TCP Login Client IP Address: The server sends the client their ip address. This might be used for NAT hole-punching down the line.
0x08 RT_MSG_SERVER_CONNECT_NOTIFY
0x09 RT_MSG_SERVER_DISCONNECT_NOTIFY
0x0a RT_MSG_SERVER_APP Generic data message to client from server.
0x0b RT_MSG_CLIENT_APP_TOSERVER Generic data message to server from client.
0x0c RT_MSG_UDP_APP
0x0d RT_MSG_CLIENT_SET_RECV_FLAG
0x0e RT_MSG_CLIENT_SET_AGG_TIME
0x0f RT_MSG_CLIENT_FLUSH_ALL
0x10 RT_MSG_CLIENT_FLUSH_SINGLE
0x11 RT_MSG_SERVER_FORCED_DISCONNECT
0x12 RT_MSG_CLIENT_CRYPTKEY_PUBLIC The client is requesting to start encryption. The contents is an RSA key generated by the PS2, which is encrypted using public-key of the server (512-bit Textbook RSA). The public-key is burned in the games iso.
0x13 RT_MSG_SERVER_CRYPTKEY_PEER The server is accepting encryption. The contents is a custom RC4 or RCQ "session key" used to encrypt/decrypt messages going forward, this message is encrypted via the RSA key in the client.
0x14 RT_MSG_SERVER_CRYPTKEY_GAME Game encryption key.
0x15 RT_MSG_CLIENT_CONNECT_TCP_AUX_UDP
0x16 RT_MSG_CLIENT_CONNECT_AUX_UDP
0x17 RT_MSG_CLIENT_CONNECT_READY_AUX_UDP
0x18 RT_MSG_SERVER_INFO_AUX_UDP
0x19 RT_MSG_SERVER_CONNECT_ACCEPT_AUX_UDP
0x1a RT_MSG_SERVER_CONNECT_COMPLETE Connection established with the client.
0x1b RT_MSG_CLIENT_CRYPTKEY_PEER
0x1c RT_MSG_SERVER_SYSTEM_MESSAGE
0x1d RT_MSG_SERVER_CHEAT_QUERY
0x1e RT_MSG_SERVER_MEMORY_POKE
0x1f RT_MSG_SERVER_ECHO Send back for the CLIENT_ECHO - Heartbeat: 15000 ms/15 seconds long.
0x20 RT_MSG_CLIENT_DISCONNECT_WITH_REASON Client disconnects with a Disconnect Reason ID.
0x21 RT_MSG_CLIENT_CONNECT_READY_TCP
0x22 RT_MSG_SERVER_CONNECT_REQUIRE
0x23 RT_MSG_CLIENT_CONNECT_READY_REQUIRE
0x24 RT_MSG_CLIENT_HELLO
0x25 RT_MSG_SERVER_HELLO
0x26 RT_MSG_SERVER_STARTUP_INFO_NOTIFY
0x27 RT_MSG_CLIENT_PEER_QUERY
0x28 RT_MSG_SERVER_PEER_QUERY_NOTIFY
0x29 RT_MSG_CLIENT_PEER_QUERY_LIST
0x2a RT_MSG_SERVER_PEER_QUERY_LIST_NOTIFY
0x2b RT_MSG_CLIENT_WALLCLOCK_QUERY
0x2c RT_MSG_CLIENT_WALLCLOCK_QUERY_NOTIFY
0x2d RT_MSG_CLIENT_TIMEBASE_QUERY
0x2e RT_MSG_SERVER_TIMEBASE_QUERY_NOTIFY
0x2f RT_MSG_CLIENT_TOKEN_MESSAGE
0x30 RT_MSG_SERVER_TOKEN_MESSAGE
0x31 RT_MSG_CLIENT_SYSTEM_MESSAGE
0x32 RT_MSG_CLIENT_APP_BROADCAST_QOS
0x33 RT_MSG_CLIENT_APP_SINGLE_QOS
0x34 RT_MSG_CLIENT_APP_LIST_QOS
0x35 RT_MSG_CLIENT_MAX_MSGLEN
0x36 RT_MSG_SERVER_MAX_MSGLEN
0x3b RT_MSG_CLIENT_MULTI_APP_TO_SERVER Used to send multiple 0x0a App_To_Server and/or 0x05 client echos.
0x3d RT_MSG_CLIENT_APP_TO_PLUGIN Zipper Interactive Games Only
0x3e RT_MSG_SERVER_PLUGIN_TO_APP Zipper Interactive Games Only
Reject Reason IDs

RT Message sent from server with RT Packet ID 0x06 can send these possible reasons to the client.

ID Name Description
0x00 RT_MSG_CLIENT_REJECT_NONE Default for Invalid Reason or SERVER_CONNECT_ACCEPT_TCP.
0x02 RT_MSG_CLIENT_REJECT_CLIENT_VER
0x04 RT_MSG_CLIENT_REJECT_FULL
0x05 RT_MSG_CLIENT_REJECT_WORLD_ID
0x06 RT_MSG_CLIENT_REJECT_APP_SIGNATURE
0x07 RT_MSG_CLIENT_REJECT_ENCRYPTION
0x08 RT_MSG_CLIENT_ACCESS_KEY
0x09 RT_MSG_CLIENT_REJECT_AUX_UDP_FAILURE
Disconnect Reason IDs

Messages sent with RT Packet ID 0x20 include a Disconnect with Reason, these are those possible reasons.

ID Name Description
0x00 RT_MSG_CLIENT_DISCONNECT_NONE
0x01 RT_MSG_CLIENT_DISCONNECT_NORMAL Default Disconnect Reason in most cases.
0x02 RT_MSG_CLIENT_DISCONNECT_CONNECT_FAIL
0x03 RT_MSG_CLIENT_DISCONNECT_STREAMMEDIA_FAIL
0x04 RT_MSG_CLIENT_DISCONNECT_UPDATE_FAIL
0x05 RT_MSG_CLIENT_DISCONNECT_INACTIVITY
0x06 RT_MSG_CLIENT_DISCONNECT_SHUTDOWN Can occur when there is no response sent by the server in multiple connect attempts.
0x07 RT_MSG_CLIENT_DISCONNECT_LENGTH_MISMATCH Can occur if the Server response doesn't match what is expected.
0x08 MAX_RT_MSG_CLIENT_DISCONNECT_REASON


RT Result IDs

RT_Results are their own labelled enum, sent generally, this table is hardcoded in the client itself but not easily mapped.

ID Name Description
0xcf27 - 53031 RT_SOCKET_ETIMEDOUT RT_Result Time out, usually from connection interrupts.
0xcb2e - 52014 RT_MSG_CLIENT_CONNECTION_LOST Can occur if the server response isn't what the client is expecting
NetConnectionType IDs

These NetConnectionTypes are their own labelled enum, sent generally, this table is hardcoded in the client itself.

ID Name Description
0x0001 NetConnectionTypeClientServerTCP Client - Server TCP Communication
NetErrorCode IDs

These NetErrors are enum ._0 types sent generally, as such a set table is hardcoded in the client itself.

ID Name Description
0x0000 NetErrorNone default value in most cases
0x0025 NetErrorUnknown Returned value from rare instances in update loops.
0x119f NetErrorMsgClientBadState
0x11a0 NetErrorMsgClientConnectionLost Can happen when a Timeout occurs during communication
0x13a3 NetErrorETimeout Client connection timed out, happens usually during connection interrupt.
0x0db1 NetErrorCommConnectionClosed Client closes communication from the server
NetResult IDs

These NetResult are their own labelled enum, sent as a output in MAPS communication via Plugins in the Client.

ID Name Description
0x0000000c (12) kNetProtocolError Client - Server Protocol Version Check 
Zipper Interactive Only
NetConnectStatus IDs

These ConnectStatus are enum ._1 type.

ID Name Description
0x0000 ConnectStatusClosed
0x0001 ConnectStatusOpen default value in most cases
0x0003 ConnectStatusFailed Can occur from a timeout
FailureReason IDs

These FailureReasons are enum ._4 type.

ID Name Description
0x0000 ConnectFailureReasonNone default value in most cases
AccessLevel IDs

These accessLevel IDs are enum ._131 type.

ID Name Description
0x0000 MEDIUS_ACCESSLEVEL_DEFAULT default value
Context StatusCode IDs

The Context StatusCode type is an enum ._222.

ID Name Description
0x0000 MediusSuccess default value
0x0xfffffc5d MediusTransactionTimedOut Connection timed out
Context IsEndOfList IDs

The IsEndOfList type is an enum ._212.

ID Name Description
0x0000 MEDIUS_FALSE default value
0x0001 MEDIUS_TRUE When it reaches end of list, or reaches a error of some form.
Transaction Response StatusCode IDs

The Transaction Response StatusCode type is an enum ._137.

ID Name Description
0x0000 MediusSuccess default value
ErrorResponse ExceptExtent IDs

The ExceptExtent type is an enum ._129.

ID Name ErrorMessage
0x0000 MEDIUS_EXCEPT_ABORT_TRANSACTION Transaction Timed Out

Medius Messages

Medius Messages are the underlying layer past RT Messages that is what the game actually sends the server data between client <-> server. This is usually sent after the Server Connection is established.

MUIS RequestUniverseInfo

This Medius Message is usually the first in the MUIS communication, asking for the Universe Information Server. Below this are the parameter tables such as CharacterEncoding and Language.

MessageID

This parameter is a character type with it being 21 bytes long.

ID Char Values Description
0x00 None - default value
0x31 1 1 of 21 characters used in this MessageID.
InfoType

This parameter is an unsigned int.

ID Description
0x0000 None - default value
0x03fc
CharacterEncoding

This parameter is enum ._138 type.

ID Name Description
0x00 MediusCharacterEncoding_NoUpdate No Update - default value
0x01 MediusCharacterEncoding_ISO8859_1 Latin-1 - Archived University Document that details this type of CharacterEncoding
0x02 MediusCharacterEncoding_UTF8
Language

This parameter is enum ._26 type.

ID Name Description
0x00 NetLanguageNone None - default value
0x01 NetLanguageUSEnglish US Language
NetLanguageJapanese Japanese Language
NetLanguageKorean Korean Language
NetLanguageItalian Italian Language
NetLanguageSpanish Spanish Language
NetLanguageGerman German Language
NetLanguageGerman German Language
NetLanguageFrench French Language
NetLanguageDutch Dutch Language
NetLanguagePortuguese Portuguese Language
NetLanguageChinese Chinese Language
NetLanguageTaiwanese Taiwanese Language
NetLanguageFinnish Finnish Language
NetLanguageNorwegian Norwegian Language
Retrieved from "https://wiki.hashsploit.net/index.php?title=PlayStation_3&oldid=65573"