python -m venv venv
source venv/bin/activate
pip install pycryptodome
Can it be the M.2 (NVME) drive encryption key (LUKS) Self-encrypting device
https://fail0verflow.com/blog/2018/ps4-cec/
EAP Keys (??) can is refer to Enterprise Authentication Protocol (EAP) settings for Wi-Fi or controller button customization
x: Jose Coixao
@notnotzecoxao
progress report: thanks to astrelsky, we now have the EAP KBL Kernel keys. unfortunately sony decided to use LZRA as a way of compressing the self, so this might take a while. for those of you who do want to contribute, now would be an excellent time to make a ps5 self too
Publishing Tools, are a collection of utilities used when managing and creating different types of file formats used for PlayStation 5 games and applications.
https://www.psdevwiki.com/ps5/Publishing_Tools
https://github.com/DNNDHH/PS5-PKGs
DNNDHH (Nasu Ni Furenaide) recently added a Github repository dubbed PS5 PKGs containing official build tools for building PS5 Packages to use on Prospero aka PlayStation 5... with PS5PKGsInstaller v1.21.0 featuring Publishing Tools for Prospero v1.21.0.10200 and a Param File Editor for Prospero v1.21 (Build 1.21.761931406) for PS5 PARAM.SFO files among the applications included in the Publishing Tools Installer leak. Download: Ps5PkgsInstaller-1.21.0.exe (29.1 MB - includes prospero-pub-cmd.exe, prospero-pub-param.exe, p2d.exe, ric.exe and sc2.exe) / GIT / Publishing Tools For Prospero.exe (29.1 MB - Mirror) via testkit_dev / Unity3D PS5.rar (15.47 GB - Publishing Tools, Unity3D 2021.2.0b11, PlayStation 5 ***) via testkit_dev / PS5.PKG.Tool_v1.0.5_BG4.zip (Latest) (38.6 MB - PS5 PKG Creation Tool Fork) / GIT (Fork) via @master s9 aka
Mitigation: However, even with the BootROM exploit (often associated with the "checkm8" style exploit on other devices), the PS5 uses a separate, secure operating system (SepOS) to handle sensitive functions like passcodes and biometrics, which makes a full, unmitigated jailbreak more challenging for everyday users.
pkgdec5 by Red-EyeX32 and zecoxao
pkgdec5 is an open source C# GUI program made by Red-EyeX32 and updated by zecoxao to decrypt and extract a PS5 release or debug NPDRM sc PKG file encrypted with keyset 3.\
Status: I made a python implementation for testing this, but haven't been able to validate it.
https://www.psdevwiki.com/ps5/PUP
http://dus01.ps5.update.playstation.net/update/ps5/official/tJMRE80IbXnE9YuG0jzTXgKEjIMoabr6/image/2025_1016/sys_83fbc791b7747e389762d68011b17c70ebbd4497a1d7cec0a947b9bdb833710e/PS5UPDATE.PUP \
It seems PS5 have a hardwarebacked key, that have not leaked (yet).
On a PS5 where we can execute code, we use the tool https://github.com/zecoxao/ps5-pup-decrypt/
to decrypt update or recover blobs /mnt/usb0/safe.PS5UPDATE.PUP
After that, it's possible to unpack the contents of nested filesystems, e.g. using https://github.com/idc/ps4-pup_unpack. The filesystem images in updates are FAT32, exFAT, etc images and can be mounted or unpacked with other tools.
https://www.psxhax.com/threads/ps5-system-software-firmware-update-live-ps5update-pup-unpacked.8271/
https://github.com/harlequin/ps4tools/blob/master/pupunpack.c
https://www.psdevwiki.com/ps5/Devices
The /dev/pup_update0 device is used to perform firmware updates. A virtual device representing the update file being installed.
Data structure
+-------+------------+-----------------------------------------+
|Offset | Name | Value/Description |
+-------+------------+-----------------------------------------+
|0x00 | Magic | Always 53 4C 42 32 "SLB2" |
|0x30 | File table | Contains a list of all files in the PUP |
+-------+------------+-----------------------------------------+
// Main PUP packed header (size == 0x20):
// 0x00: 53 4C 42 32 -> SLB2
// 0x04: 01 00 00 00 -> Version?
// 0x08: 00 00 00 00 -> Unknown
// 0x0C: 02 00 00 00 -> Number of PUP files in this pack
// 0x10: 03 9F 09 00 -> Total number of blocks (512 bytes)
// 0x14: 00 00 00 00 -> Unknown
// 0x18: 00 00 00 00 -> Unknown
// 0x1C: 00 00 00 00 -> Unknown
```1
The PUP entries are put after each other \
pup_entry_list = malloc(header.pup_file_num * sizeof(struct pup_entry));
Also known as PS4_PUP_PACK_MAGIC
0 53 4c 42 32 03 00 00 00 00 00 01 00 01 00 00 00 86 4b 27 00 00 SLB2.............K'..
15 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 2d 07 97 4e 00 00 ...............-..N..
2A 00 00 00 00 00 00 50 53 35 55 50 44 41 54 45 31 2e 50 55 50 00 ......PS5UPDATE1.PUP.
The PUP is decrypted using:
0xC0184404 VerifyPupWatermark 0xC0184405 PUP_UPDATER_DECRYPT_SEGMENT 0xC0284406 DecryptPupSegmentBlock
---
rootparam
0xC0305202 ROOTPARAM_VERIFY_PPR_ROOT_PARAM
# TPM
The TPM chip is an INFINEON SLM 9670:
- H2007A75
- Infineon H2007A75 TPM Chip
- Based off the Optiga SLM 9670 Chip
- SLS 52ASAC6
- CC: BSI-DSZ-CC-1100-2018
Seem to be abler to operate both in ISO and SPI mode
--
**Secure Channel?**
Still unclear if it has secure channel,
Trusted Platform Module 2.0 Library Part 1: Architecture: talks about use of secure channel `TPM2_PolicyTransportSPDM
https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-3-Commands-01.38.pdf
Its referred to "SPDM"
"Security Protocol and Data Model"
- SPDM is a protocol defined by the Distributed Management Task Force (DMTF),
- Applications do not directly communicate with the TPM hardware. Instead, they interact with the TPM via a TPM driver or a TPM Software Stack (TSS).
- Communication between the application and TPM is typically done through a trusted software interface. This software stack ensures that the TPM is accessed securely and that all commands to the TPM are authorized.
- Local and Trusted Path:
--
TPM2_VerifySignature
- TPMT_TK_VERIFIED (OK)
- TPM_RC_SIGNATURE
# ELF
What we should have:
- ROOTFS
- PS5_FSELF_MAGIC
#define PS4_FSELF_MAGIC "\x4F\x15\x3D\x1D" #define PS5_FSELF_MAGIC "\x54\x14\xF5\xEE" <=
# MISC References
https://gist.github.com/idlesauce/2ded24b7b5ff296f21792a8202542aaa
https://github.com/SvenGDK/PS-Multi-Tools/blob/b96f9cde522238c25f1cbf157407d334b9610ef3/PSMultiTools/PS5/Tools/PS5MakefSELFs.axaml.cs#L56