HOME public beta just started a few minutes ago, and as a little bonus I write this little vulnarabilitie disclosure of HOME beta 1.3. Don't be THAT surprised, remember the decrypted HOME game files^^. HOME is the most buggy game I ever saw and they really ****ed up so much. Ok, the delays gone about 2 years but after this years of waiting as user I expect a little bit more. "It feels like 2005 tech in 2008. I'm not sure that’s what people want.", I can only agree with this comment of Microsoft. Well, here the disclosure:

The first 2 are server structure listenings. Some uninteresting files like the model files are missing, in generall the most interesting files are included. JSP files are NEVER sources, they are the response of the server. They are responded for german area.

----------------------------------------------------------------------------

1) scee-home.playstation.net server structure (without spaces as they are to big)

DOWNLOAD

2) homeps3.online.scee.com (jsp files are no sources, they are responds of the home servers)

DOWNLOAD

3) The different Content Bases:

For Developers & Alpha = http://homeps3-content.online.scee.com:10010/Alpha/Dev/
For Quality Assurance = http://homeps3-content.online.scee.com:10010/Alpha/QA/
For HOME Beta 0.9 = http://homeps3-content.online.scee.com:10010/Beta/090/

4) Take a look in the first download package \c.home\prod\live\Screens\

Only one of the XML files is encrypted, which means you can simply customize the HOME areas with your own videos, pictures and text if you use a apache + simple dns redirection.

5) Download any file from the HOME content server you want

(Well now we come to the more interesting parts^^)

Theres a download script here...

(homeps3.online.scee.com/HUBPS3_SVML/home/fileservices/Download.jsp)

...which is meaned to act as downloader for other users profiles, avatars and more.
Example: User1 uploads his profile to the home server (see point 6), now User2 sees User1 in HOME; the downloader downloads the profile of User1 to the local HDD space of User2. So far so good. Now theres the possibility to do a realtime packet edit to download ANY file you want. It's up to you what files you think about now, but there are more than just lame user profiles on such servers ;-) To continue:

Download.jsp?filename=Profile-UserXYZ

This is the structure how it looks like when a user profile is requested, after this the server responds this way:

http://pastebin.com/f422ad43e

Simply edit the filename to get your specific file

6) The most important vulnarability "upload any file to the HOME server"

The methode is nearly the same like in 5. just that you can upload instead of download a file. The structure looks like this:

Server request:
homeps3.online.scee.com/HUBPS3_SVML/fileservices/UploadFileServlet?fileNameBeginsWith=Avatar-UserXYZ.jpg&filePermission=2&fileTypeID=2&fileDescription=unused

Aswell theres the file you want to upload as raw data in the POST header. Just do a live edit again and inject your file. It will be saved in /HUBPS3_SVML/.

Please don't upload any r00tshells or similiar ;-)

7) At the end a funny thing "delete any file on the HOME server"

homeps3.online.scee.com/HUBPS3_SVML/home/fileservices/Delete.jsp?filename=XYZ

This could end really evil with a simple script :P

Please remember the last 3 vulnarabilities only work if you do a realtime packet edit. It's not possible to do this from a PC only or with fake packets!

----------------------------------------------------------------------------

So what is the conclusion?:

SONY ****ed it really up! First they delay HOME for more than a year, then they delay it a few times again and again till finally we have a HOME beta on a technical standard from 2005 with crappy graphics, a few boring areas and many many many many many many many many bugs. After this whole bullshitting we finally get our beta on 11.12.2008 with another delay of about 5 hours because SONY is unable to test their servers before. Congratz, to SONY for this fantastic product. THANKS!

Please remember:

Don't do anything stupid with this information which you could repent later.

Thanks for you attention, this was my little HOME vulnarabilities disclosure for you,

SKFU

**********UPDATE1**********
I think I need to clear up some things:

1) This is all public information anyone with a bit networking knowledge can get.

2) At no time I hacked the servers. The HOME errors are NOT caused by me! The explainations are all based on theorethical base!

3) All scripts and responds are client site, so all legal.

4) I like the idea of HOME but the tech of 2005 is a fact.

5) I'm not responsible for other people which are going to experiment with the provided information.

6) I think this disclosure is very ok, think about the 2 options:

1. I disclosure it and it gets fixed by SONY.

2. Someone else use the bugs, uploads a shell, roots the server, kills your HOME.

Hi,

DSolfege is the Nintendo DS port of free software GNU Solfege. Unfortunatly I've no more time to develop it. Actually only tne intervals game works without possibility to save scores.

If anyone is interested to continue this project or to take some parts of it (by exemple all notes in raw format) i've published the sources on my blog.

http://www.pianopenguin.net/index.ph...12/13/DSolfege

Hello!

This is a 3D engine, which aim is to make easier the procces of making a 3D game for the DS

Characteristics:
-Loader of models and textures from FAT.
-Dual 3D, as easy as normal 3D.
-Can load BMPs of 8, 16, and 24 bits and convert them into textures.
-Hardware-accelerated effects like fog and toon shading.
-You can take screenshots of both screens in dual 3D mode or the 3D screen in normal 3D mode.
-Animated model support.
-2D over 3D system.
-Very basic physics engine.
-API functions.
-2D text in 3D mode, any character size allowed.

TODO:
-A3I5 texture converter (3 bits of alpha, 5 bits of indexed colors).
-Improve physics engine.
-You can ask me for the things you would like to see.