PS5 PUP Decrypt Tool

PC-based Python tool for parsing and decrypting PS5 PUP (PlayStation Update Package) files. No console needed.

Status

The tool handles 3 of 4 crypto layers. Layer 1 (PUP container encryption) is the one missing piece — see RESEARCH_POST.md for the full technical write-up and what's needed.

Layer	Purpose	Status
0	PBKDF2 master key derivation	Solved
1	PUP container encryption	Blocked — key not public
2	PUP segment-level encryption	Blocked (depends on Layer 1)
3	Inner firmware encryption	Solved

Setup

pip install -r requirements.txt

Requires Python 3.10+, pycryptodome, and capstone (for automated handler disassembly).

Usage

# Show PUP file structure (BLS container + PUP header)
python main.py info PS5UPDATE.PUP

# Extract inner entries from BLS container
python main.py extract PS5UPDATE.PUP -o output_dir/

# Decrypt inner firmware blobs with known Layer 3 keys
python main.py decrypt firmware_blob.bin -k emc_ipl_header

# Bruteforce-test an unknown blob against all known keys
python main.py bruteforce unknown_blob.bin

# Analyze entropy of a binary blob
python main.py analyze blob.bin

# Show all known keys and derivation results
python main.py keys

# Decompress a zlib-compressed segment
python main.py decompress segment.bin -o decompressed.bin

Files

Core Tool

File	Description
main.py	CLI entry point — 7 commands
keys.py	All known PS5 keys (ROM, keyseeds, OTP/KDF, Titania, firmware)
bls.py	BLS (SLB2) outer container parser
pup.py	PUP inner structure parser
crypto.py	AES-128-CBC/ECB, PBKDF2, Layer 3 decrypt functions
firmware.py	Inner firmware decryptor with entropy analysis

Key Extraction (for jailbroken PS5)

File	Description
ps5_key_extract.c	C payload — 5 approaches to extract the missing PUP container key
analyze_dump.py	Parses the dump, tests key candidates, and auto-disassembles handlers to find the key source

Documentation

File	Description
RESEARCH_POST.md	Full technical write-up of findings
EXTRACTION_GUIDE.md	Step-by-step walkthrough for running the extraction

Key Extraction Payload (v2)

If you have a jailbroken PS5 on FW 13.60 or below, ps5_key_extract.c implements a chained extraction strategy:

The chain: Approach 2 → automated RE → Approach 5

1. Dump the pup_update0 ioctl/open/close handler code (only needs kernel R/W)
2. Run analyze_dump.py on PC — it auto-disassembles the handlers and finds the key source
3. Re-run the payload with the -a <address> command it gives you

All five approaches:

1. CCP LSB Key Slot Dump + Queue Registers — Reads all 128 hardware key slots AND queue config registers (shows which slots are CPU-readable)
2. Full EncryptService Handler Dump — Dumps 16KB each of d_ioctl, d_open, and d_close handlers plus the full cdevsw struct
3. Instrumented PUP Decrypt — Invokes DecryptHeader ioctl with type=1 (system update key) between pre/post LSB snapshots to catch key loading
4. Kernel Memory Scan — Searches near crypto-related strings
5. Targeted Address Read — Re-run mode: reads a specific kernel or physical address after RE reveals the key location

# Full scan — run all approaches
./ps5_key_extract

# Targeted read — using the address from analyze_dump.py's recommendations
./ps5_key_extract -a 0xFFFFFFFF82345678
./ps5_key_extract -a 0xFFFFFFFF82345678 -s 256

# Analyze on PC (tests keys + auto-disassembles handlers)
python analyze_dump.py pup_key_dump.bin --pup14 PS5UPDATE14.00.PUP --pup14_1 PS5UPDATE14.10.PUP

# Save handler .bin files for manual Ghidra/IDA analysis
python analyze_dump.py pup_key_dump.bin --save-handlers

Requirements: FreeBSD 11 amd64 cross-compiler, kernel R/W via Byepervisor Reborn + Relapse + etaHEN or similar. You'll need to provide your framework's kernel_read64 / kernel_copyout functions.

Contributing

The tool is one key away from full PUP decryption. If you have console access and can run the extraction payload or dump the EncryptService, open an issue or DM.

---

All research conducted on personally owned hardware for educational purposes. Referenced keys are publicly documented on psdevwiki.