git-etawen-dev-mia/ssl-patcher
Watch
1
0
Fork
You've already forked ssl-patcher
 0
Code Issues Pull requests Releases 1 Activity
Archive of https://git.etawen.dev/mia/ssl-patcher — PS5 TLS pinning bypass for libSceHttp / libSceSsl https://git.etawen.dev/mia/ssl-patcher
4 commits 1 branch 1 tag 70 KiB
  • C 60%
  • Python 39%
  • Shell 0.5%
  • Makefile 0.5%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
mia ea0d170b26
 proxy: add oauth/trophy/clienthello spoofs 
- tls_clienthello: log SNI for every PS5 TLS handshake (helps map which
  domains need to land in hosts.txt)
- /api/authz/v3/oauth/token: return a properly-claimed RS256 JWT so Game
  Base can init (parses requested scope from the body)
- /api/trophy/v1: fake trophySummary (level 247), trophyTitles list
  (Astro's Playroom / Elden Ring / GoW Ragnarok), trophyGroups, and a
  set of inside-joke trophies (SSL Slayer / etaWEN PS5 Discord etc.)
- sessionManager friends/partySessions: serve a fake 'etaWEN Crew Party'
  so the hub card has something to show
- userProfile: handle /users/.../friends, /availabilities,
  /basicPresences (plural), all returning sane stubs
- catch-all: any unhandled /api/ path on ps5.np.playstation.net returns
  empty 200 so native modules don't hit 401s
2026-05-18 21:43:11 -04:00
proxy proxy: add oauth/trophy/clienthello spoofs 2026-05-18 21:43:11 -04:00
.gitignore initial: PS5 TLS pinning bypass payload 2026-05-16 09:37:26 -04:00
LICENSE license: GPL-3.0 2026-05-16 09:43:34 -04:00
Makefile initial: PS5 TLS pinning bypass payload 2026-05-16 09:37:26 -04:00
README.md readme: describe patches, firmware compat (10.01 / 5.50), build, usage 2026-05-16 09:45:38 -04:00
ssl_pin_bypass.c initial: PS5 TLS pinning bypass payload 2026-05-16 09:37:26 -04:00

README.md

ssl-patcher

PS5 payload that disables TLS certificate pinning in libSceHttp / libSceSsl, so HTTPS clients on the console (including SceShellCore's PSN traffic) can be MITM-routed through a local proxy.

How it works

Two pattern-scanned patches:

  1. libSceSsl / sceSslCreateSslConnection — NOPs the or byte ptr [r14+4Dh], 21h instruction (5 bytes: 41 80 4E 4D 21). That instruction sets the sticky pin bit 0x100 for Sony hostnames (p.*, ps5.*, ps4.*.playstation.net). Once set the bit can't be cleared — sceSslDisableOptionInternalInsecure explicitly preserves it.
  2. libSceHttp / sub_F960 (HTTPS init helper) — replaces mov esi, [r12+150h] (8 bytes: 41 8B B4 24 50 01 00 00) with xor esi, esi + 6-byte NOP (31 F6 66 0F 1F 44 00 00). The helper calls sceSslDisableOptionInternalInsecure(0x3DFF) to strip verify bits, then immediately sceSslEnableOptionInternal(ctx, template_options) to restore them — zeroing the second arg turns the Enable into a no-op so the Disable actually sticks.

Combined effect: every HTTPS connection built through libSceHttp ends up with SSL context options at 0x400 (just the non-verify preserve bit) instead of 0x4A5 / 0x25A5. Chain validation bits 0x1 / 0x4 / 0x20 are off.

Firmware compatibility

Pattern scans were derived from firmware 10.01 and 5.50. Other firmwares may work — the binaries are pattern-scanned at runtime, so as long as the target instructions are byte-identical in the user's libSceSsl / libSceHttp, the patches apply.

If the patterns have shifted (compiler change, refactor between firmware versions), the scan will fail and the patches won't land. In that case you need to re-derive the byte signatures for that firmware:

  • Disassemble libSceSsl.sprx around sceSslCreateSslConnection and find the equivalent or byte ptr [reg+offset], imm that sets the pin bit.
  • Disassemble libSceHttp.sprx and find the function that calls sceSslDisableOptionInternalInsecure(0x3DFF) followed by sceSslEnableOptionInternal. Re-derive the mov instruction byte pattern.

Update the byte signatures in ssl_pin_bypass.c and rebuild.

Build

Requires the PS5 payload SDK.

make PS5_PAYLOAD_SDK=/path/to/ps5-payload-sdk

Produces ssl_pin_bypass.elf.

Usage

Send the ELF to elfldr (port 9021) on a jailbroken PS5:

nc -q 99 <ps5-ip> 9021 < ssl_pin_bypass.elf

Then route HTTPS traffic through the local proxy in proxy/ — see proxy/run.sh.

License

GPL-3.0 — see LICENSE.