steam-frame/deepkicks--TitaniaPy
1
0 Fork 0
mirror of https://github.com/deepkicks/TitaniaPy.git synced 2026-10-25 00:00:49 +02:00
Code Issues Packages Projects Releases 1 Wiki Activity

Add files via upload

Browse Source 
ioctl handler dump	4KB	16KB
cdevsw handlers dumped	d_ioctl only	d_open, d_close, d_read, d_ioctl
CCP queue descriptors	not dumped	dumped (shows what ops are queued)
Targeted address read	not possible	--addr flag for pass 2
Run order	all 4 parallel	approach 2 first (priority)
Approach 3 (pre/post)	included	demoted to optional (PSP lockout concern)
This commit is contained in:
deepkicks authored and GitHub committed 2026-10-15 03:11:14 -05:00
1 parent 81246f153f
commit 60eab267db
4 files changed
+847 -21
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+20 -7
View File
@@ -69,18 +69,31 @@ python main.py decompress segment.bin -o decompressed.bin
|------|-------------|
| `RESEARCH_POST.md` | Full technical write-up of findings |
## Key Extraction Payload
## Key Extraction Payload (v2)
If you have a jailbroken PS5 on FW 13.60 or below, `ps5_key_extract.c` implements four extraction approaches:
If you have a jailbroken PS5 on FW 13.60 or below, `ps5_key_extract.c` implements a **chained extraction strategy**:
1. **CCP LSB Key Slot Dump** — Reads all 128 hardware key slots via MMIO
2. **EncryptService ioctl Handler Scan** — Finds and dumps the `pup_update0` decrypt handler code
3. **Instrumented PUP Decrypt** — Snapshots key slots before/after a decrypt call to catch the key being loaded
4. **Kernel Memory Scan** — Searches near crypto-related strings for key material
**The chain: Approach 2 → Approach 1/5**
1. Dump the `pup_update0` ioctl/open/close handler code (only needs kernel R/W)
2. Disassemble on PC to find where the key comes from
3. Re-run the payload with `-a <address>` to read that specific location
All read-only. Output goes to `/data/pup_key_dump.bin`. Transfer to PC and run:
**All five approaches:**
1. **CCP LSB Key Slot Dump + Queue Registers** — Reads all 128 hardware key slots AND queue config registers (shows which slots are CPU-readable)
2. **Full EncryptService Handler Dump** — Dumps 16KB each of `d_ioctl`, `d_open`, and `d_close` handlers plus the full `cdevsw` struct
3. **Instrumented PUP Decrypt** — Pre/post LSB snapshots around a decrypt call
4. **Kernel Memory Scan** — Searches near crypto-related strings
5. **Targeted Address Read** — Re-run mode: reads a specific kernel or physical address after RE reveals the key location
```bash
# Full scan — run all approaches
./ps5_key_extract
# Targeted read — after disassembling the handler dump
./ps5_key_extract -a 0xFFFFFFFF82345678
./ps5_key_extract -a 0xFFFFFFFF82345678 -s 256
# Analyze on PC
python analyze_dump.py pup_key_dump.bin --pup14 PS5UPDATE14.00.PUP --pup14_1 PS5UPDATE14.10.PUP
```
RESEARCH_POST.md
+41 -7
View File
@@ -137,20 +137,54 @@ Any one of these gives us the missing piece. Once that key is in the tool, it wo
## I Already Built the Extraction Payload
To make this as easy as possible for anyone with a jailbroken 13.60 PS5, I wrote a ready-to-compile C payload (`ps5_key_extract.c`) that does all three of the above automatically. It implements four approaches:
To make this as easy as possible for anyone with a jailbroken 13.60 PS5, I wrote a ready-to-compile C payload (`ps5_key_extract.c` v2) that implements a **chained extraction strategy**. The key insight: Byepervisor Reborn gives kernel + HV R/W, but **not** direct PSP memory access. So we can't just dump the security processor — we need to be smarter.
1. **CCP LSB Key Slot Dump** — Maps the AMD CCP v5 MMIO region via `/dev/dmem0`, reads all 128 hardware key slots (8 LSBs x 16 slots x 32 bytes each). If the PUP key is in any slot, this grabs it.
### The Chained Strategy: Approach 2 → Approach 1
2. **EncryptService ioctl Handler Scan** — Searches kernel memory for the `pup_update0` device driver's `cdevsw` structure, follows the `d_ioctl` function pointer, and dumps 4KB of the handler code. Disassemble on PC with Ghidra/IDA to find which CCP key slot the decrypt function references.
**Step 1 — Dump the handler code (approach 2, needs only kernel R/W):**
The payload finds the `pup_update0` device driver's `cdevsw` struct in kernel memory and dumps 16KB each of:
- `d_ioctl` handler — the function behind `DecryptPupHeader` (ioctl `0xC0184402`)
- `d_open` handler — key loading may happen when the device is opened
- `d_close` handler — cleanup code that may reference the key
3. **Instrumented PUP Decrypt** — Snapshots all CCP LSB slots before and after a `DecryptPupHeader` ioctl call. Any slot that changes during the call = the key that was loaded for decryption.
Transfer the dump to PC, load the handler bytes into Ghidra/IDA as x86-64 code. The disassembly shows exactly how the key gets loaded: which CCP slot, which kernel address, or which PSP mailbox command provides it.
4. **Kernel Memory Scan** — Searches near strings like `encsrv`, `decrypt_header`, `Titania`, `ccp_key` and dumps surrounding context.
**Step 2 — Target what you found:**
Based on what the handler reveals:
All operations are **read-only** — nothing is written to kernel or CCP state. Output goes to `/data/pup_key_dump.bin`, which you transfer to PC and run through the companion `analyze_dump.py` script. That script automatically tests every captured key candidate against encrypted PUP headers from FW 14.00 and 14.10.
| Handler shows | Next step |
|---|---|
| Key loaded from a kernel memory address | Re-run payload with `-a 0xADDRESS` to read it directly |
| Key loaded via CCP unwrap operation | Read the wrapped blob + wrapping key |
| Key pre-loaded in CCP slot at boot | Check approach 1 results for that slot |
| Key fetched from PSP via mailbox | Now you know the exact PSP address to target |
### All Five Approaches
1. **CCP LSB Key Slot Dump + Queue Registers** — Maps the AMD CCP v5 MMIO region, reads all 128 hardware key slots AND all queue configuration registers. The queue registers tell us which slots are CPU-readable (public mask) vs hardware-protected (private mask) — so we know immediately if direct reads are possible.
2. **Full EncryptService Handler Dump** — Dumps the complete `cdevsw` struct (all function pointers) plus 16KB of `d_ioctl`, `d_open`, and `d_close` handler code. This is the most reliable approach — it only needs kernel R/W, which Byepervisor Reborn provides.
3. **Instrumented PUP Decrypt** — Snapshots all CCP LSB slots before and after a decrypt ioctl. Note: PSP may lock out after boot on newer firmware, making this less reliable.
4. **Kernel Memory Scan** — Searches near strings like `encsrv`, `decrypt_header`, `sceSblSsDecryptPupHeader`, `Titania` and dumps surrounding context.
5. **Targeted Address Read** — Re-run mode for after you've analyzed the handler dump on PC. Pass `-a 0xADDRESS` to read from a specific kernel or physical address. Automatically detects whether the address is virtual (uses `kernel_copyout`) or physical (uses MMIO mapping).
All operations are **read-only** — nothing is written to kernel or CCP state. Output goes to `/data/pup_key_dump.bin`, which you transfer to PC and run through the companion `analyze_dump.py` script. That script automatically parses all section types, displays CCP queue register masks, shows which slots are CPU-readable, and tests every captured key candidate against encrypted PUP headers from FW 14.00 and 14.10.
**Requirements:** A PS5 on FW 13.60 or below with kernel R/W access (Byepervisor Reborn + Relapse + etaHEN or similar). Compile for FreeBSD 11 amd64 and load via payload loader. You'll need to plug in your framework's `kernel_read64` / `kernel_copyout` functions.
**Usage:**
```bash
# Full scan — run all approaches
./ps5_key_extract
# Targeted read — after RE on PC reveals the key address
./ps5_key_extract -a 0xFFFFFFFF82345678
./ps5_key_extract -a 0xFFFFFFFF82345678 -s 256
```
## Tool Availability
The tool works today for everything except the one missing key:
@@ -163,7 +197,7 @@ The tool works today for everything except the one missing key:
- **Ready to accept the Layer 1 key** — the crypto module just needs one more key added and the full pipeline connects
- **Extraction payload ready** — `ps5_key_extract.c` + `analyze_dump.py` for someone with console access
Source is published: **https://github.com/deepkicks/TitaniaPy** — drop in your PUP files and go. DMs open if you have console access and want to collaborate — this is a one-key problem with a permanent payoff.
Source is published: **[GitHub repo link]** — drop in your PUP files and go. DMs open if you have console access and want to collaborate — this is a one-key problem with a permanent payoff.
---
analyze_dump.py
+95 -7
View File
@@ -21,22 +21,40 @@ except ImportError:
print("ERROR: pycryptodome required. Install with: pip install pycryptodome")
sys.exit(1)
# --- Dump format constants (must match ps5_key_extract.c) ---
# --- Dump format constants (must match ps5_key_extract.c v2) ---
DUMP_MAGIC = 0x505550444D50 # "PUPDMP\0\0" as uint64 LE
SECTION_LSB = 0x01
SECTION_IOCTL = 0x02
SECTION_SNAP_PRE = 0x03
SECTION_SNAP_POST = 0x04
SECTION_MEMSCAN = 0x05
SECTION_CDEVSW = 0x06
SECTION_CCP_REGS = 0x07
SECTION_ADDR_READ = 0x08
SECTION_HANDLER_OPEN = 0x09
SECTION_HANDLER_CLOSE = 0x0A
SECTION_NAMES = {
SECTION_LSB: "CCP LSB Key Slots",
SECTION_IOCTL: "ioctl Handler Code",
SECTION_IOCTL: "d_ioctl Handler Code",
SECTION_SNAP_PRE: "Pre-Decrypt LSB Snapshot",
SECTION_SNAP_POST: "Post-Decrypt LSB Snapshot",
SECTION_MEMSCAN: "Kernel Memory Scan",
SECTION_CDEVSW: "cdevsw Struct",
SECTION_CCP_REGS: "CCP Queue Registers",
SECTION_ADDR_READ: "Targeted Address Read",
SECTION_HANDLER_OPEN: "d_open Handler Code",
SECTION_HANDLER_CLOSE: "d_close Handler Code",
}
# CCP queue register names (11 regs x 4 bytes each, per queue)
CCP_QUEUE_REG_NAMES = [
"CONTROL", "TAIL_LO", "HEAD_LO", "INT_ENABLE", "INT_STATUS",
"STATUS", "PUBLIC_MASK_LO", "PUBLIC_MASK_HI",
"PRIVATE_MASK_LO", "PRIVATE_MASK_HI", "STATUS2",
]
CCP_NUM_QUEUES = 5
# LSB geometry
LSB_COUNT = 8
SLOTS_PER_LSB = 16
@@ -72,7 +90,7 @@ def parse_dump(data: bytes) -> dict:
header_size = 16 # dump_header_t
section_hdr_size = 16 # section_header_t
max_sections = 32
max_sections = 64
section_table_offset = header_size
sections = []
@@ -105,7 +123,7 @@ def extract_key_candidates(sections: list) -> list:
seen = set()
for sec in sections:
if sec["type"] not in (SECTION_LSB, SECTION_SNAP_PRE, SECTION_SNAP_POST):
if sec["type"] not in (SECTION_LSB, SECTION_SNAP_PRE, SECTION_SNAP_POST, SECTION_ADDR_READ):
continue
data = sec["data"]
@@ -289,6 +307,64 @@ def hexdump_section(data: bytes, label: str, max_bytes: int = 256):
print(f" ... ({len(data) - show} more bytes)")
def display_cdevsw(data: bytes):
"""Display the pup_update0 cdevsw struct with labeled function pointers."""
print(f"\n--- cdevsw Struct (pup_update0) ---")
if len(data) < 0x58:
print(f" [!] Too small ({len(data)} bytes)")
return
fields = [
(0x00, "d_version"),
(0x04, "d_flags"),
(0x08, "d_name (ptr)"),
(0x10, "d_open"),
(0x18, "d_close"),
(0x20, "d_read"),
(0x28, "d_write"),
(0x30, "d_ioctl"),
(0x38, "d_poll"),
(0x40, "d_mmap"),
(0x48, "d_strategy"),
(0x58, "d_kqfilter"),
]
for off, name in fields:
if off + 8 <= len(data):
val = struct.unpack_from("<Q", data, off)[0]
print(f" +0x{off:02x} {name:16s} = 0x{val:016x}")
def display_ccp_regs(data: bytes):
"""Display CCP queue registers."""
print(f"\n--- CCP Queue Registers ---")
regs_per_queue = len(CCP_QUEUE_REG_NAMES)
bytes_per_queue = regs_per_queue * 4
num_queues = min(CCP_NUM_QUEUES, len(data) // bytes_per_queue)
for q in range(num_queues):
base = q * bytes_per_queue
print(f" Queue {q}:")
for r in range(regs_per_queue):
val = struct.unpack_from("<I", data, base + r * 4)[0]
name = CCP_QUEUE_REG_NAMES[r]
print(f" {name:20s} = 0x{val:08x}")
pub_lo = struct.unpack_from("<I", data, base + 6 * 4)[0]
pub_hi = struct.unpack_from("<I", data, base + 7 * 4)[0]
pub_mask = (pub_hi << 32) | pub_lo
priv_lo = struct.unpack_from("<I", data, base + 8 * 4)[0]
priv_hi = struct.unpack_from("<I", data, base + 9 * 4)[0]
priv_mask = (priv_hi << 32) | priv_lo
readable = pub_mask & ~priv_mask
print(f" CPU-readable slots mask: 0x{readable:016x}")
if readable == 0:
print(f" [!] No CPU-readable slots on this queue")
else:
for bit in range(64):
if readable & (1 << bit):
print(f" [+] Slot {bit} is CPU-readable")
def main():
parser = argparse.ArgumentParser(description="Analyze PS5 PUP key dump")
parser.add_argument("dumpfile", help="Path to pup_key_dump.bin")
@@ -310,12 +386,24 @@ def main():
if parsed is None:
sys.exit(1)
# Display ioctl handler sections
# Display handler and metadata sections
for sec in parsed["sections"]:
if sec["type"] == SECTION_IOCTL:
hexdump_section(sec["data"], "ioctl Handler Code (DecryptPupHeader)")
hexdump_section(sec["data"], "d_ioctl Handler Code (DecryptPupHeader)")
print(f" Save this {len(sec['data'])}-byte blob and load into Ghidra/IDA as x86-64")
elif sec["type"] == SECTION_HANDLER_OPEN:
hexdump_section(sec["data"], "d_open Handler Code")
print(f" Key loading may happen here — disassemble alongside d_ioctl")
elif sec["type"] == SECTION_HANDLER_CLOSE:
hexdump_section(sec["data"], "d_close Handler Code")
elif sec["type"] == SECTION_CDEVSW:
display_cdevsw(sec["data"])
elif sec["type"] == SECTION_CCP_REGS:
display_ccp_regs(sec["data"])
elif sec["type"] == SECTION_ADDR_READ:
hexdump_section(sec["data"], "Targeted Address Read")
elif sec["type"] == SECTION_MEMSCAN:
hexdump_section(sec["data"], f"Kernel Memory Scan Match")
hexdump_section(sec["data"], "Kernel Memory Scan Match")
# Check for LSB diff (approach 3)
changed_slots = find_lsb_diff(parsed["sections"])
ps5_key_extractV2.c
+691
View File
@@ -0,0 +1,691 @@
/*
* ps5_key_extract.c — PUP header decryption key extractor for jailbroken PS5
*
* Target: PS5 FW 13.60 or below with kernel R/W (e.g. Byepervisor Reborn + Relapse)
* Build: compile for FreeBSD 11 amd64, load via payload loader
* Output: /data/pup_key_dump.bin (structured binary with section headers)
*
* Strategy: Chain approach 2 → approach 1.
* 1) Dump the ioctl handler code (approach 2) — needs only kernel R/W
* 2) RE the handler on PC to find which CCP slot / kernel address holds the key
* 3) Use approach 5 (read-address mode) to read that specific location
* 4) Approach 1 (CCP LSB dump) may catch it directly if slots are readable
*
* All operations are READ-ONLY. Nothing is written to kernel or hardware state.
*
* Usage:
* ./ps5_key_extract — run all approaches
* ./ps5_key_extract -a 0xFFFF... — read 4KB from a specific kernel address
* ./ps5_key_extract -a 0xFFFF... -s N — read N bytes from that address
*/
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
/* ---------- kernel R/W primitives (framework-dependent) ---------- */
extern uint64_t kernel_read64(uint64_t kaddr);
extern uint32_t kernel_read32(uint64_t kaddr);
extern int kernel_copyout(uint64_t kaddr, void *uaddr, size_t len);
/* ---------- output format (v2) ---------- */
#define DUMP_MAGIC 0x505550444D50ULL /* "PUPDMP\0\0" */
#define DUMP_VERSION 2
#define SECTION_LSB 0x01
#define SECTION_IOCTL 0x02
#define SECTION_SNAP_PRE 0x03
#define SECTION_SNAP_POST 0x04
#define SECTION_MEMSCAN 0x05
#define SECTION_CDEVSW 0x06
#define SECTION_CCP_REGS 0x07
#define SECTION_ADDR_READ 0x08
#define SECTION_HANDLER_OPEN 0x09
#define SECTION_HANDLER_CLOSE 0x0A
typedef struct {
uint64_t magic;
uint32_t version;
uint32_t section_count;
} __attribute__((packed)) dump_header_t;
typedef struct {
uint32_t type;
uint32_t size;
uint32_t offset;
uint32_t reserved;
} __attribute__((packed)) section_header_t;
/* ---------- AMD CCP v5 constants ---------- */
#define CCP_QUEUE_MMIO_BASE 0x3001000
#define CCP_QUEUE_STRIDE 0x1000
#define CCP_NUM_QUEUES 5
/* Queue register offsets */
#define CCP_REG_CONTROL 0x00
#define CCP_REG_TAIL_LO 0x04
#define CCP_REG_HEAD_LO 0x08
#define CCP_REG_INT_ENABLE 0x0C
#define CCP_REG_INT_STATUS 0x10
#define CCP_REG_STATUS 0x14
#define CCP_PUBLIC_MASK_LO 0x18
#define CCP_PUBLIC_MASK_HI 0x1C
#define CCP_PRIVATE_MASK_LO 0x20
#define CCP_PRIVATE_MASK_HI 0x24
#define CCP_REG_STATUS2 0x28
#define CCP_QUEUE_REG_COUNT 11
#define CCP_QUEUE_REG_SIZE (CCP_QUEUE_REG_COUNT * 4)
/* LSB region candidates from CCP BAR */
#define LSB_OFFSET_A 0x8000
#define LSB_OFFSET_B 0x10000
#define LSB_OFFSET_C 0x4000
/* LSB geometry: 8 LSBs x 16 slots x 32 bytes = 4096 bytes */
#define LSB_COUNT 8
#define SLOTS_PER_LSB 16
#define SLOT_SIZE 32
#define LSB_TOTAL_SIZE (LSB_COUNT * SLOTS_PER_LSB * SLOT_SIZE)
/* ---------- PUP ioctl constants (from psdevwiki) ---------- */
#define PUP_DEVICE_PATH "/dev/pup_update0"
#define PUP_IOCTL_DECRYPT_HEADER 0xC0184402
/* ---------- PS5 kernel constants (FreeBSD 11 based) ---------- */
#define KERNEL_BASE_PRIMARY 0xFFFFFFFF82200000ULL
#define KERNEL_BASE_FALLBACK 0xFFFFFFFF80000000ULL
/* FreeBSD 11 cdevsw field offsets */
#define CDEVSW_D_VERSION 0x00
#define CDEVSW_D_FLAGS 0x04
#define CDEVSW_D_NAME 0x08
#define CDEVSW_D_OPEN 0x10
#define CDEVSW_D_CLOSE 0x18
#define CDEVSW_D_READ 0x20
#define CDEVSW_D_WRITE 0x28
#define CDEVSW_D_IOCTL 0x30
#define CDEVSW_D_POLL 0x38
#define CDEVSW_D_MMAP 0x40
#define CDEVSW_D_STRATEGY 0x48
#define CDEVSW_D_KQFILTER 0x58
#define CDEVSW_SIZE 0x80
/* Handler dump size — 16KB gives enough room for full function + callees */
#define HANDLER_DUMP_SIZE (16 * 1024)
/* ---------- globals ---------- */
#define OUTPUT_MAX (512 * 1024)
static uint8_t g_output[OUTPUT_MAX];
static uint32_t g_output_pos = 0;
static uint32_t g_section_count = 0;
#define MAX_SECTIONS 64
static section_header_t g_sections[MAX_SECTIONS];
/* ---------- output helpers ---------- */
static void output_begin(void) {
g_output_pos = sizeof(dump_header_t) + sizeof(g_sections);
g_section_count = 0;
memset(g_output, 0, sizeof(g_output));
}
static void output_add_section(uint32_t type, const void *data, uint32_t size) {
if (g_section_count >= MAX_SECTIONS) return;
if (g_output_pos + size > OUTPUT_MAX) return;
g_sections[g_section_count].type = type;
g_sections[g_section_count].size = size;
g_sections[g_section_count].offset = g_output_pos;
g_sections[g_section_count].reserved = 0;
memcpy(g_output + g_output_pos, data, size);
g_output_pos += size;
g_section_count++;
}
static int output_write(const char *path) {
dump_header_t hdr;
hdr.magic = DUMP_MAGIC;
hdr.version = DUMP_VERSION;
hdr.section_count = g_section_count;
memcpy(g_output, &hdr, sizeof(hdr));
memcpy(g_output + sizeof(hdr), g_sections, sizeof(g_sections));
int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644);
if (fd < 0) {
printf("[!] Failed to open %s for writing\n", path);
return -1;
}
write(fd, g_output, g_output_pos);
close(fd);
printf("[+] Wrote %u bytes to %s (%u sections)\n",
g_output_pos, path, g_section_count);
return 0;
}
static void hexdump(const char *label, const uint8_t *data, size_t len) {
printf("[*] %s (%zu bytes):\n", label, len);
size_t show = len > 256 ? 256 : len;
for (size_t i = 0; i < show; i++) {
if (i > 0 && (i % 16) == 0) printf("\n");
if ((i % 16) == 0) printf(" %04zx: ", i);
printf("%02x ", data[i]);
}
printf("\n");
if (show < len)
printf(" ... (%zu more bytes in dump)\n", len - show);
}
/* ================================================================
* APPROACH 1: CCP LSB Key Slot Dump + Queue Register Dump
*
* Map the AMD CCP v5 MMIO region and read all 128 LSB key slots.
* Also dump all queue configuration registers (control, status,
* public/private masks) — these tell us which slots are CPU-readable.
* ================================================================ */
static int approach1_ccp_lsb_dump(void) {
printf("\n=== APPROACH 1: CCP LSB Key Slot Dump + Queue Registers ===\n");
int dmem_fd = open("/dev/dmem0", O_RDWR);
if (dmem_fd < 0) {
dmem_fd = open("/dev/mem", O_RDWR);
if (dmem_fd < 0) {
printf("[!] Cannot open /dev/dmem0 or /dev/mem\n");
return -1;
}
printf("[+] Opened /dev/mem\n");
} else {
printf("[+] Opened /dev/dmem0\n");
}
uint64_t bar_candidates[] = {
0xE0100000ULL,
0xFED80000ULL,
0xFEC10000ULL,
0x03000000ULL,
};
uint32_t lsb_offsets[] = { LSB_OFFSET_A, LSB_OFFSET_B, LSB_OFFSET_C };
uint8_t lsb_data[LSB_TOTAL_SIZE];
int found_any = 0;
for (int b = 0; b < (int)(sizeof(bar_candidates)/sizeof(bar_candidates[0])); b++) {
uint64_t bar = bar_candidates[b];
for (int lo = 0; lo < (int)(sizeof(lsb_offsets)/sizeof(lsb_offsets[0])); lo++) {
uint64_t lsb_phys = bar + lsb_offsets[lo];
printf("[*] Trying BAR 0x%llx + LSB offset 0x%x = 0x%llx\n",
(unsigned long long)bar, lsb_offsets[lo],
(unsigned long long)lsb_phys);
void *mapped = mmap(NULL, LSB_TOTAL_SIZE,
PROT_READ, MAP_SHARED,
dmem_fd, (off_t)lsb_phys);
if (mapped == MAP_FAILED) {
printf("[!] mmap failed for 0x%llx\n", (unsigned long long)lsb_phys);
continue;
}
memcpy(lsb_data, mapped, LSB_TOTAL_SIZE);
munmap(mapped, LSB_TOTAL_SIZE);
int nonzero_count = 0;
for (int slot = 0; slot < LSB_COUNT * SLOTS_PER_LSB; slot++) {
uint8_t *s = &lsb_data[slot * SLOT_SIZE];
int is_zero = 1;
for (int j = 0; j < SLOT_SIZE; j++) {
if (s[j] != 0) { is_zero = 0; break; }
}
if (!is_zero) {
nonzero_count++;
printf("[+] Non-zero LSB slot %d (LSB %d, slot %d):\n",
slot, slot / SLOTS_PER_LSB, slot % SLOTS_PER_LSB);
hexdump(" slot data", s, SLOT_SIZE);
}
}
if (nonzero_count > 0) {
printf("[+] Found %d non-zero slots at BAR 0x%llx + 0x%x\n",
nonzero_count, (unsigned long long)bar, lsb_offsets[lo]);
output_add_section(SECTION_LSB, lsb_data, LSB_TOTAL_SIZE);
found_any = 1;
}
}
/* Dump ALL queue registers — not just masks */
uint8_t queue_regs[CCP_NUM_QUEUES * CCP_QUEUE_REG_SIZE];
int got_regs = 0;
memset(queue_regs, 0, sizeof(queue_regs));
for (int q = 0; q < CCP_NUM_QUEUES; q++) {
uint64_t queue_base = bar + CCP_QUEUE_MMIO_BASE + (q * CCP_QUEUE_STRIDE);
void *qmap = mmap(NULL, 0x100, PROT_READ, MAP_SHARED,
dmem_fd, (off_t)queue_base);
if (qmap == MAP_FAILED) continue;
uint32_t *dst = (uint32_t *)&queue_regs[q * CCP_QUEUE_REG_SIZE];
dst[0] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_REG_CONTROL);
dst[1] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_REG_TAIL_LO);
dst[2] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_REG_HEAD_LO);
dst[3] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_REG_INT_ENABLE);
dst[4] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_REG_INT_STATUS);
dst[5] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_REG_STATUS);
dst[6] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_PUBLIC_MASK_LO);
dst[7] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_PUBLIC_MASK_HI);
dst[8] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_PRIVATE_MASK_LO);
dst[9] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_PRIVATE_MASK_HI);
dst[10] = *(volatile uint32_t *)((uint8_t *)qmap + CCP_REG_STATUS2);
munmap(qmap, 0x100);
printf("[+] Queue %d: ctrl=0x%08x status=0x%08x "
"pub=0x%08x%08x priv=0x%08x%08x\n",
q, dst[0], dst[5], dst[7], dst[6], dst[9], dst[8]);
got_regs = 1;
}
if (got_regs) {
output_add_section(SECTION_CCP_REGS, queue_regs, sizeof(queue_regs));
}
}
close(dmem_fd);
if (!found_any) {
printf("[!] No non-zero LSB data found via MMIO\n");
}
return found_any ? 0 : -1;
}
/* ================================================================
* APPROACH 2: EncryptService Full Handler Dump
*
* Find the pup_update device's cdevsw in kernel memory, then dump:
* - The full cdevsw struct (all function pointers)
* - 16KB of d_ioctl handler code
* - 16KB of d_open handler code (key loading may happen here)
* - 16KB of d_close handler code
*
* Disassemble all three on PC — the key's journey from storage
* into the CCP slot is visible somewhere in these functions.
* ================================================================ */
static int approach2_ioctl_handler_scan(void) {
printf("\n=== APPROACH 2: EncryptService Full Handler Dump ===\n");
uint64_t kernel_bases[] = { KERNEL_BASE_PRIMARY, KERNEL_BASE_FALLBACK };
const char *search_str = "pup_update";
size_t search_len = strlen(search_str);
size_t scan_size = 32 * 1024 * 1024;
uint8_t *kbuf = (uint8_t *)malloc(scan_size);
if (!kbuf) {
printf("[!] malloc failed for kernel scan buffer\n");
return -1;
}
for (int kb = 0; kb < (int)(sizeof(kernel_bases)/sizeof(kernel_bases[0])); kb++) {
uint64_t kbase = kernel_bases[kb];
printf("[*] Scanning kernel at base 0x%llx...\n", (unsigned long long)kbase);
if (kernel_copyout(kbase, kbuf, scan_size) != 0) {
printf("[!] kernel_copyout failed for base 0x%llx\n", (unsigned long long)kbase);
continue;
}
for (size_t i = 0; i < scan_size - search_len; i++) {
if (memcmp(&kbuf[i], search_str, search_len) == 0 && kbuf[i + search_len] == '\0') {
uint64_t str_kaddr = kbase + i;
printf("[+] Found \"%s\" at kernel address 0x%llx\n",
search_str, (unsigned long long)str_kaddr);
for (size_t j = 0; j < scan_size - 8; j += 8) {
uint64_t val;
memcpy(&val, &kbuf[j], 8);
if (val == str_kaddr) {
uint64_t ptr_kaddr = kbase + j;
uint64_t cdevsw_base = ptr_kaddr - CDEVSW_D_NAME;
printf("[+] Pointer to string at 0x%llx\n",
(unsigned long long)ptr_kaddr);
printf("[+] Candidate cdevsw at 0x%llx\n",
(unsigned long long)cdevsw_base);
/* Read all function pointers from cdevsw */
uint64_t d_open = kernel_read64(cdevsw_base + CDEVSW_D_OPEN);
uint64_t d_close = kernel_read64(cdevsw_base + CDEVSW_D_CLOSE);
uint64_t d_read = kernel_read64(cdevsw_base + CDEVSW_D_READ);
uint64_t d_write = kernel_read64(cdevsw_base + CDEVSW_D_WRITE);
uint64_t d_ioctl = kernel_read64(cdevsw_base + CDEVSW_D_IOCTL);
uint64_t d_poll = kernel_read64(cdevsw_base + CDEVSW_D_POLL);
uint64_t d_mmap = kernel_read64(cdevsw_base + CDEVSW_D_MMAP);
printf("[+] cdevsw function pointers:\n");
printf(" d_open = 0x%llx\n", (unsigned long long)d_open);
printf(" d_close = 0x%llx\n", (unsigned long long)d_close);
printf(" d_read = 0x%llx\n", (unsigned long long)d_read);
printf(" d_write = 0x%llx\n", (unsigned long long)d_write);
printf(" d_ioctl = 0x%llx\n", (unsigned long long)d_ioctl);
printf(" d_poll = 0x%llx\n", (unsigned long long)d_poll);
printf(" d_mmap = 0x%llx\n", (unsigned long long)d_mmap);
if (d_ioctl < 0xFFFFFFFF80000000ULL) {
printf("[!] d_ioctl address looks invalid, skipping\n");
continue;
}
/* Dump the raw cdevsw struct */
uint8_t cdevsw_raw[CDEVSW_SIZE];
if (kernel_copyout(cdevsw_base, cdevsw_raw, sizeof(cdevsw_raw)) == 0) {
printf("[+] Dumped cdevsw struct (%d bytes)\n", CDEVSW_SIZE);
output_add_section(SECTION_CDEVSW, cdevsw_raw, sizeof(cdevsw_raw));
}
/* Dump 16KB of d_ioctl handler */
uint8_t handler_code[HANDLER_DUMP_SIZE];
if (kernel_copyout(d_ioctl, handler_code, sizeof(handler_code)) == 0) {
printf("[+] Dumped d_ioctl handler (%d bytes)\n", HANDLER_DUMP_SIZE);
hexdump("d_ioctl first 128 bytes", handler_code, 128);
output_add_section(SECTION_IOCTL, handler_code, sizeof(handler_code));
} else {
printf("[!] Failed to dump d_ioctl handler\n");
}
/* Dump 16KB of d_open handler — key loading may happen here */
if (d_open >= 0xFFFFFFFF80000000ULL) {
uint8_t open_code[HANDLER_DUMP_SIZE];
if (kernel_copyout(d_open, open_code, sizeof(open_code)) == 0) {
printf("[+] Dumped d_open handler (%d bytes)\n", HANDLER_DUMP_SIZE);
hexdump("d_open first 128 bytes", open_code, 128);
output_add_section(SECTION_HANDLER_OPEN, open_code, sizeof(open_code));
} else {
printf("[!] Failed to dump d_open handler\n");
}
}
/* Dump 16KB of d_close handler */
if (d_close >= 0xFFFFFFFF80000000ULL) {
uint8_t close_code[HANDLER_DUMP_SIZE];
if (kernel_copyout(d_close, close_code, sizeof(close_code)) == 0) {
printf("[+] Dumped d_close handler (%d bytes)\n", HANDLER_DUMP_SIZE);
output_add_section(SECTION_HANDLER_CLOSE, close_code, sizeof(close_code));
} else {
printf("[!] Failed to dump d_close handler\n");
}
}
free(kbuf);
return 0;
}
}
}
}
}
free(kbuf);
printf("[!] Could not locate pup_update cdevsw\n");
return -1;
}
/* ================================================================
* APPROACH 3: Instrumented PUP Decrypt (LSB snapshot)
*
* Snapshot all CCP LSB key slots BEFORE and AFTER issuing the
* DecryptPupHeader ioctl. Any slot that changed was loaded by
* the security processor for decryption.
*
* NOTE: PSP may lock out after boot, making this less reliable
* on newer firmware. Still worth running for the diff data.
* ================================================================ */
static int approach3_instrumented_decrypt(void) {
printf("\n=== APPROACH 3: Instrumented PUP Decrypt ===\n");
int pup_fd = open(PUP_DEVICE_PATH, O_RDWR);
if (pup_fd < 0) {
printf("[!] Cannot open %s — device may not exist or access denied\n",
PUP_DEVICE_PATH);
printf("[*] Skipping approach 3 (needs %s)\n", PUP_DEVICE_PATH);
return -1;
}
printf("[+] Opened %s\n", PUP_DEVICE_PATH);
int dmem_fd = open("/dev/dmem0", O_RDWR);
if (dmem_fd < 0) {
printf("[!] Cannot open /dev/dmem0 for LSB snapshot\n");
close(pup_fd);
return -1;
}
uint64_t lsb_phys = 0x03000000ULL + LSB_OFFSET_A;
uint8_t pre_lsb[LSB_TOTAL_SIZE];
uint8_t post_lsb[LSB_TOTAL_SIZE];
void *mapped = mmap(NULL, LSB_TOTAL_SIZE, PROT_READ, MAP_SHARED,
dmem_fd, (off_t)lsb_phys);
if (mapped == MAP_FAILED) {
printf("[!] Cannot map LSB region for snapshot\n");
close(dmem_fd);
close(pup_fd);
return -1;
}
memcpy(pre_lsb, mapped, LSB_TOTAL_SIZE);
printf("[+] Pre-decrypt LSB snapshot captured\n");
output_add_section(SECTION_SNAP_PRE, pre_lsb, LSB_TOTAL_SIZE);
printf("[*] To invoke the ioctl, provide valid src/dst physical addresses.\n");
printf("[*] Skipping actual ioctl call (needs DMA-able memory with PUP header).\n");
memcpy(post_lsb, mapped, LSB_TOTAL_SIZE);
munmap(mapped, LSB_TOTAL_SIZE);
printf("[+] Post-decrypt LSB snapshot captured\n");
output_add_section(SECTION_SNAP_POST, post_lsb, LSB_TOTAL_SIZE);
int changes = 0;
for (int slot = 0; slot < LSB_COUNT * SLOTS_PER_LSB; slot++) {
uint8_t *pre = &pre_lsb[slot * SLOT_SIZE];
uint8_t *post = &post_lsb[slot * SLOT_SIZE];
if (memcmp(pre, post, SLOT_SIZE) != 0) {
printf("[+] LSB slot %d CHANGED during decrypt!\n", slot);
hexdump(" before", pre, SLOT_SIZE);
hexdump(" after ", post, SLOT_SIZE);
changes++;
}
}
printf("[*] %d LSB slots changed\n", changes);
close(dmem_fd);
close(pup_fd);
return (changes > 0) ? 0 : -1;
}
/* ================================================================
* APPROACH 4: Kernel Memory Scan
*
* Search kernel memory near known strings for key-like data.
* Dump 512 bytes of surrounding context for each match.
* ================================================================ */
static int approach4_kernel_memscan(void) {
printf("\n=== APPROACH 4: Kernel Memory Scan ===\n");
const char *needles[] = {
"encsrv",
"encrypt_service",
"pup_key",
"decrypt_header",
"ccp_key",
"dec_pup",
"Titania",
"sceSblSsDecryptPupHeader",
"sceSblServiceCrypt",
NULL
};
uint64_t kernel_bases[] = { KERNEL_BASE_PRIMARY, KERNEL_BASE_FALLBACK };
size_t scan_size = 32 * 1024 * 1024;
uint8_t *kbuf = (uint8_t *)malloc(scan_size);
if (!kbuf) {
printf("[!] malloc failed\n");
return -1;
}
int total_found = 0;
for (int kb = 0; kb < (int)(sizeof(kernel_bases)/sizeof(kernel_bases[0])); kb++) {
uint64_t kbase = kernel_bases[kb];
printf("[*] Scanning kernel at base 0x%llx...\n", (unsigned long long)kbase);
if (kernel_copyout(kbase, kbuf, scan_size) != 0) {
printf("[!] kernel_copyout failed for 0x%llx\n", (unsigned long long)kbase);
continue;
}
for (int n = 0; needles[n] != NULL; n++) {
size_t nlen = strlen(needles[n]);
for (size_t i = 0; i < scan_size - nlen; i++) {
if (memcmp(&kbuf[i], needles[n], nlen) == 0) {
uint64_t match_addr = kbase + i;
printf("[+] Found \"%s\" at 0x%llx\n",
needles[n], (unsigned long long)match_addr);
size_t ctx_start = (i >= 256) ? (i - 256) : 0;
size_t ctx_end = i + 256;
if (ctx_end > scan_size) ctx_end = scan_size;
size_t ctx_len = ctx_end - ctx_start;
char label[128];
snprintf(label, sizeof(label), "context around \"%s\"", needles[n]);
hexdump(label, &kbuf[ctx_start], ctx_len);
output_add_section(SECTION_MEMSCAN, &kbuf[ctx_start], (uint32_t)ctx_len);
total_found++;
i += nlen;
}
}
}
if (total_found > 0) break;
}
free(kbuf);
printf("[*] Total string matches: %d\n", total_found);
return (total_found > 0) ? 0 : -1;
}
/* ================================================================
* APPROACH 5: Targeted Address Read
*
* After disassembling the handler dump on PC, you know exactly
* which kernel address or CCP slot holds the key. Re-run the
* payload with -a <address> to read from that specific location.
*
* Usage: ./ps5_key_extract -a 0xFFFFFFFF82345678
* ./ps5_key_extract -a 0xFFFFFFFF82345678 -s 256
* ================================================================ */
static int approach5_read_address(uint64_t addr, uint32_t size) {
printf("\n=== APPROACH 5: Targeted Address Read ===\n");
printf("[*] Reading %u bytes from 0x%llx\n", size, (unsigned long long)addr);
uint8_t *buf = (uint8_t *)malloc(size);
if (!buf) {
printf("[!] malloc failed\n");
return -1;
}
if (addr < 0x100000000ULL) {
/* Physical address — use MMIO mapping */
printf("[*] Address looks physical, using mmap\n");
int dmem_fd = open("/dev/dmem0", O_RDWR);
if (dmem_fd < 0) {
printf("[!] Cannot open /dev/dmem0\n");
free(buf);
return -1;
}
void *mapped = mmap(NULL, size, PROT_READ, MAP_SHARED,
dmem_fd, (off_t)addr);
if (mapped == MAP_FAILED) {
printf("[!] mmap failed\n");
close(dmem_fd);
free(buf);
return -1;
}
memcpy(buf, mapped, size);
munmap(mapped, size);
close(dmem_fd);
} else {
/* Kernel virtual address — use kernel_copyout */
printf("[*] Address looks virtual, using kernel_copyout\n");
if (kernel_copyout(addr, buf, size) != 0) {
printf("[!] kernel_copyout failed\n");
free(buf);
return -1;
}
}
hexdump("address read", buf, size);
output_add_section(SECTION_ADDR_READ, buf, size);
free(buf);
printf("[+] Saved to dump file\n");
return 0;
}
/* ---------- main ---------- */
int main(int argc, char **argv) {
printf("=== PS5 PUP Key Extractor v2 ===\n");
printf("Target: PUP header decryption key\n");
printf("Output: /data/pup_key_dump.bin\n\n");
/* Parse arguments */
uint64_t target_addr = 0;
uint32_t target_size = 4096;
int addr_mode = 0;
for (int i = 1; i < argc; i++) {
if (strcmp(argv[i], "-a") == 0 && i + 1 < argc) {
target_addr = strtoull(argv[++i], NULL, 0);
addr_mode = 1;
} else if (strcmp(argv[i], "-s") == 0 && i + 1 < argc) {
target_size = (uint32_t)strtoul(argv[++i], NULL, 0);
if (target_size > 65536) target_size = 65536;
}
}
output_begin();
if (addr_mode) {
/* Targeted read mode — just read the specified address */
approach5_read_address(target_addr, target_size);
} else {
/* Full scan mode — run all approaches */
int r1 = approach1_ccp_lsb_dump();
int r2 = approach2_ioctl_handler_scan();
int r3 = approach3_instrumented_decrypt();
int r4 = approach4_kernel_memscan();
printf("\n=== Summary ===\n");
printf("Approach 1 (CCP LSB + queue regs): %s\n", r1 == 0 ? "OK" : "FAILED");
printf("Approach 2 (full handler dump): %s\n", r2 == 0 ? "OK" : "FAILED");
printf("Approach 3 (instrumented decrypt): %s\n", r3 == 0 ? "OK" : "FAILED");
printf("Approach 4 (kernel mem scan): %s\n", r4 == 0 ? "OK" : "FAILED");
printf("\nChained strategy:\n");
printf(" 1. Load d_ioctl/d_open dumps into Ghidra/IDA on PC\n");
printf(" 2. Find which CCP slot or kernel address the key comes from\n");
printf(" 3. Re-run with: ./ps5_key_extract -a <address> -s <size>\n");
}
output_write("/data/pup_key_dump.bin");
printf("\n[*] Done. Transfer /data/pup_key_dump.bin to PC and run:\n");
printf(" python analyze_dump.py pup_key_dump.bin\n");
return 0;
}