dnas-replacement

dnas-replacement is a replacement implementation of a DNAS server intended for development, protocol research, and reverse engineering workflows.

This repository is an implementation of the DNAS server by FogNo23/DNASrep.

Related project worth mentioning: Project-Backstab/DNASBypass.

It is primarily designed for developers and reverse engineers who need a controlled environment to test requests, validate packet behavior, and iterate on custom responses.

For a quick local start, use the setup in docker-compose.yaml.

Prebuilt Docker images are available at panzerpunk/dnas-rep.

If you need to support multiple hostnames/domains in front of the service with stunnel, plan for several public IP addresses on the same host and bind separate listeners to them.

When working with original PS2 clients, stunnel is recommended as a TLS gateway in front of this service to bridge legacy encryption protocol support.

Docker Run Guide

Before running the project in Docker, you need to generate the certificates first. This is required because the server expects cert.pem, cert-key.pem, and ca-cert.pem in the certs directory.

You can do this locally:

./tools/reissue-certs.sh
mv ./tools/certs .

If you need a different primary CN for the server certificate:

./tools/reissue-certs.sh --primary-cn your.host.name

Certificate generation examples with parameters:

# Custom validity period (days)
./tools/reissue-certs.sh --days 730

# Custom primary CN
./tools/reissue-certs.sh --primary-cn gate2.jp.dnas.playstation.org

# Custom CN + validity period
./tools/reissue-certs.sh --primary-cn gate2.jp.dnas.playstation.org --days 365

Or with Docker:

docker build --target dnas-reissue-certs -t dnas-reissue-certs .
mkdir -p certs
docker run --rm \
  -u "$(id -u):$(id -g)" \
  -v "$(pwd)/certs:/app/certs" \
  dnas-reissue-certs

With Docker and script parameters:

docker run --rm \
  -u "$(id -u):$(id -g)" \
  -v "$(pwd)/certs:/app/certs" \
  dnas-reissue-certs --primary-cn gate2.jp.dnas.playstation.org --days 365

reissue-certs domain reference

Known domains (from bioserv httpd.conf):

• JP:
  • gate1.jp.dnas.playstation.org
  • ts01.jp.dnas.playstation.org
  • dnns-p01.jp.dnas.playstation.org
  • dnns-r01.jp.dnas.playstation.org
  • bbn01.jp.dnas.playstation.org
  • bbn02.jp.dnas.playstation.org
• EU:
  • gate1.eu.dnas.playstaion.org
• US:
  • gate1.us.dnas.playstaion.org

After that, ./certs should contain:

• cert.pem
• cert-key.pem
• ca-cert.pem
• ca-key.pem

Then build the main image:

docker build --target dnas -t dnas .

And run the container:

docker run --rm \
  -p 443:443 \
  -v "$(pwd)/certs:/etc/dnas/certs:ro" \
  dnas

If you do not want to use port 443 on the host, you can map another port instead:

docker run --rm \
  -p 8443:443 \
  -v "$(pwd)/certs:/etc/dnas/certs:ro" \
  dnas

Custom packets via volume

The image is built with embedded assets, but filesystem assets have priority when files exist in /etc/dnas/assets. This allows overriding built-in packets with your own files.

Folder layout for custom packets:

custom-assets/
  eu-gw/
    error.raw
    <gameid_hex>_<qrytype_hex>
  us-gw/
    error.raw

Notes:

• Region folder name (for example eu-gw, us-gw, gai-gw) comes from request path.
• Packet filename format is <gameid_hex>_<qrytype_hex>.
• Keep error.raw in each region folder as a fallback packet.

Run with a custom assets volume:

docker run --rm \
  -p 8443:443 \
  -v "$(pwd)/certs:/etc/dnas/certs:ro" \
  -v "$(pwd)/custom-assets:/etc/dnas/assets:ro" \
  dnas

Single file override example (without mounting the whole folder):

docker run --rm \
  -p 8443:443 \
  -v "$(pwd)/certs:/etc/dnas/certs:ro" \
  -v "$(pwd)/assets/eu-gw/0c9f71ec2d8639f7_01080001:/etc/dnas/assets/eu-gw/0c9f71ec2d8639f7_01080001:ro" \
  dnas

docker-compose variant (add to dnas-backend service):

services:
  dnas-backend:
    volumes:
      - ./custom-assets:/etc/dnas/assets:ro

Notes

• It is better to create the certs directory in advance with mkdir -p certs, otherwise it may be created with root ownership.
• The certificate generation stage is named dnas-reissue-certs.
• The main image is built with the embedassets tag. Mount /etc/dnas/assets only when you need to override embedded packets with custom ones.