PS4 HDD Decryption Helper

Main purpose of this toolkit is helping with internal HDD decryption and mounting.

Unicorns: ;)

PS4 HDD Mounter.sh allows to create mappers and mount filesystems.
PS4 HDD Umounter.sh allows to unmount filesystems and remove mappers.

EAP & SAMU Keys

Both keys are mandatory for decryption and mounting all partitions. However, currently SAMU key can be obtained only on fw v6.72 (up to v7.55). With EAP key alone, You can get inside to only: /app_reserved, /app_tmp, /eap_user, /eap_vsh, /system_data, /update, /user and swap.

To read EAP Key, You can e.g start Linux Psxitarch and copy /etc/cryptsetp/eap_hdd_key.bin to USB. To read SAMU Key… There is no user friendly method. Personally never have this key or any sample encrypted by it, so part of this script I made, based on dev wiki informations. Could be wrong, so be warned.

Guide:

All above listed scripts needs some keys and kernel modules to operate. Depend of task, You need put different files in specified directories.

Preparations:

Put EAP Key and SAMU Key into ~/ps4/keys/ dir under eap_key.bin and samu_key.binfilenames.
Put UFS kernel module into ~/ps4/apps/ dir under ufs.ko filename. You must compile it yourself to match kernel version in Your Linux distribution. Version mismatching results in unable of load it. ufs is OPTIONAL, providing only write permissions on UFS2 partitions (/eap_user, /system_data, /user).

Tasks:

Reading HDD contents

Run PS4 HDD Mounter and “follow the damn train CJ”. ;) After You are done, remember to run PS4 HDD Umounter if You don’t want format HDD after back to the console. :P

Models

What are PS4 none-IV and IV models? There is no list of motherboards which using IV and which doesn’t, so in general:

CUH-1000 and some CUH-1100 models are “none-IV models”.
Some CUH-1100, CUH-2xxx up to and include CUH-7xxx are “IV models”.

FAQ:

Q: Are You the author of the method, tools and shit?
A: Obviously NO. I’m humble Graphic Artist and IT Specialist, not a Programmer, Reverse Engineer or even Linux master hiding in basement. I’m a Prometheus who brings You the fire, just remember to not burn someone else with it. ;)

Q: Can I use toolkit for pirating games?
A: No…

Q: Can I use it in WSL2?
A: Probably yes.

Q: Can I use it on FreeBSD?
A: I’m not familiar with BSD family. If You can use there lsblk equivalent and dmcrypt (Geli?) - only then You can port and use the scripts. However, last time when I exposed decrypted UFS2 partition, I wasn’t able to mount this filesystem (tried on GhostBSD). So it is really hard to judge for me, ask someone experienced with FreeBSD.

Special Thanks:

To all hackers who reverse engineered this shit.
To Gmipf for compiling UFS module for Ubuntu 19.10.
To Thefirebeast for test samples.
To Rj017 for test the script.

Berion
2022-09-11