The Spectrum Dispatch News

technology

Developer finds way to hijack PS5's streaming to bypass Sony restrictions

A developer created a method to intercept PS5 RTMP streams using DNS spoofing and nginx, enabling Discord streaming without capture cards.

Developer finds way to hijack PS5's streaming to bypass Sony restrictions

Sony restricts which services the PS5 can stream to through its built-in Broadcast button, limiting options to YouTube and Twitch. A developer documented a workaround that intercepts the console’s streaming protocol to send video feeds to custom endpoints instead.

Developer finds way to hijack PS5’s streaming to bypass Sony restrictions

The PS5 uses RTMP (Real-Time Messaging Protocol) for streaming. When a user initiates a broadcast, the console resolves Twitch’s hostname via DNS and sends the stream there. The developer’s solution exploits this by controlling DNS responses on the local network.

The Technical Approach

Initial attempts to spoof Twitch’s ingest endpoint failed for two reasons. First, ingest.twitch.tv:443 is a discovery endpoint, not the actual RTMP server—it directs the PS5 to regional servers like ap-southeast-1.prod.fi.contribute.live-video.net. Second, Twitch’s real ingest uses RTMPS (RTMP over TLS), which validates certificates against trusted certificate authorities. The PS5 doesn’t allow installing custom certificates, blocking self-signed alternatives.

YouTube’s plain RTMP endpoint on port 1935 initially worked without certificate validation, but the platform’s periodic API checks failed since YouTube never received the stream, causing broadcasts to stop after 60 seconds.

The solution came from monitoring DNS logs during a Twitch broadcast. The PS5 resolves ingest.global-contribute.live-video.net, which chains to aps30.contribute.live-video.net—the actual RTMP server using plain RTMP without TLS.

Implementation

The setup uses two tools bundled in a macOS menu bar app: dnsmasq for DNS spoofing and nginx-rtmp for receiving streams. The developer configured dnsmasq to resolve Twitch’s ingest domains (contribute.live-video.net and regional variants) to their Mac’s local IP address. When the PS5 requests DNS resolution, it receives the Mac’s IP instead of Twitch’s, connecting to the local machine thinking it’s the official service.

The PS5’s DHCP lease on an OpenWRT router was configured to serve the Mac’s IP as the DNS server specifically for that device, requiring no manual console configuration.

Once the PS5 connects to nginx-rtmp on port 1935, it streams 1080p60 H.264 video with AAC stereo audio directly to the Mac. The developer uses mpv with a low-latency profile to display the stream with under one second of delay, then shares the window to Discord. The complete setup has proven reliable over weeks of use.

Key facts

  • The PS5 restricts streaming to Sony-approved services like Twitch and YouTube through the Broadcast button
  • Twitch uses RTMPS with certificate validation, preventing simple DNS spoofing without additional tools
  • YouTube’s RTMP ingest worked but failed due to API checks confirming stream receipt
  • The solution uses DNS spoofing via dnsmasq to redirect PS5 streams to a local nginx-rtmp server
  • The stream is intercepted at the contribute.live-video.net domain, which handles actual RTMP transmission
  • The PS5 streams 1080p60 H.264 video with AAC stereo audio directly to the local endpoint
  • The developer achieves under one-second latency using mpv’s low-latency profile for Discord sharing

Sources

← All posts