1 Release 1 Tag

RSS Feed

• Alpha_V1 01ebb1c749

  Compare

  PS5_Key_ExtractV4-Read-Only Pre-Release

  DieMitchell released this 2026-10-15 20:02:49 +02:00 | 4 commits to main since this release

  • Goal: Extract the PUP container decryption key from a jailbroken PS5. This is the one missing key needed to decrypt PS5 firmware update files (PUP files) on PC.

  ---

  • Target: The AMD CCP v5 (Cryptographic Co-Processor) and Sony’s EncryptService kernel driver (/dev/pup_update0). The PS5 uses this hardware+driver combo to decrypt firmware — the key lives in the CCP’s private key slots, which the CPU normally can’t read.

  ---

  • Attack surface (default scan, no flags):

  • CCP MMIO registers

  • — reads the hardware’s public/private slot masks to see which key slots exist and which are CPU-accessible
    Kernel cdevsw — finds Sony’s PUP decrypt driver in kernel memory, dumps the ioctl handler code (the function that actually calls the CCP to decrypt)

  • CCP command queue

  • — triggers a decrypt operation, then reads the raw CCP command descriptors the driver submitted. These reveal the exact AES mode, key size, and which slot number holds the key
    Kernel symbol table — resolves sceSblServiceCrypt, sceSblSsDecryptPupHeader, etc. to get their addresses and dump their code.

  ---

  Attack surface (with flags):

  • -p — submits a CCP PASSTHROUGH command to copy a private key slot’s contents to readable memory. This is the extraction step — it bypasses the CPU read mask by having the CCP itself do the copy
  • -d — feeds a real encrypted PUP header to the decrypt ioctl and captures the output (decryption oracle)

  ---

  • What it doesn’t touch:
  • No writes to flash, NVS, syscon, or kernel memory. The default scan is 100% read-only. Only -p writes (a single 32-byte CCP command descriptor).

  Downloads

  • ps5_key_extractV4.elf
    126 KiB

    2026-10-15 21:00:34 +02:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)