PS4 HDD reading

About image 2:
Did You mount partition after loading module? Because each other doesn't know of their existence. While You mount first, even if -rw is invoked, then is mount with -ro because kernel module loaded doesn't allow to -rw. So first, You must replace this module to be took from memory (Yours), not from kernel. So in other words: first do insmod, and only after that mounting.

About image 3:
On this image You looking at permissions from user Nemo, not root Nemo. So even if You have mount with -rw, You will not be allowed to do that (for unknown to me reason).

PS: don't change owners or permissions of existing files/folders on PS4 HDD because I don't know if this will no cause troubles (on PS3 it does).
 
I've loaded the module first as you can see in the terminal but still no luck :( @Berion
image0.jpg
 
I'll try test this with my unencrypted UFS2 dump from PS3 (because I borrowed my console) and look if this will work. However, that's not gonna happen in this week as don't have to much time.for it. Sorry. If I'll forget about it somehow, don't be shy and remind me. :P
 
Okay, take your time! Thank you for your replies, you're the only one who can help me so I'll keep waiting for your reply here in a few days :)
 
I'm not sure if the only one. :P

BTW: have You tried list modules? i.e "sudo lsmod | grep ufs" and see if it's loaded default or Yours? There wasn't any error back so it looks like it was loaded but I dunno. Just blind shot.
 
I don't think I understood what command to run to list kernel modules :/

later today I will also try to mount the PS3 hdd after loading the kernel to see if I get the same result...
 
sudo lsmod | grep ufs

You will, it is pointless. UFS2 is the same on both platforms. ;) And in case of PS3 You need also a lot of more effort to do because she have custom partition table instead to GPT, and writing data on HDD in Little Endian instead of Big Endian (or inversely, I always misleading those two...) so You must convert it on the fly by bswap16 module (in other words, following by my tutorial).
 
I would have gone as far as shipping you my hdd with its eap key so good thing ps3 hdd also has read-write problem ;)
One question, you talked about GhostBSD having UFS2 rw support... where is the problem with it? Do you suggest installing it? Will I be able to write when I mount the hdd being a BSD? Even if write speed is a bit slow, is there any other easy solution?
 
Last edited:
That will not be necessary (especially sending, raw disc image would be sufficient, however I strongly NOT recommending that because IDPS can be retrieved from it and used to unban someone's console i.e PS3 and there is risk Sony will ban it including Your user accounts on PS4). ^^ We can work fully remotely and I believe You will succeed. I just didn't test it by myself even for PS3 (only reading) so I cannot help You right now. But when I try and figure this out for PS3, it will be much easier in PS4 case. So don't worry.

Problem with it is problem inside me. I have no idea about BSD family systems. ^^ In case of PS3 the problem was lack of tools to "byte swapping" and custom partition table, which isn't a problem in case of PS4. So the only thing to figure out is how BSD mounting devices and how to use geli (imagine it as kind of cryptsetup in Linux world). At least in theory. FreeBSD fully support UFS2 so this should be the best way to approach (stable + full speed) but as I said before, I have zero knowledge about it so You will be alone on this journey. ^^ GhostBSD is judging by screens user friendly FreeBSD, which using Gnome desktop environment and it can be also launch in live session (no need of installation).
 
Don't worry about disk image I can send it for research purpose without any problem (I have more than 1 PS4 ^^) so if you find the PS3 hdd troublesome let me know :)
So all is left is to keep trying to manually enable ufs rw by recompiling kernel I guess...
I'll leave you my configuration/kernel in case you'll work on this next week when you have time ;)
The iso I'm using to live boot: https://sourceforge.net/projects/ub...cinnamonremix-19.10-all.20191204.iso/download
If you have PayPal I can make a small donation (like 20€) for the time you'll spend into this ;)
 
Yes. On Linux, loading external ufs kernel module with write permission is the only obstacle here.

Thanks. ^^
 
@Berion I am a newbie and I found your post which is very helpful. Im encountering a bigger issue and was wondering if I can contact you directly somewhere>? thanks mate
 
@lies I don't using any apps or form of communication in real time. Sorry. I'm a dinosaur. ;) Better way would be sending me just private message (however, You are unable to, until reaching some post count (probably 10 if I'm not wrong)).

The best way would be just writing here because other peoples from future will come here and maybe learn something from Your case. So don't be shy and describe this "bigger issue" (sounds promising, I like interesting case more than routine ^^). If this is somehow private stuff, well, I could send a PM to You and then probably You will be able to response - but I strongly recommending to use just forum.
 
my ps4 isn't booting anymore (happen after one KP), sadly i didn't do the eap key backup, only the database backup through the web browser exploit page, inside the backup folder UserData\user\settings there is a file named "system.eap" is this the eap key? i'm hoping that i can read the ps4 hdd and retreive my savegames and screenshots before having to reinstall the ps4 firmware
 
I never have hacked PS4 so I don't know. You can try, nothing will happen if it is not the right key. But anyway, You will not retrieve saves anyway as they are closed in PFS containers. To decrypt them on PC, You need PFS key and application which no one yet write (I doubt You can just copy and paste them as is). HDD encryption layer is just first barrier here. You should making regularly backup copies of decrypted saves when Your console was fully functional, for now it is probably to late.

But hey, I'm still interesting if this key is the EAP Key. What is Your console model?
 
If someone is curious. :D

Thanks to @Thefirebeast (big thank You for providing dumps!) I've got samples of all partitions dumps from CUH-2215B. Partitions listed by Linux from this machine were: sdx1, 2, 3, 5, 7, 9, 10, 11, 12, 13, 17, 19, 25, 27, 29, 31. All encrypted, yet some partially.

To decrypt and mount e.g 27th partition ("game partition"), use:
Code: 
sudo su
cryptsetup create -c aes-xts-plain64 -d /home/mint/ps4/eap_key.bin -s 256 -p 111669149696 ps4hdd_27 /dev/sdx27
mount -t ufs -o ufstype=ufs2,ro /dev/mapper/ps4hdd_27 /home/mint/ps4/partition_27
unmounting and removing mapper:
Code: 
umount -l /home/mint/ps4/partition_27
cryptsetup remove ps4hdd_27


What is interesting, only first sector of partition 13 can be decrypted, and without iv skipping:
Code: 
cryptsetup create -c aes-xts-plain64 -d /home/mint/ps4/eap_key.bin -s 256 ps4hdd_13 /dev/sdx13
I've tried decrypt it again and/or with skipping first two sectors (because second are zeroes) but without success. After successfully decryption this part, You should see "SONY BLAH BLAH BLAH". ;)

ps4hdd_p13_decryption.png


- - -
Based on dev wiki, I've made quick guide for those who don't like or don't have in repositories cryptmount.
 
Last edited:
Berion said:
If someone is curious. :D

Thanks to @Thefirebeast (big thank You for providing dumps!) I've got samples of all partitions dumps from CUH-2215B. Partitions listed by Linux from this machine were: sdx1, 2, 3, 5, 7, 9, 10, 11, 12, 13, 17, 19, 25, 27, 29, 31. All encrypted, yet some partially.

To decrypt and mount e.g 27th partition ("game partition"), use:
Code: 
sudo su
cryptsetup create -c aes-xts-plain64 -d /home/mint/ps4/eap_key.bin -s 256 -p 111669149696 ps4hdd_27 /dev/sdx27
mount -t ufs -o ufstype=ufs2,ro /dev/mapper/ps4hdd_27 /home/mint/ps4/partition_27
unmounting and removing mapper:
Code: 
umount -l /home/mint/ps4/partition_27
cryptsetup remove ps4hdd_27


What is interesting, only first sector of partition 13 can be decrypted, and without iv skipping:
Code: 
cryptsetup create -c aes-xts-plain64 -d /home/mint/ps4/eap_key.bin -s 256 ps4hdd_13 /dev/sdx13
I've tried decrypt it again and/or with skipping first two sectors (because second are zeroes) but without success. After successfully decryption this part, You should see "SONY BLAH BLAH BLAH". ;)

View attachment 37210

- - -
Based on dev wiki, I've made quick guide for those who don't like or don't have in repositories cryptmount.
Click to expand...




I hope you see this, I made an account just to post this lol I've been trying to follow all these messages and i have correct ubuntu installed with the ufs.ko module installed also. I was able to mount the ps4 hdd no issues using the code you posted as well as cryptmount. They give no read-only errors however I cannot copy/move anything into the hdd even as root. I tried to your code to move the test.img into the root of the hdd but it still throws the read-only file system error. I'm hoping you can help me out :)
 
@rj017 All possible to decrypt at the moment partitions (all marked as green in post no.37) should be writable (TMPFS and FAT16), while UFS2 by default only in read only mode. ufs.ko module is part of the every Linux kernel, but by default it was compiled with ro flags, that's why You need compile it by yourself but with rw flags in kernel config; after insmod it, mount and remount this partition as ufstype=ufs2,rw to gain write access. This is literally pain in the ass and was explained on many pages of PS3 HDD decryption and PS3 HDD Keygen forum pages. Later I'll look for it and link it here.

I would make tutorial for it but I don't have hacked PS4 (I have one with 8.03 fw but with dead ODD, which means not possible update to 9.00) and no one have time and will to send the image with eap key. So Prometheus cannot brings the fire. ^^ Everything You can read so far is only based on short binary samples which proves the methods valid but with barrier of working on fs logic.
 
Last edited:
Berion said:
@rj017 All possible to decrypt at the moment partitions (all marked as green in post no.37) should be writable (TMPFS and FAT16), while UFS2 by default only in read only mode. ufs.ko module is part of the every Linux kernel, but by default it was compiled with ro flags, that's why You need compile it by yourself but with rw flags in kernel config; after insmod it, mount and remount this partition as -rw to gain write access. This is literally pain in the ass and was explained on many pages of PS3 HDD decryption and PS3 HDD Keygen forum pages. Later I'll look for it and link it here.

I would make tutorial for it but I don't have hacked PS4 (I have one with 8.03 fw but with dead ODD, which means not possible update to 9.00) and no one have time and will to send the image with eap key. So Prometheus cannot brings the fire. ^^ Everything You can read so far is only based on short binary samples which proves the methods valid but with barrier of working on fs logic.
Click to expand...
Oh I see, it would be great if i could get rw to work :') This does seem like a royal pain in the ass lmao. Would it be possible for you to compile the linux kernal with rw enabled and send it to me in .iso form? I saw you and other referencing the ps3 post which is where i got the rw ufs.ko file from that one person who posted it but i guess installing ubuntu and loading that module isn't the working way haha
 
You must log in or register to reply here.
Back
Top