so, PS4 Crypto Coprocessor (CCP) interface in secure kernel had a bug that allowed us to dump (or better saying, bruteforce) key slots from SAMU,
that's how AES/HMAC keys from PFS, portability keys, VTRM keys, etc could be retrieved on unpatched firmware:
There are a few ways on PS5 to defeat HV. One of methods that I've found was related to APIC: struct apic_ops is located in RW segment of kernel data. With KRW you can overwrite a function pointer inside it like xapic_mode and get into ROP, for example (just need to bypass CFI).
I've just dumped AMD PSP ROM from 4800s Desktop Kit which shares the same APU as used in Xbox Series X (Arden, Sparkman). Now it's a time to explore. :)
Just dropped my project I've worked on for several years: github.com/flatz/pkg_pfs_… it's PS4 PKG/PFS unpacker, that can build GP4, generate all keys, etc
finally managed to get C# code working on PS4 (using JIT, non AOT) :) before this I've fixed OpenGL code that @Zer0xFF started, so it works too.. now I think that with C# and OpenGL it will be possible to create system apps that use native PS4 UI and their .net libraries as well
By the way, it's not the method that has been patched in 5.00. Actually I'm not even sure if has been patched at all, needs testing for which I don't have spare time now. Maybe someone can do it.
