Sony Ps5 Rom Keys Leaked – Jailbreaking Could Be Made Easier with Bootrom Codes
Key topics
The PlayStation 5's BootROM decryption keys have been leaked, sparking debate among security enthusiasts about the potential implications for jailbreaking the console. Some commenters, like peddling-brink, believe the leak could be a significant step towards understanding the official bootloader, while others, such as MuffinFlavored, caution that it's not a straightforward path to jailbreaking. The discussion reveals a nuanced understanding of the situation, with some pointing out that the leaked keys are likely used for validation rather than encryption, and others speculating about the potential consequences of Sony's inability to patch the issue. As the community digs deeper, the thread sheds light on the complexities of console security and the cat-and-mouse game between manufacturers and hackers.
Snapshot generated from the HN discussion
Discussion Activity
Very active discussionFirst comment
33m
Peak period
24
4-6h
Avg / period
7.2
Based on 93 loaded comments
Key moments
- 01Story posted
Jan 1, 2026 at 10:57 AM EST
6d ago
Step 01 - 02First comment
Jan 1, 2026 at 11:30 AM EST
33m after posting
Step 02 - 03Peak activity
24 comments in 4-6h
Hottest window of the conversation
Step 03 - 04Latest activity
Jan 2, 2026 at 7:58 PM EST
4d ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
edit:
> You still won't get a jailbroken PlayStation 5 with this leak, but it will make it easier for hackers to compromise the console's bootloader.
nope?
This would just allow further study.
If there was a breach, I'd expect keys for the PS4 to be leaked as well which would be quite handy. There are soft jailbreaks you can do currently on the PS4, but they're not full on CFW (custom firmware) and don't persist reboots.
> According to The Cybersec Guru, this is an unpatchable problem for Sony, because these keys cannot be changed and are burned directly in the APU.
I'm just speculating at this point, but what could prevent Sony from anticipating this exact situation and burning several keys in the APU? I mean, eFuse is not exactly a new technology. That way, once a key is leaked, Sony could push a firmware update switching the APU to a new key which hasn't been leaked yet.
So if v1 is signed by key A, v2 is signed by key B and invalidates key A; a console that installs v2 wouldn't be able to install v1 after, but that's not a problem for Sony.
But, I'm not sure how many companies would be able to manage their keys properly to ensure that someone with access to key A doesn't have access to key B.
So if you’ve blown 4 fuses you can’t do a patch that requires only 2 fuses to have blown, it’s a pretty wild solution.
Firmware v2 requires a switch with no more than one fuse blown and blows the first fuse.
If you install v2, you can't install v1.
Nintendo can make 22 firmware released that disallow rollback.
If your console blows a fuse before Nintendo intends to, you won't be able to install firmware until a firmware is released that will run with that number of fuses blown. And, depending on how things are implemented, you might not be able to run the firmware that you have either.
> By default, the boot ROM will only consider bootloader entries with a version field that matches the version field of the first entry, and will stop iterating through the entries is a mismatch is found. The intent is to ensure that if some subset of the bootloader entries are upgraded, and hence the version field of their entries is modified, then the boot ROM will only boot the most recent version of the bootloader. This prevents an accidental rollback to an earlier version of the bootloader in the face of boot memory read errors, corruption, or tampering. Observe that this relies on upgraded bootloader entries being placed contiguously at the start of the array.
[0] https://http.download.nvidia.com/tegra-public-appnotes/tegra...
All this is basically a fragile anti-user timebomb that will only generate more avoidable e-waste eventually.
(Although ideally they would itself trap that functionality behind a fuse, so you have to opt-in but can't be opted out.)
[0]: https://www.chromium.org/developers/design-documents/tpm-usa...
HSMs come in all sizes, from a chip in your phone (secure element) or even a dedicated part of a SoC chip, to a big box in a datacenter that can handle tons of requests per second.
The idea is having dedicated hardware to protect the private key material. This hardware can execute signing operations, so it can use the key but it can't share the key material itself. It is usually also physically hardened with techniques to extract said keys, like sidechannel attacks based on power draw, X-ray inspection, decapping etc.
This also sounds very AI-like
I don't really get why anyone would let an AI put random comments on discussions anyway but that's another story.
(I guess)
If keys are recovered using some form of low level hardware attack, as was almost surely the case here, the attacker can usually recover the unused key sets too.
If the chip manufacturing provisioning supply chain is leaky the new keys will probably be disclosed anyway, and if the key custody chain is broken (ie, keys are shared with OEMs or third parties) they will definitely be disclosed anyway.
Usually this is to allow different departments / divisions / customers (in the case of an OEM model) to all sign code or encrypt binaries, although this is likewise a bit off as each enrolled key increases the amount of material which is available to leak in the leak model. Or to allow model line differentiation with crossover.
Probably could have been avoided if Sony kept the Linux version of the Playstation still alive. Imagine what the (console) world would have looked like, if it was still alive. I never got the chance to even try it myself before it was gone, but I'm sure a lot of the homebrew community's energy could have been redirected towards it instead, hitting two flies with one swath.
The causality here is backwards; Sony removed Other OS support precisely because the first jailbreak (a glitching attack) relied on it.
IMHO, removal of this feature should have triggered Sony having to pay back the amount of taxes cheated.
On the other hand, the Ps3 clusters were around since basically the console's launch. The console had been selling at a profit by 2009.
All this happened 16 years ago. If you're curious about this stuff, you can research it online.
A company press release is not necessarily the be-all end-all full story when it comes to justifying something extremely unpopular with their customer base.
It's quite probable I read some sources that were dated or had some more nuance to it that I don't recall off the top of my head because it was 15 years ago. New information. Doesn't immediately replace old information in the minds of the entire populace - that's not how news consumption works.
I suggest you stop starting out arguments with such hostility and maybe you won't get it in response.
Also, there is no evidence that the PS3 clusters were particularly widespread. The largest single PS3 cluster I know of was the USAF 1760-machine cluster; the second largest was about 200 machines at EPFL. With 87M+ PS3s sold, that's a drop in the ocean. The PS3 just wasn't very good as a general-purpose server, and it also didn't have good interconnect at all (people struggled to even reach 100Mbit/sec on it, so it's also not a very good general HPC server); if you didn't have a problem that mapped really well to Cell, it just wasn't for you. There's no evidence any significant amount of companies bought tens of thousands of PS3s for their datacenters.
So even if Sony _did_ lose money on each sold PS3 used for servers, there simply can't have been a lot of money in all.
Only the original ones ever supported the feature.
Nobody tried to hack it, everyone assumed it was impossible. But when they removed Linux, then people tried, and it was broken very quickly.
But it was fun.
https://m.youtube.com/watch?v=cVJZYT8kYsI
> news sites are overhyping the release/leak/whatever of the rom keyseeds, saying it could be used to fully unlock the ps5. i've already stated on twitter and i'll state it again. rom and seeds alone are NOT enough to pwn a ps5, you either need fuses and nandgroups to complement it
> ... or alternatively, you need to find bugs in the rom that you can use to exploit the ps5. neither of these are easy and require immense work. also, decapping a ps5 apu to retrieve the fuses optically will prove useless to the end user because those fuses are encrypted/xored/obfuscated
I always fascinated by works of people that try to reverse engineer this secure system
- Precocity and curiosity. Access to tech, resources, ways of actually getting answers instead of just hypothesizing. Though a curious mind will always conjure theories of all sorts.
- Working on an assortment of devices. Recent, old. Take them apart, ask how do they work. Read up about how they are constructed. Repeat.
- Robotics. Dead give away because robotics means embedded and embedded knowledge is gold. As is electronics knowledge. You don’t wake up knowing how software and hardware interfaces. Along with learning this you learn a ridiculous amount regarding protocols, tools like logic analyzers and oscilloscopes, and patterns that repeat again and again.
- Free time. This one is a given. This shit takes too long and all you’ve got are hunches along the way.
Take the recent CCC presentation on Miele appliances. The young presenter practically gives the punch line away: he fixes his parents’ house appliances, he rummages forum posts looking for information. He reads data sheets of processors and knows what pin does what. He looks at what others have done and wonders “what if?”. His whole presentation was so textbook and the appliance is an early 2000s model that it’s begging for someone with a shred of curiosity to take it apart and learn how it works. He finished by successfully dumping the firmware even when he thought it couldn’t be done. Along the way his “hunches” show he knows how things work because he’s worked on it before. The only people surprised are people who haven’t done it. He was going to succeed before he began - that’s how prepared you need to be.
Now, if you’re not a super talented 12 year old, that’s okay. Start programming microcontrollers and get comfortable with reading voltage levels and signals of GPIOs and peripherals. Learn how your firmware gets loaded at startup. Build some basic protocols and confirm on a logic analyzer. Decode your work with your eyes. Reading binary and hex should be second nature. Read and decode a USB protocol. An SPI protocol. And don’t complain it’s too much work.
Ref: https://www.pcmag.com/news/japans-cyber-security-minister-do...
Once PS3 was cracked enough to run game mods, every PS3 GTA freeroam session was overrun with obnoxious cheaters, ruining it for everyone else. (Sorta like the tech industry.)
In most computer tech things, I'm all Linux, OpenWrt, Coreboot, GrapheneOS, etc., but the game console is one thing that that I like being locked down.
I simply sell my game consoles when I'm done with them.
They would make terrible Linux routers, even if they were unlocked.
Shouldn't I be allowed to repurpose it for other uses than just a console when it becomes EOL?
Yes, once hardware becomes some kind of end-of-use, end-of-support, or end-of-life (exactly what, to-be-determined), the brand should be required to unlock any aspect that hasn't already been unlocked, so that people can reuse the hardware. (And maybe put the unlocks in escrow before then, in case the brand goes out of business.)
There are also situations in which hardware should be unlocked while within use and support. But probably not for a given gaming device, or not in a way that permits that hardware be used as the gaming device while unlocked.
Gaming consoles are a very rare thing that I want locked down, as long as I am sharing whatever pool of online gamers that device accesses. (Because online gaming has way too many people who haven't yet learned to play well with others, and cheating in multiplayer games is a thing that many do.)
And the fact that I have less control and ownership of a gaming device is one of the reasons why I use a dedicated device for gaming, and also isolate it on the guest VLAN.
Although, as someone who really tries hard to fight the environmental waste (I litter pick, I donate, I reuse, I repurpose) it hurts to see to walk by a second hand tech store with stacks of old consoles in the window (excluding retro here) knowing they will just end up in a landfilled polluting the world for the rest of entirety and cannot be used for anything more than a paper weight.
This isn't just gaming consoles.
My view is that cheating is a developer problem not hardware. If game companies actually enlisted proper moderation this wouldn't be an issue. Where can I report cheaters, How do I report cheaters? That's never a provided option to me. Although maybe now you i don't game online as much as I did, but even when you could, not one thing was done about it.
I kicked hackers back in the day in my CS:S servers. If they actually hired moderators who actually did their job then this wouldn't be so much of a problem.
Your right, and I don't disagree. Knowing that the device is locked down I cannot ensure that I am not being used for monterey gain.
Isolating to a VLAN should be the de-facto but most outside of tech have no idea what that is, so now you have a lockable console prone to monitoring all for the sake of mitigation of hacking and to force you to upgrade for cash grabs.
iOS hasn't had a jailbreak since ios 15.5, or 17 if you own a iPhone 11.
Nintendo DS is now kind of EOL, so the era of Flashcarts and the likes are gone. I remeber the toothpick wrapped in tinfoil to flash a custom firmware trick and applying it to my DS.
PS3, Switch have had e-fuses which now look out the console.
Games are now protected by Denuvo which are almost impossible to crack apart from two folk, one who is slightly mental and another who only does racing games.
Even the android bootloader is being locked down to stop custom firmware.
Nasty filler to add that to the page.
General question: (I don't know enough about cryptography)
Are these symmetric keys or asymmetric ones? Both allow you to decrypt, but only the former would allow you to make changes to it, whereas the latter would still require you to find an exploit in the next stage. I think?
This also goes into a bit more detail regarding how these keys are used.
/sarcasm