Add ioctl map from ps5-pup-decrypt source, improve approach 3 and auto-analysis
- Mapped all 6 ioctl codes for /dev/pup_update0 from the on-console
ps5-pup-decrypt encryptsrv.c source (VerifyBlsHeader through
DecryptSegmentBlock)
- Discovered type dispatch: DecryptHeader takes a type arg (0/1/2) that
selects which key to use. PS5UPDATE1.PUP = type 1 (system update key)
- analyze_dump.py now detects all 6 ioctl codes and type dispatch
patterns (cmp 0/1/2) in handler disassembly, labels them in output
- ps5_key_extractV2.c approach 3 now actually invokes DecryptHeader
ioctl with type=1 between LSB snapshots instead of skipping the call
- Added automated capstone disassembly engine to analyze_dump.py with
--save-handlers flag for manual Ghidra/IDA fallback
- Updated RESEARCH_POST.md with ioctl table and type dispatch finding
- Updated README.md and EXTRACTION_GUIDE.md for automated analysis flow
ioctl handler dump 4KB 16KB
cdevsw handlers dumped d_ioctl only d_open, d_close, d_read, d_ioctl
CCP queue descriptors not dumped dumped (shows what ops are queued)
Targeted address read not possible --addr flag for pass 2
Run order all 4 parallel approach 2 first (priority)
Approach 3 (pre/post) included demoted to optional (PSP lockout concern)
ioctl handler dump 4KB 16KB
cdevsw handlers dumped d_ioctl only d_open, d_close, d_read, d_ioctl
CCP queue descriptors not dumped dumped (shows what ops are queued)
Targeted address read not possible --addr flag for pass 2
Run order all 4 parallel approach 2 first (priority)
Approach 3 (pre/post) included demoted to optional (PSP lockout concern)
DeepKick-Stacks