ps5_extract_usb_key.py

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import hashes, hmac

# https://www.psdevwiki.com/ps4/Keys#PS4-PS5_USB_Extended_Storage_Key
KEY1 = bytes([0x72, 0x13, 0x19, 0x74, 0x52, 0xC6, 0xCC, 0x7E, 0xC8, 0xA3, 0xC0, 0x6C, 0x3E, 0x22, 0xF9, 0x1A])
KEY2 = bytes([0x76, 0x17, 0xB6, 0xE7, 0xA9, 0x73, 0x60, 0xFC, 0x4C, 0x67, 0xBF, 0x38, 0xD0, 0x7F, 0xD7, 0x2D])

def read_sector(path: str, index: int) -> bytes:
    with open(path, "rb") as f:
        f.seek(index * 0x200, 0)
        return f.read(0x200)

def decrypt_sector(sector_data: bytes, key: bytes, index: int) -> bytes:
    decryptor = Cipher(algorithms.AES(key), modes.XTS(index.to_bytes(16, byteorder='little'))).decryptor()
    return decryptor.update(sector_data) + decryptor.finalize()

def extract_key(path: str) -> bytes:
    sector0 = read_sector(path, 0)
    decrypted_sector0 = decrypt_sector(sector0, KEY1 + KEY2, 0)
    h = hmac.HMAC(KEY2 + KEY1, hashes.SHA256())
    h.update(decrypted_sector0[0x20:0x40])
    key_data = h.finalize()
    return key_data[0x10:0x20] + key_data[:0x10]

DRIVE_PATH = "/dev/sdb"

if __name__ == "__main__":
    with open("ps5_usb_key.bin", "wb") as out:
        out.write(extract_key(DRIVE_PATH))