webMAN MOD Stealth Features and IDPS/PSID Spoofing: Implementation Guide

webMAN MOD implements stealth capabilities and console identifier spoofing through Cobra/PS3MAPI syscalls that disable detection vectors and patch kernel memory to mask custom firmware presence.

webMAN MOD provides sophisticated stealth mechanisms designed to hide the plugin from the PlayStation 3 system UI and spoof the console's unique identifiers. These features operate at the kernel level through the SC_COBRA_SYSCALL8 interface, enabling users to bypass detection systems and run disc-based games tied to different consoles. This article examines the implementation details in the aldostools/webman-mod repository, analyzing how stealth mode conceals custom firmware activity and how IDPS/PSID spoofing modifies console identity data.

How Stealth Mode Works in webMAN MOD

Stealth mode in webMAN MOD serves as a comprehensive evasion mechanism that removes digital fingerprints of custom firmware from the system. According to the source code in include/ps3mapi/stealth.h, stealth functionality encompasses three primary defense layers: hiding the plugin from XMB menus and process lists, disabling specific system calls used for firmware detection, and blocking PlayStation Network URLs that could expose the console's modified state.

Hiding the Plugin and Blocking System Calls

The core stealth implementation resides in include/ps3mapi/stealth.h, which defines the syscall removal infrastructure. When activated, the system executes remove_cfw_syscalls(), a function that writes zero values into the syscall table entries associated with known custom firmware detection vectors. The code maintains a restoration capability through restore_cfw_syscalls(), allowing the plugin to reverse these modifications when stealth mode is disabled.

The implementation specifically targets syscall 8 through remove_cfw_syscall8(), which is the primary Cobra/PS3MAPI syscall interface. By clearing this entry, external tools cannot query the kernel for custom firmware indicators. The header defines SYSCALLS_UNAVAILABLE as 0xFFFFFFFF80010003ULL, representing the error code returned when blocked syscalls are invoked.

PSN URL Blocking Mechanism

webMAN MOD maintains a table of blocked PlayStation Network URLs to prevent authentication leaks. The source defines static u64 blocked_url[MAX_BLOCKED_URL][2] and u8 url_count to track these entries. The function restore_blocked_urls(bool notify) handles writing these blocked addresses into LV1 (hypervisor) memory, effectively preventing the console from contacting Sony's servers that would expose the custom firmware presence.

Stealth Folder Implementation

When stealth mode is active, webMAN MOD redirects game scanning to a hidden directory defined in include/init/paths.h as MM_ROOT_STL "/dev_hdd0/tmp/game_repo/main". This stealth folder remains invisible to standard XMB scans, ensuring game content remains accessible to webMAN while hidden from the default system browser.

Activation Flow

The stealth activation sequence begins in main.c when the configuration flag webman_config->stealth evaluates to true. The plugin executes:

system_call_3(SC_COBRA_SYSCALL8, SYSCALL8_OPCODE_STEALTH_ACTIVATE, 0, 0);

The opcode SYSCALL8_OPCODE_STEALTH_ACTIVATE (defined as 0x3995 in include/ps3mapi/ps3mapi.h) triggers the kernel-level stealth extension (derived from the PSNPatch project) to set an internal flag. This flag initiates the cascade of remove_cfw_syscalls(), remove_cfw_syscall8(), and restore_blocked_urls(false) calls that sanitize the system's detectable state.

IDPS and PSID Spoofing Implementation

IDPS (Initial Device Private Key) and PSID (PlayStation ID) spoofing allows webMAN MOD to masquerade as a different console by overwriting these unique identifiers stored in flash memory. This capability enables running disc-based games bound to specific console IDs and alters the console's network identity.

Console Identifier Structure

The IDPS consists of two 64-bit values representing the console's unique hardware identity. webMAN MOD stores user-provided spoof values in webman_config->vIDPS1 and webman_config->vIDPS2, with activation flags webman_config->sidps and webman_config->spsid controlling IDPS and PSID spoofing respectively.

The spoof_idps_psid() Function

The primary spoofing logic resides in include/feat/idps.h within the spoof_idps_psid() function. The implementation follows this sequence:

1. Hex Conversion: User-provided string values convert to unsigned 64-bit integers via convertH(), populating newIDPS[2].

2. Validation: The code performs a sanity check ensuring the IDPS follows the required format pattern:

   if(((newIDPS[0] & 0xFFFFFFFFFFF0FF00ULL) == 0x0000000100800000ULL) && (newIDPS[1] != 0))

3. Kernel Write: For Cobra-enabled firmware, the system invokes:

   system_call_4(SC_COBRA_SYSCALL8, 
                 SYSCALL8_OPCODE_PS3MAPI, 
                 PS3MAPI_OPCODE_SET_IDPS,
                 (u64)newIDPS[0], 
                 (u64)newIDPS[1]);

   The opcode PS3MAPI_OPCODE_SET_IDPS (defined as 0x0082 in include/ps3mapi/ps3mapi.h) instructs the kernel to overwrite the protected IDPS values.

4. Legacy Fallback: For firmware versions 4.53 and below, or when specific offsets are known (idps_offset1 and idps_offset2), the code falls back to direct memory patching using pokeq() to write values directly to flash-derived memory locations.

PSID Spoofing Parallels

PSID spoofing follows an identical pattern using PS3MAPI_OPCODE_SET_PSID (0x0084). The same validation, conversion, and fallback mechanisms apply, allowing simultaneous spoofing of both identifiers through the webMAN setup interface.

Key Source Files and Architecture

Understanding webMAN MOD's stealth architecture requires familiarity with several critical source files that define the syscall interface and configuration handling.

Core Header Files

include/ps3mapi/stealth.h contains the stealth mode implementation including remove_cfw_syscalls(), restore_cfw_syscalls(), and the URL blocking table management.

include/ps3mapi/ps3mapi.h defines the essential opcodes for both stealth and spoofing operations:

• SYSCALL8_OPCODE_STEALTH_ACTIVATE 0x3995
• PS3MAPI_OPCODE_SET_IDPS 0x0082
• PS3MAPI_OPCODE_SET_PSID 0x0084

include/feat/idps.h implements the identifier spoofing logic through spoof_idps_psid() and supporting conversion functions.

include/ps3mapi/ps3mapi_server.h and include/ps3mapi/ps3mapi.c handle remote administration commands, processing SETIDPS and GETIDPS requests from HTTP or telnet interfaces and forwarding them to the kernel syscall interface.

Configuration Integration

The main entry point in main.c initializes these features by checking webman_config flags during plugin startup. When users enable stealth or spoofing through the web interface (/setup.ps3), the configuration reload triggers the respective syscall sequences, applying changes without requiring system reboots.

Practical Implementation Examples

Enabling Stealth via HTTP Interface

Users can activate stealth mode remotely through the web interface:

# HTTP request to enable stealth

http://<ps3_ip>/setup.ps3?stealth=1

This updates webman_config->stealth and triggers:

system_call_3(SC_COBRA_SYSCALL8,
              SYSCALL8_OPCODE_STEALTH_ACTIVATE,
              0, 0);

Spoofing IDPS through Configuration

To spoof console identifiers, users submit hex values through the setup page:

# HTTP command format for IDPS spoofing

http://<ps3_ip>/setup.ps3?vIDPS1=001000000800ABCD&vIDPS2=001000000800EF01&sidps=1

Internally, this executes the spoofing routine in idps.h:

u64 newIDPS[2] = { convertH("001000000800ABCD"),
                   convertH("001000000800EF01") };

system_call_4(SC_COBRA_SYSCALL8,
              SYSCALL8_OPCODE_PS3MAPI,
              PS3MAPI_OPCODE_SET_IDPS,
              newIDPS[0],
              newIDPS[1]);

Summary

• Stealth mode operates through SYSCALL8_OPCODE_STEALTH_ACTIVATE (0x3995), which disables CFW syscalls via remove_cfw_syscalls(), blocks PSN URLs through the blocked_url table, and redirects game scanning to the hidden MM_ROOT_STL folder (/dev_hdd0/tmp/game_repo/main).

• IDPS/PSID spoofing is handled by spoof_idps_psid() in include/feat/idps.h, which validates hex input through convertH(), checks the 0x0000000100800000ULL pattern, and writes values using either PS3MAPI_OPCODE_SET_IDPS (0x0082) or direct memory pokes for legacy firmware.

• Both features depend on the Cobra/PS3MAPI syscall interface (SC_COBRA_SYSCALL8) and manipulate kernel-level data structures to mask the console's true firmware state and hardware identity.

Frequently Asked Questions

How does webMAN MOD hide itself from the XMB when stealth mode is enabled?

When stealth mode is activated, webMAN MOD executes the SYSCALL8_OPCODE_STEALTH_ACTIVATE syscall which removes the plugin from the list of loaded PRX modules and disables syscall 8, preventing system utilities from detecting the custom firmware. The plugin also redirects game scanning to the stealth folder defined as /dev_hdd0/tmp/game_repo/main in include/init/paths.h, keeping content accessible while invisible to standard XMB scans.

What validation does webMAN MOD perform before applying IDPS spoofing?

Before writing new IDPS values, webMAN MOD validates the input through a bitwise pattern check in include/feat/idps.h. The code verifies that newIDPS[0] & 0xFFFFFFFFFFF0FF00ULL equals 0x0000000100800000ULL and that newIDPS[1] is non-zero. This ensures the spoofed IDPS follows the correct Sony console identifier format, preventing system instability from malformed values.

Can stealth mode and IDPS spoofing be used simultaneously?

Yes, stealth mode and IDPS/PSID spoofing function independently and can operate concurrently. Stealth mode manages syscall visibility and network blocking through include/ps3mapi/stealth.h, while identifier spoofing modifies console-specific values through include/feat/idps.h. Both features activate during plugin initialization in main.c when their respective configuration flags (webman_config->stealth and webman_config->sidps) are enabled.

What is the difference between the PS3MAPI syscall method and direct memory patching for IDPS spoofing?

The PS3MAPI method uses system_call_4 with PS3MAPI_OPCODE_SET_IDPS (0x0082) to request the kernel extension to handle the protected memory write, available on Cobra firmware. Direct memory patching via pokeq() serves as a fallback for legacy firmware versions 4.53 and below, or when specific flash offsets (idps_offset1 and idps_offset2) are known, writing directly to the memory-mapped flash regions without kernel mediation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}