NPDRM Key Dumper Payload

This PS4 payload opens /dev/npdrm and retrieves the NPDRM key via ioctl.

Description

The payload performs the following operations:

1. Initializes kernel and libc functionality
2. Jailbreaks the system to gain elevated privileges
3. Opens the /dev/npdrm device
4. Calls ioctl with command 0xC0D04401 to retrieve the NPDRM key
5. Displays the 16-byte key in a notification message
6. Closes the device and exits

Building

export PS4SDK=/path/to/ps4-payload-sdk
make

The compiled payload will be npdrm-key-dumper.bin.

Usage

1. Send the payload to your jailbroken PS4 using a payload sender
2. The payload will display a notification with the NPDRM key in hexadecimal format

Files

• source/main.c - Main payload source code
• Makefile - Build configuration
• npdrm-key-dumper.bin - Compiled payload (after build)
• rif_signer3.py - RIF resigner utility by @zecoxao

Credits

• rif_signer3.py — zecoxao

Structure

The key is retrieved into a npdrm_key_t structure:

typedef struct {
  uint8_t key[0x10];  // 16 bytes
} npdrm_key_t;

References

• PS4 Payload SDK: libPS4 library
• /dev/npdrm device interface
• Standard BSD ioctl interface