Hijacking the PS5's RTMP Stream

Sony has increasingly restricted the ways users can utilize their PS5 hardware. Streaming is one such area where limitations become evident once you venture beyond the supported services. The console’s “Broadcast” button offers convenience, but going beyond the limited supported services can be frustrating. Third-party Bluetooth devices also face restrictions, as Sony ties its wireless stack to their own peripherals.

Streaming to platforms like Discord, which lacks screen sharing support, presents additional challenges. An alternative to investing in a capture card is using Remote Play to stream the PS5 directly to a MacBook and then broadcasting from there. However, this method requires linking the controller, headphones, and other peripherals to the Remote Play device and can result in input lag.

The console’s built-in streaming capabilities to YouTube and Twitch require no configuration, but the protocol used, RTMP, limits customization options. The idea is to make a device act as Twitch and receive the RTMP stream instead. The PS5 doesn’t hardcode Twitch’s IP, instead, it looks it up via DNS each time. If control over DNS resolutions is gained, the stream can be redirected.

However, spoofing the hostname directly fails as it’s a discovery endpoint, not the RTMP server. The actual RTMP server uses RTMPS, and self-signed certificates or custom CA installations aren’t possible on the PS5. YouTube RTMP ingestion, on the other hand, uses plain RTMP on port 1935 without TLS, making it a suitable alternative.

The DNS logs reveal the PS5 resolves ingest.global-contribute.live-video.net, which further resolves to aps30.contribute.live-video.net. Spoofing contribute.live-video.net redirects the stream to the Mac without any certificate issues. The setup includes two main components: dnsmasq and nginx-rtmp. A macOS menu bar app bundles both and manages the DNS resolution.

The app modifies the PS5’s DNS server setting in its DHCP lease on a GL.iNet router running OpenWRT. The PS5 pushes the stream directly to the Mac at 1080p60, H.264, and AAC stereo, which can be pulled into OBS, recorded locally, or shared with Discord. This setup has proven reliable for several weeks, with minimal issues.