ps5dbg 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- ps5dbg-0.1.0/LICENSE +26 -0
- ps5dbg-0.1.0/PKG-INFO +249 -0
- ps5dbg-0.1.0/README.md +216 -0
- ps5dbg-0.1.0/pyproject.toml +56 -0
- ps5dbg-0.1.0/setup.cfg +4 -0
- ps5dbg-0.1.0/src/ps5dbg/__init__.py +39 -0
- ps5dbg-0.1.0/src/ps5dbg/__main__.py +9 -0
- ps5dbg-0.1.0/src/ps5dbg/auth.py +109 -0
- ps5dbg-0.1.0/src/ps5dbg/cli.py +597 -0
- ps5dbg-0.1.0/src/ps5dbg/client.py +309 -0
- ps5dbg-0.1.0/src/ps5dbg/connection.py +157 -0
- ps5dbg-0.1.0/src/ps5dbg/constants.py +260 -0
- ps5dbg-0.1.0/src/ps5dbg/debugger.py +325 -0
- ps5dbg-0.1.0/src/ps5dbg/discover.py +99 -0
- ps5dbg-0.1.0/src/ps5dbg/errors.py +67 -0
- ps5dbg-0.1.0/src/ps5dbg/klog.py +65 -0
- ps5dbg-0.1.0/src/ps5dbg/models.py +180 -0
- ps5dbg-0.1.0/src/ps5dbg/protocol.py +761 -0
- ps5dbg-0.1.0/src/ps5dbg/turboscan.py +296 -0
- ps5dbg-0.1.0/src/ps5dbg/wire.py +81 -0
- ps5dbg-0.1.0/src/ps5dbg.egg-info/PKG-INFO +249 -0
- ps5dbg-0.1.0/src/ps5dbg.egg-info/SOURCES.txt +27 -0
- ps5dbg-0.1.0/src/ps5dbg.egg-info/dependency_links.txt +1 -0
- ps5dbg-0.1.0/src/ps5dbg.egg-info/entry_points.txt +2 -0
- ps5dbg-0.1.0/src/ps5dbg.egg-info/requires.txt +8 -0
- ps5dbg-0.1.0/src/ps5dbg.egg-info/top_level.txt +1 -0
- ps5dbg-0.1.0/tests/test_debugger.py +54 -0
- ps5dbg-0.1.0/tests/test_live.py +218 -0
- ps5dbg-0.1.0/tests/test_wire.py +133 -0
ps5dbg-0.1.0/LICENSE
ADDED
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
GNU GENERAL PUBLIC LICENSE
|
|
2
|
+
Version 3, 29 June 2007
|
|
3
|
+
|
|
4
|
+
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
|
5
|
+
Everyone is permitted to copy and distribute verbatim copies
|
|
6
|
+
of this license document, but changing it is not allowed.
|
|
7
|
+
|
|
8
|
+
ps5dbg is licensed under the GNU General Public License v3.0.
|
|
9
|
+
This matches the license of ps5debug-NG (OpenSourcereR-dev), whose
|
|
10
|
+
wire protocol this library implements and to which it is wire-compatible.
|
|
11
|
+
|
|
12
|
+
The full text of the GPL-3.0 is available at:
|
|
13
|
+
https://www.gnu.org/licenses/gpl-3.0.txt
|
|
14
|
+
|
|
15
|
+
A verbatim copy should accompany this file in distributions. If you need
|
|
16
|
+
the complete license text programmatically, fetch it from the URL above.
|
|
17
|
+
|
|
18
|
+
This program is free software: you can redistribute it and/or modify
|
|
19
|
+
it under the terms of the GNU General Public License as published by
|
|
20
|
+
the Free Software Foundation, either version 3 of the License, or
|
|
21
|
+
(at your option) any later version.
|
|
22
|
+
|
|
23
|
+
This program is distributed in the hope that it will be useful,
|
|
24
|
+
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
25
|
+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
26
|
+
GNU General Public License for more details.
|
ps5dbg-0.1.0/PKG-INFO
ADDED
|
@@ -0,0 +1,249 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: ps5dbg
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Cross-platform Python client and CLI for the ps5debug-NG wire protocol on jailbroken PS5 consoles.
|
|
5
|
+
Author: Darkatek7
|
|
6
|
+
License: GPL-3.0-only
|
|
7
|
+
Project-URL: Homepage, https://github.com/Darkatek7/ps5dbg
|
|
8
|
+
Project-URL: Repository, https://github.com/Darkatek7/ps5dbg
|
|
9
|
+
Project-URL: Issues, https://github.com/Darkatek7/ps5dbg/issues
|
|
10
|
+
Keywords: ps5,playstation5,ps5debug,ps5debug-ng,debugger,homebrew,jailbreak
|
|
11
|
+
Classifier: Development Status :: 3 - Alpha
|
|
12
|
+
Classifier: Intended Audience :: Developers
|
|
13
|
+
Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
|
|
14
|
+
Classifier: Operating System :: OS Independent
|
|
15
|
+
Classifier: Programming Language :: Python :: 3
|
|
16
|
+
Classifier: Programming Language :: Python :: 3 :: Only
|
|
17
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
21
|
+
Classifier: Topic :: Software Development :: Debuggers
|
|
22
|
+
Classifier: Topic :: System :: Hardware
|
|
23
|
+
Requires-Python: >=3.10
|
|
24
|
+
Description-Content-Type: text/markdown
|
|
25
|
+
License-File: LICENSE
|
|
26
|
+
Provides-Extra: dev
|
|
27
|
+
Requires-Dist: pytest>=8; extra == "dev"
|
|
28
|
+
Requires-Dist: pytest-cov; extra == "dev"
|
|
29
|
+
Provides-Extra: build
|
|
30
|
+
Requires-Dist: build; extra == "build"
|
|
31
|
+
Requires-Dist: twine; extra == "build"
|
|
32
|
+
Dynamic: license-file
|
|
33
|
+
|
|
34
|
+
# ps5dbg
|
|
35
|
+
|
|
36
|
+
> A cross-platform Python client and CLI for the **ps5debug-NG** wire protocol on jailbroken PS5 consoles. Speak to your console from any OS — build trainers, debuggers, and tooling on a clean library instead of reimplementing the protocol.
|
|
37
|
+
|
|
38
|
+
[](https://www.python.org/)
|
|
39
|
+
[](./LICENSE)
|
|
40
|
+
[](#testing)
|
|
41
|
+
[](https://github.com/OpenSourcereR-dev/ps5debug-NG/blob/main/PROTOCOL.md)
|
|
42
|
+
|
|
43
|
+
`ps5dbg` lets a developer talk to a PS5 running the [ps5debug-NG](https://github.com/OpenSourcereR-dev/ps5debug-NG) command payload (the debugger that lives in `SceShellCore` and listens on **port 744**). It implements the full v1.3.0 wire protocol — process inspection, memory scanning, kernel R/W, software & hardware breakpoints, live disassembly/assembly, and console control — and exposes it as both an importable Python library and a `ps5dbg` command-line tool.
|
|
44
|
+
|
|
45
|
+
It runs anywhere Python 3.10+ runs (Linux, macOS, Windows) with **zero runtime dependencies**.
|
|
46
|
+
|
|
47
|
+
---
|
|
48
|
+
|
|
49
|
+
## Why it exists
|
|
50
|
+
|
|
51
|
+
Every reusable client for the ps5debug/ps5debug-NG protocol today is **C# / .NET, Windows-oriented, and predates the v1.3.0 protocol additions** — the canonical reference (Ctn's `PS4DBG.cs`) has been dormant since 2023. Mac and Linux users who want to scan memory or apply trainers over this protocol have **no working open tool**.
|
|
52
|
+
|
|
53
|
+
`ps5dbg` fills that gap: a clean, tested, dependency-free Python implementation of the full v1.3.0 protocol — framing, bit-swapped status words, the xorshift-128 auth handshake, the turbo-scan family, kernel R/W, breakpoints, and the port-755 async interrupt channel. It's the foundation that makes a cross-platform scanner GUI or unified toolbox feasible later.
|
|
54
|
+
|
|
55
|
+
---
|
|
56
|
+
|
|
57
|
+
## Install
|
|
58
|
+
|
|
59
|
+
```bash
|
|
60
|
+
# when published
|
|
61
|
+
pip install ps5dbg
|
|
62
|
+
# or
|
|
63
|
+
pipx install ps5dbg
|
|
64
|
+
|
|
65
|
+
# from source (development)
|
|
66
|
+
git clone https://github.com/Darkatek7/ps5dbg.git
|
|
67
|
+
cd ps5dbg
|
|
68
|
+
pip install -e ".[dev]"
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
Requires a PS5 running [ps5debug-NG](https://github.com/OpenSourcereR-dev/ps5debug-NG) and reachable on your LAN. Set the address via `--host`/`--port` or the `PS5_HOST`/`PS5_PORT` env vars (default unset).
|
|
72
|
+
|
|
73
|
+
---
|
|
74
|
+
|
|
75
|
+
## Quick start
|
|
76
|
+
|
|
77
|
+
**CLI:**
|
|
78
|
+
```bash
|
|
79
|
+
$ ps5dbg ping
|
|
80
|
+
ps5debug-NG v1.3 (ps5debug-NG by OSR v1.3.0) FW=5.50 rtt=3ms
|
|
81
|
+
|
|
82
|
+
$ ps5dbg procs
|
|
83
|
+
PID NAME
|
|
84
|
+
0 kernel
|
|
85
|
+
1 init
|
|
86
|
+
...
|
|
87
|
+
47 SceShellCore
|
|
88
|
+
91 eboot.bin # the foreground game
|
|
89
|
+
|
|
90
|
+
$ ps5dbg read 91 0x0000004b3a8c0000 16 --hex
|
|
91
|
+
4b3a8c0000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
|
|
92
|
+
|
|
93
|
+
$ ps5dbg notify "hello from ps5dbg"
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
**Library:**
|
|
97
|
+
```python
|
|
98
|
+
from ps5dbg import PS5Debug
|
|
99
|
+
|
|
100
|
+
with PS5Debug("192.168.1.10") as ps5:
|
|
101
|
+
print(ps5.fw_version()) # 550
|
|
102
|
+
print(ps5.branding().brand) # 'ps5debug-NG by OSR v1.3.0'
|
|
103
|
+
for p in ps5.procs():
|
|
104
|
+
print(f"{p.pid:4d} {p.name}")
|
|
105
|
+
data = ps5.read(pid=91, addr=0x4b3a8c0000, length=16)
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
**Build a trainer in a few lines** (full scan API lands with v0.1):
|
|
109
|
+
```python
|
|
110
|
+
# pseudo — see examples/build_a_trainer.py once scan lands
|
|
111
|
+
with PS5Debug("192.168.1.10") as ps5:
|
|
112
|
+
fg = ps5.foreground_app()
|
|
113
|
+
hits = ps5.scan_aob(fg.pid, addr, length, pattern=b"\x01\x00\x00\x00", mask=b"\xff\xff\xff\xff")
|
|
114
|
+
ps5.write(fg.pid, hits[0], (999).to_bytes(4, "little")) # risky: needs --yes-equivalent in CLI
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
---
|
|
118
|
+
|
|
119
|
+
## Features
|
|
120
|
+
|
|
121
|
+
Full coverage of the ps5debug-NG v1.3.0 command surface:
|
|
122
|
+
|
|
123
|
+
| Area | What you can do |
|
|
124
|
+
|---|---|
|
|
125
|
+
| **Info / ping** | protocol version, firmware version, branding, platform id, liveness NOP |
|
|
126
|
+
| **Processes** | list, memory read/write (auto-chunked past 1 MiB), write-multi, VM maps, metadata (name/path/titleId/contentId), alloc/free, RPC function call (6 SysV args), ELF load (run or RPC), mprotect, foreground-app detect |
|
|
127
|
+
| **Memory scanning** | one-shot value scan, AOB + multi-AOB, iterative trio (START/COUNT/GET, auth-gated), **turbo scan family** (SIMD compare, server-resident sets, snapshot, aliasing, parallel) with capability detection + automatic fallback to the iterative trio |
|
|
128
|
+
| **Kernel** | kernel base, arbitrary kernel memory read/write |
|
|
129
|
+
| **Disasm / asm** | server-side **Zydis** region disassembly, RIP-relative xref extraction, xrefs-to-target, server-side RBP-chain stack walk, server-side **Keystone** x86-64 assembly |
|
|
130
|
+
| **Debugger** | attach/detach, up to 30 software breakpoints, up to 4 hardware watchpoints, full register access (GP/FPU+YMM/debug/FS-GS base), thread list/suspend/resume, continue/stop/step, async interrupt packets via the port-755 outbound channel |
|
|
131
|
+
| **Console** | reboot, on-screen notification, kernel-console print |
|
|
132
|
+
| **Discovery & logs** | UDP `0xFFFFAAAA` discovery to find consoles without hardcoding IPs, kernel-log tailer (port 9081) |
|
|
133
|
+
|
|
134
|
+
---
|
|
135
|
+
|
|
136
|
+
## CLI reference
|
|
137
|
+
|
|
138
|
+
```
|
|
139
|
+
ps5dbg [--host H] [--port P] [--json] SUBCOMMAND
|
|
140
|
+
|
|
141
|
+
Connection / info:
|
|
142
|
+
ping NOP round-trip + fw version
|
|
143
|
+
version protocol version + branding + fw + platform id
|
|
144
|
+
discover UDP broadcast, list responding consoles
|
|
145
|
+
klog [-f] tail kernel log (port 9081)
|
|
146
|
+
notify "<text>" on-screen toast
|
|
147
|
+
reboot (confirm required)
|
|
148
|
+
|
|
149
|
+
Process & memory:
|
|
150
|
+
procs process list
|
|
151
|
+
fg foreground app
|
|
152
|
+
info <pid> name/path/titleid/contentid
|
|
153
|
+
maps <pid> VM maps
|
|
154
|
+
read <pid> <addr> <len> [--hex|--bytes|--ascii]
|
|
155
|
+
write <pid> <addr> <hex|@file> (--yes required)
|
|
156
|
+
write-multi <pid> <addr>:<hex> ... (--yes required)
|
|
157
|
+
alloc <pid> <len>
|
|
158
|
+
free <pid> <addr> <len>
|
|
159
|
+
|
|
160
|
+
Kernel:
|
|
161
|
+
kbase kernel base address
|
|
162
|
+
kread <addr> <len>
|
|
163
|
+
kwrite <addr> <hex|@file> (--yes required)
|
|
164
|
+
|
|
165
|
+
Reverse engineering:
|
|
166
|
+
disasm <pid> <addr> <len> server-side Zydis
|
|
167
|
+
asm "<text>" [--base 0x..] server-side Keystone
|
|
168
|
+
stack <pid> [<rbp> <rsp>] server-side stack walk
|
|
169
|
+
|
|
170
|
+
Scanning:
|
|
171
|
+
scan value <pid> <addr> <len> <type> <cmp> <value>
|
|
172
|
+
scan aob <pid> <addr> <len> <pattern> [--mask ..]
|
|
173
|
+
scan start|count|get <pid> ... (iterative, auth-gated)
|
|
174
|
+
scan turbo ... (caps-detected)
|
|
175
|
+
|
|
176
|
+
Debugger:
|
|
177
|
+
dbg attach <pid>
|
|
178
|
+
dbg threads
|
|
179
|
+
dbg regs <lwpid>
|
|
180
|
+
dbg bp <index> <addr>
|
|
181
|
+
dbg wp <index> <addr> <len> <rw>
|
|
182
|
+
dbg continue|stop|step
|
|
183
|
+
dbg detach
|
|
184
|
+
```
|
|
185
|
+
|
|
186
|
+
Use `--json` on any subcommand for machine-readable output. Mutating/risky commands (`write`, `kwrite`, `reboot`, `protect`, `load_elf`, `attach`) require `--yes` or an interactive confirm.
|
|
187
|
+
|
|
188
|
+
---
|
|
189
|
+
|
|
190
|
+
## Protocol coverage
|
|
191
|
+
|
|
192
|
+
`ps5dbg` implements every opcode in the ps5debug-NG v1.3.0 table (66 commands across the info / process / debug / kernel / console namespaces). Notes on the non-obvious bits:
|
|
193
|
+
|
|
194
|
+
- **Status words are bit-swapped** on the wire (adjacent even/odd bits swapped). `CMD_SUCCESS` arrives as `0x80000000`. The library handles this internally; you compare against `ps5dbg.Status.SUCCESS`.
|
|
195
|
+
- **1 MiB max body** — `read`, `write`, and `load_elf` auto-chunk transparently.
|
|
196
|
+
- **Auth handshake** (`CMD_PROC_AUTH`) uses an xorshift-128 keystream seeded `[200,300,400,500]`; `ps5dbg` runs it for you and sets the scan-enabled bit.
|
|
197
|
+
- **Turbo scan** is capability-detected via `CMD_PROC_TURBOSCAN_CAPS` with automatic fallback to the iterative trio when the server predates it.
|
|
198
|
+
- **Debugger interrupts** arrive over a separate TCP channel (port 755, PS5 dials out) as 1184-byte packets; `ps5dbg` runs a background listener and surfaces them via callback/queue.
|
|
199
|
+
|
|
200
|
+
Full protocol notes and gotchas: see [`docs/protocol_notes.md`](./docs/protocol_notes.md) and the upstream [`PROTOCOL.md`](https://github.com/OpenSourcereR-dev/ps5debug-NG/blob/main/PROTOCOL.md).
|
|
201
|
+
|
|
202
|
+
---
|
|
203
|
+
|
|
204
|
+
## Requirements & compatibility
|
|
205
|
+
|
|
206
|
+
- **Python** 3.10 or newer. No runtime dependencies.
|
|
207
|
+
- **OS** any (Linux / macOS / Windows).
|
|
208
|
+
- **Console** any PS5 running ps5debug-NG v1.x (the library targets v1.3.0). Verified against FW 5.50.
|
|
209
|
+
|
|
210
|
+
---
|
|
211
|
+
|
|
212
|
+
## Roadmap
|
|
213
|
+
|
|
214
|
+
- **v0.1** — full protocol coverage ✅ (this release: all 66 opcodes across info/process/scan+turbo/kernel/disasm/asm/debugger/console/discovery/klog)
|
|
215
|
+
- **v0.2** — memory-scanner GUI on top of `ps5dbg` (cross-platform "Cheat Engine for PS5")
|
|
216
|
+
- **v0.3** — unified PC toolbox (klog tail + elfldr deploy + ps5dbg control + PKG install + console discovery in one app)
|
|
217
|
+
|
|
218
|
+
Contributions welcome — see [`AGENTS.md`](./AGENTS.md) for architecture and conventions.
|
|
219
|
+
|
|
220
|
+
## Testing
|
|
221
|
+
|
|
222
|
+
```
|
|
223
|
+
pytest # unit tests (anywhere; no PS5 needed)
|
|
224
|
+
pytest -m live # + live tests against PS5_HOST (default unset; set PS5_HOST)
|
|
225
|
+
pytest -m live --risky --yes # + risky live tests (notify, debug attach) — be prepared to reboot
|
|
226
|
+
```
|
|
227
|
+
|
|
228
|
+
Unit tests cover: bitswap involution, status-code mapping, framing layout,
|
|
229
|
+
opcode top-byte, interrupt-packet parsing, GP-register indexing. Live tests
|
|
230
|
+
exercise the real console on safe ops (ping, version, procs, maps, read,
|
|
231
|
+
kern_base, AOB scan, turbo scan resident round-trip). No test ever reboots the
|
|
232
|
+
console. The debug-attach test is gated behind `--risky` because attaching to
|
|
233
|
+
SceShellCore can freeze the system UI.
|
|
234
|
+
|
|
235
|
+
See [`examples/`](./examples) for `read_game_memory.py`, `build_a_trainer.py`,
|
|
236
|
+
and `watch_foreground.py`.
|
|
237
|
+
|
|
238
|
+
---
|
|
239
|
+
|
|
240
|
+
## Acknowledgments
|
|
241
|
+
|
|
242
|
+
- **[OpenSourcereR-dev/ps5debug-NG](https://github.com/OpenSourcereR-dev/ps5debug-NG)** — the debugger payload and the definitive `PROTOCOL.md` this library implements.
|
|
243
|
+
- **Ctn** — the original `ps5debug`, whose wire protocol ps5debug-NG extends and which this library remains compatible with.
|
|
244
|
+
- **[ps5-payload-dev](https://github.com/ps5-payload-dev)** — the SDK and payload ecosystem that made PS5 homebrew possible.
|
|
245
|
+
- **[etaHEN](https://github.com/etaHEN/etaHEN)** — the HEN chain that loads the debugger.
|
|
246
|
+
|
|
247
|
+
## License
|
|
248
|
+
|
|
249
|
+
[GPL-3.0-only](./LICENSE) — matching ps5debug-NG, whose wire protocol this library implements.
|
ps5dbg-0.1.0/README.md
ADDED
|
@@ -0,0 +1,216 @@
|
|
|
1
|
+
# ps5dbg
|
|
2
|
+
|
|
3
|
+
> A cross-platform Python client and CLI for the **ps5debug-NG** wire protocol on jailbroken PS5 consoles. Speak to your console from any OS — build trainers, debuggers, and tooling on a clean library instead of reimplementing the protocol.
|
|
4
|
+
|
|
5
|
+
[](https://www.python.org/)
|
|
6
|
+
[](./LICENSE)
|
|
7
|
+
[](#testing)
|
|
8
|
+
[](https://github.com/OpenSourcereR-dev/ps5debug-NG/blob/main/PROTOCOL.md)
|
|
9
|
+
|
|
10
|
+
`ps5dbg` lets a developer talk to a PS5 running the [ps5debug-NG](https://github.com/OpenSourcereR-dev/ps5debug-NG) command payload (the debugger that lives in `SceShellCore` and listens on **port 744**). It implements the full v1.3.0 wire protocol — process inspection, memory scanning, kernel R/W, software & hardware breakpoints, live disassembly/assembly, and console control — and exposes it as both an importable Python library and a `ps5dbg` command-line tool.
|
|
11
|
+
|
|
12
|
+
It runs anywhere Python 3.10+ runs (Linux, macOS, Windows) with **zero runtime dependencies**.
|
|
13
|
+
|
|
14
|
+
---
|
|
15
|
+
|
|
16
|
+
## Why it exists
|
|
17
|
+
|
|
18
|
+
Every reusable client for the ps5debug/ps5debug-NG protocol today is **C# / .NET, Windows-oriented, and predates the v1.3.0 protocol additions** — the canonical reference (Ctn's `PS4DBG.cs`) has been dormant since 2023. Mac and Linux users who want to scan memory or apply trainers over this protocol have **no working open tool**.
|
|
19
|
+
|
|
20
|
+
`ps5dbg` fills that gap: a clean, tested, dependency-free Python implementation of the full v1.3.0 protocol — framing, bit-swapped status words, the xorshift-128 auth handshake, the turbo-scan family, kernel R/W, breakpoints, and the port-755 async interrupt channel. It's the foundation that makes a cross-platform scanner GUI or unified toolbox feasible later.
|
|
21
|
+
|
|
22
|
+
---
|
|
23
|
+
|
|
24
|
+
## Install
|
|
25
|
+
|
|
26
|
+
```bash
|
|
27
|
+
# when published
|
|
28
|
+
pip install ps5dbg
|
|
29
|
+
# or
|
|
30
|
+
pipx install ps5dbg
|
|
31
|
+
|
|
32
|
+
# from source (development)
|
|
33
|
+
git clone https://github.com/Darkatek7/ps5dbg.git
|
|
34
|
+
cd ps5dbg
|
|
35
|
+
pip install -e ".[dev]"
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
Requires a PS5 running [ps5debug-NG](https://github.com/OpenSourcereR-dev/ps5debug-NG) and reachable on your LAN. Set the address via `--host`/`--port` or the `PS5_HOST`/`PS5_PORT` env vars (default unset).
|
|
39
|
+
|
|
40
|
+
---
|
|
41
|
+
|
|
42
|
+
## Quick start
|
|
43
|
+
|
|
44
|
+
**CLI:**
|
|
45
|
+
```bash
|
|
46
|
+
$ ps5dbg ping
|
|
47
|
+
ps5debug-NG v1.3 (ps5debug-NG by OSR v1.3.0) FW=5.50 rtt=3ms
|
|
48
|
+
|
|
49
|
+
$ ps5dbg procs
|
|
50
|
+
PID NAME
|
|
51
|
+
0 kernel
|
|
52
|
+
1 init
|
|
53
|
+
...
|
|
54
|
+
47 SceShellCore
|
|
55
|
+
91 eboot.bin # the foreground game
|
|
56
|
+
|
|
57
|
+
$ ps5dbg read 91 0x0000004b3a8c0000 16 --hex
|
|
58
|
+
4b3a8c0000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
|
|
59
|
+
|
|
60
|
+
$ ps5dbg notify "hello from ps5dbg"
|
|
61
|
+
```
|
|
62
|
+
|
|
63
|
+
**Library:**
|
|
64
|
+
```python
|
|
65
|
+
from ps5dbg import PS5Debug
|
|
66
|
+
|
|
67
|
+
with PS5Debug("192.168.1.10") as ps5:
|
|
68
|
+
print(ps5.fw_version()) # 550
|
|
69
|
+
print(ps5.branding().brand) # 'ps5debug-NG by OSR v1.3.0'
|
|
70
|
+
for p in ps5.procs():
|
|
71
|
+
print(f"{p.pid:4d} {p.name}")
|
|
72
|
+
data = ps5.read(pid=91, addr=0x4b3a8c0000, length=16)
|
|
73
|
+
```
|
|
74
|
+
|
|
75
|
+
**Build a trainer in a few lines** (full scan API lands with v0.1):
|
|
76
|
+
```python
|
|
77
|
+
# pseudo — see examples/build_a_trainer.py once scan lands
|
|
78
|
+
with PS5Debug("192.168.1.10") as ps5:
|
|
79
|
+
fg = ps5.foreground_app()
|
|
80
|
+
hits = ps5.scan_aob(fg.pid, addr, length, pattern=b"\x01\x00\x00\x00", mask=b"\xff\xff\xff\xff")
|
|
81
|
+
ps5.write(fg.pid, hits[0], (999).to_bytes(4, "little")) # risky: needs --yes-equivalent in CLI
|
|
82
|
+
```
|
|
83
|
+
|
|
84
|
+
---
|
|
85
|
+
|
|
86
|
+
## Features
|
|
87
|
+
|
|
88
|
+
Full coverage of the ps5debug-NG v1.3.0 command surface:
|
|
89
|
+
|
|
90
|
+
| Area | What you can do |
|
|
91
|
+
|---|---|
|
|
92
|
+
| **Info / ping** | protocol version, firmware version, branding, platform id, liveness NOP |
|
|
93
|
+
| **Processes** | list, memory read/write (auto-chunked past 1 MiB), write-multi, VM maps, metadata (name/path/titleId/contentId), alloc/free, RPC function call (6 SysV args), ELF load (run or RPC), mprotect, foreground-app detect |
|
|
94
|
+
| **Memory scanning** | one-shot value scan, AOB + multi-AOB, iterative trio (START/COUNT/GET, auth-gated), **turbo scan family** (SIMD compare, server-resident sets, snapshot, aliasing, parallel) with capability detection + automatic fallback to the iterative trio |
|
|
95
|
+
| **Kernel** | kernel base, arbitrary kernel memory read/write |
|
|
96
|
+
| **Disasm / asm** | server-side **Zydis** region disassembly, RIP-relative xref extraction, xrefs-to-target, server-side RBP-chain stack walk, server-side **Keystone** x86-64 assembly |
|
|
97
|
+
| **Debugger** | attach/detach, up to 30 software breakpoints, up to 4 hardware watchpoints, full register access (GP/FPU+YMM/debug/FS-GS base), thread list/suspend/resume, continue/stop/step, async interrupt packets via the port-755 outbound channel |
|
|
98
|
+
| **Console** | reboot, on-screen notification, kernel-console print |
|
|
99
|
+
| **Discovery & logs** | UDP `0xFFFFAAAA` discovery to find consoles without hardcoding IPs, kernel-log tailer (port 9081) |
|
|
100
|
+
|
|
101
|
+
---
|
|
102
|
+
|
|
103
|
+
## CLI reference
|
|
104
|
+
|
|
105
|
+
```
|
|
106
|
+
ps5dbg [--host H] [--port P] [--json] SUBCOMMAND
|
|
107
|
+
|
|
108
|
+
Connection / info:
|
|
109
|
+
ping NOP round-trip + fw version
|
|
110
|
+
version protocol version + branding + fw + platform id
|
|
111
|
+
discover UDP broadcast, list responding consoles
|
|
112
|
+
klog [-f] tail kernel log (port 9081)
|
|
113
|
+
notify "<text>" on-screen toast
|
|
114
|
+
reboot (confirm required)
|
|
115
|
+
|
|
116
|
+
Process & memory:
|
|
117
|
+
procs process list
|
|
118
|
+
fg foreground app
|
|
119
|
+
info <pid> name/path/titleid/contentid
|
|
120
|
+
maps <pid> VM maps
|
|
121
|
+
read <pid> <addr> <len> [--hex|--bytes|--ascii]
|
|
122
|
+
write <pid> <addr> <hex|@file> (--yes required)
|
|
123
|
+
write-multi <pid> <addr>:<hex> ... (--yes required)
|
|
124
|
+
alloc <pid> <len>
|
|
125
|
+
free <pid> <addr> <len>
|
|
126
|
+
|
|
127
|
+
Kernel:
|
|
128
|
+
kbase kernel base address
|
|
129
|
+
kread <addr> <len>
|
|
130
|
+
kwrite <addr> <hex|@file> (--yes required)
|
|
131
|
+
|
|
132
|
+
Reverse engineering:
|
|
133
|
+
disasm <pid> <addr> <len> server-side Zydis
|
|
134
|
+
asm "<text>" [--base 0x..] server-side Keystone
|
|
135
|
+
stack <pid> [<rbp> <rsp>] server-side stack walk
|
|
136
|
+
|
|
137
|
+
Scanning:
|
|
138
|
+
scan value <pid> <addr> <len> <type> <cmp> <value>
|
|
139
|
+
scan aob <pid> <addr> <len> <pattern> [--mask ..]
|
|
140
|
+
scan start|count|get <pid> ... (iterative, auth-gated)
|
|
141
|
+
scan turbo ... (caps-detected)
|
|
142
|
+
|
|
143
|
+
Debugger:
|
|
144
|
+
dbg attach <pid>
|
|
145
|
+
dbg threads
|
|
146
|
+
dbg regs <lwpid>
|
|
147
|
+
dbg bp <index> <addr>
|
|
148
|
+
dbg wp <index> <addr> <len> <rw>
|
|
149
|
+
dbg continue|stop|step
|
|
150
|
+
dbg detach
|
|
151
|
+
```
|
|
152
|
+
|
|
153
|
+
Use `--json` on any subcommand for machine-readable output. Mutating/risky commands (`write`, `kwrite`, `reboot`, `protect`, `load_elf`, `attach`) require `--yes` or an interactive confirm.
|
|
154
|
+
|
|
155
|
+
---
|
|
156
|
+
|
|
157
|
+
## Protocol coverage
|
|
158
|
+
|
|
159
|
+
`ps5dbg` implements every opcode in the ps5debug-NG v1.3.0 table (66 commands across the info / process / debug / kernel / console namespaces). Notes on the non-obvious bits:
|
|
160
|
+
|
|
161
|
+
- **Status words are bit-swapped** on the wire (adjacent even/odd bits swapped). `CMD_SUCCESS` arrives as `0x80000000`. The library handles this internally; you compare against `ps5dbg.Status.SUCCESS`.
|
|
162
|
+
- **1 MiB max body** — `read`, `write`, and `load_elf` auto-chunk transparently.
|
|
163
|
+
- **Auth handshake** (`CMD_PROC_AUTH`) uses an xorshift-128 keystream seeded `[200,300,400,500]`; `ps5dbg` runs it for you and sets the scan-enabled bit.
|
|
164
|
+
- **Turbo scan** is capability-detected via `CMD_PROC_TURBOSCAN_CAPS` with automatic fallback to the iterative trio when the server predates it.
|
|
165
|
+
- **Debugger interrupts** arrive over a separate TCP channel (port 755, PS5 dials out) as 1184-byte packets; `ps5dbg` runs a background listener and surfaces them via callback/queue.
|
|
166
|
+
|
|
167
|
+
Full protocol notes and gotchas: see [`docs/protocol_notes.md`](./docs/protocol_notes.md) and the upstream [`PROTOCOL.md`](https://github.com/OpenSourcereR-dev/ps5debug-NG/blob/main/PROTOCOL.md).
|
|
168
|
+
|
|
169
|
+
---
|
|
170
|
+
|
|
171
|
+
## Requirements & compatibility
|
|
172
|
+
|
|
173
|
+
- **Python** 3.10 or newer. No runtime dependencies.
|
|
174
|
+
- **OS** any (Linux / macOS / Windows).
|
|
175
|
+
- **Console** any PS5 running ps5debug-NG v1.x (the library targets v1.3.0). Verified against FW 5.50.
|
|
176
|
+
|
|
177
|
+
---
|
|
178
|
+
|
|
179
|
+
## Roadmap
|
|
180
|
+
|
|
181
|
+
- **v0.1** — full protocol coverage ✅ (this release: all 66 opcodes across info/process/scan+turbo/kernel/disasm/asm/debugger/console/discovery/klog)
|
|
182
|
+
- **v0.2** — memory-scanner GUI on top of `ps5dbg` (cross-platform "Cheat Engine for PS5")
|
|
183
|
+
- **v0.3** — unified PC toolbox (klog tail + elfldr deploy + ps5dbg control + PKG install + console discovery in one app)
|
|
184
|
+
|
|
185
|
+
Contributions welcome — see [`AGENTS.md`](./AGENTS.md) for architecture and conventions.
|
|
186
|
+
|
|
187
|
+
## Testing
|
|
188
|
+
|
|
189
|
+
```
|
|
190
|
+
pytest # unit tests (anywhere; no PS5 needed)
|
|
191
|
+
pytest -m live # + live tests against PS5_HOST (default unset; set PS5_HOST)
|
|
192
|
+
pytest -m live --risky --yes # + risky live tests (notify, debug attach) — be prepared to reboot
|
|
193
|
+
```
|
|
194
|
+
|
|
195
|
+
Unit tests cover: bitswap involution, status-code mapping, framing layout,
|
|
196
|
+
opcode top-byte, interrupt-packet parsing, GP-register indexing. Live tests
|
|
197
|
+
exercise the real console on safe ops (ping, version, procs, maps, read,
|
|
198
|
+
kern_base, AOB scan, turbo scan resident round-trip). No test ever reboots the
|
|
199
|
+
console. The debug-attach test is gated behind `--risky` because attaching to
|
|
200
|
+
SceShellCore can freeze the system UI.
|
|
201
|
+
|
|
202
|
+
See [`examples/`](./examples) for `read_game_memory.py`, `build_a_trainer.py`,
|
|
203
|
+
and `watch_foreground.py`.
|
|
204
|
+
|
|
205
|
+
---
|
|
206
|
+
|
|
207
|
+
## Acknowledgments
|
|
208
|
+
|
|
209
|
+
- **[OpenSourcereR-dev/ps5debug-NG](https://github.com/OpenSourcereR-dev/ps5debug-NG)** — the debugger payload and the definitive `PROTOCOL.md` this library implements.
|
|
210
|
+
- **Ctn** — the original `ps5debug`, whose wire protocol ps5debug-NG extends and which this library remains compatible with.
|
|
211
|
+
- **[ps5-payload-dev](https://github.com/ps5-payload-dev)** — the SDK and payload ecosystem that made PS5 homebrew possible.
|
|
212
|
+
- **[etaHEN](https://github.com/etaHEN/etaHEN)** — the HEN chain that loads the debugger.
|
|
213
|
+
|
|
214
|
+
## License
|
|
215
|
+
|
|
216
|
+
[GPL-3.0-only](./LICENSE) — matching ps5debug-NG, whose wire protocol this library implements.
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=68", "wheel"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "ps5dbg"
|
|
7
|
+
version = "0.1.0"
|
|
8
|
+
description = "Cross-platform Python client and CLI for the ps5debug-NG wire protocol on jailbroken PS5 consoles."
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
requires-python = ">=3.10"
|
|
11
|
+
license = { text = "GPL-3.0-only" }
|
|
12
|
+
authors = [{ name = "Darkatek7" }]
|
|
13
|
+
keywords = ["ps5", "playstation5", "ps5debug", "ps5debug-ng", "debugger", "homebrew", "jailbreak"]
|
|
14
|
+
classifiers = [
|
|
15
|
+
"Development Status :: 3 - Alpha",
|
|
16
|
+
"Intended Audience :: Developers",
|
|
17
|
+
"License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
|
|
18
|
+
"Operating System :: OS Independent",
|
|
19
|
+
"Programming Language :: Python :: 3",
|
|
20
|
+
"Programming Language :: Python :: 3 :: Only",
|
|
21
|
+
"Programming Language :: Python :: 3.10",
|
|
22
|
+
"Programming Language :: Python :: 3.11",
|
|
23
|
+
"Programming Language :: Python :: 3.12",
|
|
24
|
+
"Programming Language :: Python :: 3.13",
|
|
25
|
+
"Topic :: Software Development :: Debuggers",
|
|
26
|
+
"Topic :: System :: Hardware",
|
|
27
|
+
]
|
|
28
|
+
dependencies = []
|
|
29
|
+
|
|
30
|
+
[project.optional-dependencies]
|
|
31
|
+
dev = [
|
|
32
|
+
"pytest>=8",
|
|
33
|
+
"pytest-cov",
|
|
34
|
+
]
|
|
35
|
+
build = [
|
|
36
|
+
"build",
|
|
37
|
+
"twine",
|
|
38
|
+
]
|
|
39
|
+
|
|
40
|
+
[project.scripts]
|
|
41
|
+
ps5dbg = "ps5dbg.cli:main"
|
|
42
|
+
|
|
43
|
+
[project.urls]
|
|
44
|
+
Homepage = "https://github.com/Darkatek7/ps5dbg"
|
|
45
|
+
Repository = "https://github.com/Darkatek7/ps5dbg"
|
|
46
|
+
Issues = "https://github.com/Darkatek7/ps5dbg/issues"
|
|
47
|
+
|
|
48
|
+
[tool.setuptools.packages.find]
|
|
49
|
+
where = ["src"]
|
|
50
|
+
|
|
51
|
+
[tool.pytest.ini_options]
|
|
52
|
+
testpaths = ["tests"]
|
|
53
|
+
markers = [
|
|
54
|
+
"live: tests that require a reachable PS5 at PS5_HOST:PS5_PORT (default unset; set PS5_HOST)",
|
|
55
|
+
"risky: live tests that mutate target/kernel state (need --risky to run)",
|
|
56
|
+
]
|
ps5dbg-0.1.0/setup.cfg
ADDED
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
"""ps5dbg — cross-platform Python client + CLI for the ps5debug-NG wire protocol.
|
|
2
|
+
|
|
3
|
+
Public API:
|
|
4
|
+
|
|
5
|
+
from ps5dbg import PS5Debug
|
|
6
|
+
|
|
7
|
+
with PS5Debug("192.168.1.10") as ps5: # your PS5's LAN IP
|
|
8
|
+
print(ps5.fw_version()) # -> 550
|
|
9
|
+
for p in ps5.procs():
|
|
10
|
+
print(p.pid, p.name)
|
|
11
|
+
|
|
12
|
+
Host resolution: pass host= explicitly, OR set the PS5_HOST env var (then
|
|
13
|
+
PS5Debug() with no argument uses it).
|
|
14
|
+
"""
|
|
15
|
+
from __future__ import annotations
|
|
16
|
+
|
|
17
|
+
from .client import PS5Debug
|
|
18
|
+
from .errors import (
|
|
19
|
+
AlreadyAttached,
|
|
20
|
+
AuthFailed,
|
|
21
|
+
BadStatus,
|
|
22
|
+
ConnectionLost,
|
|
23
|
+
PS5DbgError,
|
|
24
|
+
ProtocolError,
|
|
25
|
+
ScanAuthRequired,
|
|
26
|
+
)
|
|
27
|
+
|
|
28
|
+
__version__ = "0.1.0"
|
|
29
|
+
__all__ = [
|
|
30
|
+
"PS5Debug",
|
|
31
|
+
"PS5DbgError",
|
|
32
|
+
"ConnectionLost",
|
|
33
|
+
"ProtocolError",
|
|
34
|
+
"BadStatus",
|
|
35
|
+
"AuthFailed",
|
|
36
|
+
"ScanAuthRequired",
|
|
37
|
+
"AlreadyAttached",
|
|
38
|
+
"__version__",
|
|
39
|
+
]
|