Hijacking the PS5's RTMP stream

Kinda sad that it's 2026 and this data still goes over the internet unencrypted...

RTMP and all the video and audio protocols behind it aren't trivial either - I bet there are hundreds of exploits waiting to be found that any three letter agency sitting on the internet can use to take over your PS5 and all credentials stored within too...

This is how Lightstream Studio has provided stream overlay for consoles[1]. Some years ago Microsoft added them as an official destination using a better protocol and dropped the need for MITM hackery.

I used to work in this space and Lightstream was always doing interesting things, even if they never seemed to find PMF.

1: https://support.golightstream.com/hc/en-us/articles/38643168...

Feel like there's a few parts missing that I'm not getting.

The author mentions that the PS5 uses RTMPS to push video up to twitch - but suddenly it just uses plain RTMP?

Don't mind me, I'm just sitting here with my HDMI-RX port on rk3588 being happy that is works and I didn't brick the board when doing uboot update to uncurse it.

This is fantastic. Not being able to share my gameplay with friends on Discord is one of my biggest gripes.

I'd kill for a Bluetooth peripheral workaround. I've a Clicks Power Keyboard that'd be great to use with the PS5.

Maybe I'm missing something but there seems to be a gap between "figure out the REAL hostname" and "we no longer have to worry about the stream never showing up on YouTube"

excited to try this! i’ve had this exact same want from streaming to discord on ps5

Vote with your $ and get a gaming PC. Don’t let people who remember the 1990s tell you it will be a sweaty experience, install Steam and it won’t be. There are like 15 exclusive games for the PS5, what’s the point?

Honestly the DNS trick in this post is neat but I'm not setting up dnsmasq just to share my screen. This is the kind of thing where Sony could just let you stream to anything and they don't, and it's annoying

You can combine the last two steps the nginx and mpv with obs and gstreamer, or just gstreamer really.

Imagine if they just let you specify your own RTMP destination. Crazy thought, I know.

Another crypto mistake by Sony this time leaving traffic completely unencrypted.

[flagged]

PS5 uses DNS to resolve where to send RTMP stream. The author found out that they cannot spoof the main server since that server uses TLS and it's not possible to make the PS5 trust self made certificate. The author then runs a real Twitch stream and monitors DNS requests and finds DNS of the server that receives the RTMP stream and spoofs only that final server. It's more of a problem with RTMP protocol/Twitch security rather than the PS5.