Key discovery procedure

[rzsn]

How can one recover the device encryption key or a the whole new crypto scheme for currently unsupported devices?
(e.g. for the ILCE-7SM3 / ILME-FX3)

Using the gen4 algo - AesCbcCrypter - I can see the FDAT header in plaintext (still the old aes-128-ecb), but the following updater image with compressed romfs that would start at offset 512 turns out as garbage.