Category PS4 CFW and Hacks       Thread starter PSXHAX       Start date May 2, 2019 at 5:47 AM       11,286       31            
Status
Not open for further replies.
Following fail0verflow's PS4 Crashdumps / Kernel Dumping and PS4 Aux Hax Documentation alongside his recent PS4 Sflash0 Pack Tool, PlayStation 4 developer @SocraticBliss made available a PS4 Crash Dump Decryptor Python Script for scene devs on Twitter today.

Download: ps4_crash_dump_decryptor.py / ps4_mono_to_il.py (PS4 MONO binaries to IL MONO binaries - updated script to work with the PS4's .dll.sprx and .exe.sprx files to turn them into .dll and .exe to be inspected with something like dnSpy)

From the Tweets below, here's what he had to say on it: "Still tweaking this somewhat, but decided to take a swing at fail0verflow's PS4 Crash Dump Decryptor script (since at this point its fairly outdated), enjoy!

Thanks goes out to notzecoxao, CelesteBlue123, and most of all fail0verflow! :)"

ps4_crash_dump_decryptor.py
Code:
#!/usr/bin/env python
'''

Crash Dump Decryptor by SocraticBliss (R)

Thanks to...
# Team FailOverflow
# CelesteBlue
# zecoxao

1) Replace  AES KEY # with the actual key
2) Replace HMAC KEY # with the actual key
3) Have orbiscore-systemcrash.orbisstate in the same directory
4) python ps4_crash_dump_decryptor.py

'''

from binascii import unhexlify as uhx, hexlify as hx
from Crypto.Cipher import AES
from Crypto.Hash import HMAC, SHA256
import struct
import sys

class Header:
    def __init__(self, f):
        __slots__ = ('VERSION', 'OPEN_PSID', 'PADDING_1', 'PADDING_2',
                     'UNKNOWN', 'STATE', 'DATA_LEN', 'PADDING_3', 'DATA_HMAC')

        # Secure Header
        self.VERSION   = struct.unpack('<I', f.read(4))[0]
        self.PSID_ENC  = struct.unpack('<16s', f.read(16))[0]
        self.PADDING_1 = struct.unpack('<I13Q', f.read(108))[0]
   
        # Padding
        self.PADDING_2 = struct.unpack('<4Q', f.read(32))[0]
   
        # Final Header
        self.UNKNOWN   = struct.unpack('<2Q', f.read(16))[0]
        self.STATE     = struct.unpack('<Q', f.read(8))[0]
        self.DATA_LEN  = struct.unpack('<Q', f.read(8))[0]
        self.PADDING_3 = struct.unpack('<2Q', f.read(16))[0]
        self.DATA_HMAC = struct.unpack('<4Q', f.read(32))[0]

KEYS = [
    ['',''],
    ['AES KEY 1','HMAC KEY 1'], # 1.01
    ['AES KEY 2','HMAC KEY 2'], # 3.55
    ['AES KEY 3','HMAC KEY 3'], # 4.05
    ['AES KEY 4','HMAC KEY 4'], # 4.07
]

def aes_ecb_encrypt(key, data):
    return AES.new(uhx(key), AES.MODE_ECB).encrypt(data)

def aes_ecb_decrypt(key, data):
    return AES.new(uhx(key), AES.MODE_ECB).decrypt(data)

def hmac_sha256(key, data):
    return HMAC.new(uhx(key), msg = data, digestmod = SHA256).digest()

# PROGRAM START
def main (argc, argv):

    # 1) Read the Header
    with open('orbiscore-systemcrash.orbisstate', 'rb') as f:
        ps = Header(f)
   
        KD = KEYS[ps.VERSION][0]
        KC = KEYS[ps.VERSION][1]
        print('\nEncrypted PSID: %s' % hx(ps.PSID_ENC).upper())
   
        PSID_DEC = aes_ecb_decrypt(KD, ps.PSID_ENC)
        print('\nPSID: %s' % hx(PSID_DEC).upper())
        
        # HMAC DIGEST
        DIGEST = hmac_sha256(KC, ps.PSID_ENC)
        print('HASH: %s' % hx(DIGEST).upper())
           
        KD = DIGEST[0x10:]
        KC = DIGEST[:0x10]
          
        print('\nAES : %s' % hx(KC).upper())
        print('HMAC: %s' % hx(KD).upper())
   
        # 2) Dump Starts Here
        f.seek(0x4000)
        DATA_ENC = f.read()

    # 3) Utilize the proper key set to decrypt the data
    IV = '0000000000000000'
    DATA = AES.new(KD, AES.MODE_CBC, IV).decrypt(DATA_ENC)

    # 4) Save the decrypted data
    with open('debug.bin', 'wb') as f:
        f.write(DATA)
   
    print('\nSaved to debug.bin')

if __name__=='__main__':
    sys.exit(main(len(sys.argv), sys.argv))
Crash Dump KeySeed
Code:
kd, kc
KEYS = [
    ['',''],
    [b'8F86DDEDCBF24A44EB6C30607AA26F76', b'4125715AAB8B78E569F512E65CA62DD3'], # 1.01-3.15
    [b'63AEF79DC49969FD8997B2F60DB65F81', b'1800A5DE2D0F0652FA5602FFADD440AA'], # 3.50-3.70
    [b'05205507B7A154E08A7A38B1897563FB', b'AD334D142EAF8B9438DB00D1D0BFF357'], # 4.00-4.05
    [b'04C1A0961BBB0CB2140361B0956AAABA', b'052D2FF3014FB38CAAF6898CB899982A'], # 4.06-4.07 (to test)
]
Sealed Key Values

Keyset 1

AES-CBC-128
Key = B5DAEFFF39E6D90ECA7DC5B029A8153E

SHA-256-HMAC
Hash = 8707960A53468D6C843B3DC9624E22AF

Keyset 2
AES-CBC-128
Key = EC0D347E2A7657471F1FC33E9E916FD4

SHA-256-HMAC
Hash = A6D6583D3217E87D9BE9BCFC4436BE4F

Keyset 3
AES-CBC-128
Key = 51D8BFB4E387FB4120F081FE33E4BE9A

SHA-256-HMAC
Hash = FFF9BDEA803B14824C61850EBB084EE9

Keyset 4
AES-CBC-128
Key = 346B5D231332AC428A44A708B1138F6D

SHA-256-HMAC
Hash = 5DC6B8D1A3A0741852A7D44268714824

Dumped with getSealedKeySecret on 5.05

PS4 Crash Dump Decryptor Python Script via SocraticBliss.jpg
 
:idea: Reminder: Those without a Verified Badge yet on Discord to access the private areas we recommend Joining Us! Why? The waiting process takes a week for new Members, and there's a lot we're unable to share on public forums including the latest PS4 PKG Games. 🏴‍☠️

Comments

Status
Not open for further replies.

moh86

Senior Member
Contributor
I‘m proud to say that I‘ve sold my PS4 5.05 last week for a good price. Now I will buy a new PS4 Pro and the first thing what I will do is updating to the latest firmware and play some new games.
 

sanyo23

Senior Member
Contributor
@Czesio8094 it is sad but it is true, this scene is dead and isnt because of us... the guys that can do something prefer to do the baiting job... they just did something in the past to earn prestigious on this world so and now talk about that they dont like backups, hum hum true crap... "you did backup since 10 years and now your consciousness wake up?" we actually dont have to try to do something.

guys that are on 5.05, will you be in 2022 and still have to much to play? gl to you i prefer to update and pay 20 dollars for a Spider Man game.
 

azoreseuropa

Senior Member
Contributor
Verified
Wow, some fo you are gave up. I am stick with mine, thank you very much. They will surprise us one day and you guys who gave up will regret, LOL! :ROFLMAO:
 
Status
Not open for further replies.
Recent Articles
PS4 Kernel Exploit (KEX) for 7.02 Firmware, Wait for Jailbreak Before Updating!
As promised last month, PlayStation 4 scene developer theflow0 just dropped the PS4 Kernel Exploit (KEX) for Firmware 7.02 and below which was patched by Sony in 7.50 PS4 OFW (Current OFW is 7.51)...
Ubisoft Forward: Assassin's Creed Valhalla & Watch Dogs: Legion PS4
In lieu of a traditional E3 2020 presentation as physical gaming shows are postponed due to the COVID-19 pandemic, Ubisoft will be hosting its first digital conference called Ubisoft Forward with...
Dark Chronicle (Dark Cloud 2) PS2 on PS4 Companion App by Halvardssm
Recently developer halvardssm made available a companion app script for the Dark Chronicle (also known as Dark Cloud 2 in North America) PS2 on PS4 action role-playing game (RPG) by Level-5 via...
PS5 Hacking-Themed Platformer Recompile Gameplay Trailer Video
Earlier this week we saw a first look at the PS5 hacking-themed indie platformer Recompile by Phigames, and below is a Recompile PlayStation 5 gameplay trailer video for sceners who can't wait to...
Top