Playstation Update Package (PUP)

Description

PUP (Playstation Update Package) files are packages which contain the files used to update a PSP or PS3 system. There are 2 different types: patches (PS3PATCH.PUP) and full updates (PS3UPDAT.PUP). Based on the model, there are 4 different release types: Retail/CEX, Shop/SEX, Debug/DEX and Tool/DECR. Within the Retail/CEX there are 2 file versions: 1 is a PUP with a normal file length which also gets released online. The other PUP file version is the same, except it is zero-filled after the normal PUP content to a fixed filelength of 256MB, which gets released on Gamedisks (if gamecreators build their project to a premaster and give it to Sony for signing, they just use a placeholder of a 256MB PS3UPDAT.PUP which contains no firmwaredata at all - it is completely zerofilled. Sony decides the firmware that gets on the disk and for which firmware the 'Gold' code is signed and mastered).

Location

PS Vita

The PS Vita and PS Vita TV OS can install the update as /PSP2/UPDATE/PSP2UPDAT.PUP or as /PSVITA/UPDATE/PSVUPDAT.PUP.

The update comes from:

http://djp01.psv.update.playstation.net/update/psv/image/image/<YYYY_MMDD>/pre_<md5>/PSVUPDAT.PUP

It is only used by sony on the website. That's why there is no update list on that server.

Download

PUP Download Repositories

Links:

• https://darthsternie.net/index.php/ps-vita-firmwares/
• https://darksoftware.xyz/VITA/FWList

Types

PS3

To document.

PS Vita

PUP contains updates for different partitions of the system. Most packages, once decrypted, decompressed and pieced together are a raw disk image for the partition to update. Sometimes, a TAR archive patch is also used along with the disk images but not as often. Sony usually releases three kinds of update files, each to update different components: release, systemdata and preinstall.

There are different types of PS Vita .PUP files:

release - full - rel

Release PUPs update most partitions. This contains the actual system files. The main components are os0, vs0, and the bootloader partition.

systemdata - sd

Systemdata PUPs only update the sa0 partition. It is likely separated from the main update due to it not regularly needing updates and size concerns.

preinstall - preinst

Preinstall PUPs only update the pd0 partition. This is the Welcome Park application and the initial setup movie. It is likely separated from the main update due to it not regularly needing updates and size concerns.

com

Unknown. Maybe stands for Common or for Communication in the case it would target COM PS Vita i.e. PS Vita that have a 3G Modem.

modeldiff

Unknown. Stands for Model Differences.

Revisions

PS Vita

See [1].

Update List

PS3

There is no regioning in the .PUP files i.e. they are the same for all different regions (if you were looking for regioninfo, see here). The PS3 however gets the ps3-updatelist.txt from different servers, depending on the region of that model (last 2 numbers in the CECHxxXX SKU name).

• Japan, jp (00 > 0x83)
• USA, us (01 > 0x84)
• Europe, eu (04 > 0x85)
• Korea, kr (05 > 0x86)
• United Kingdom, uk (03 > 0x87)
• Mexico, mx (11 > 0x88)
• Australia/New Zealand, au (02 > 0x89)
• South Asia, sa (Asia except China, Japan, Korea and Taiwan) (06 > 0x8A)
• Taiwan, tw (07 > 0x8B)
• Russia, ru (08 > 0x8C)
• China, cn (09 > 0x8D)
• Hong Kong, hk (10 > 0x8D)
• Brasil, br (11 > 0x8F)

For completeness, see Product Code: Reference Tool/DECR : 0x81, Debug/DEX : 0x82, and Arcade : 0xA0

Retail basic structure of the update URL:

  http://d<TLD>01.ps3.update.playstation.net/update/ps3/image/<TLD>/YYYY_MMDD_md5/PS3UPDAT.PUP
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 32-digits long HASH)

Shop update check URL: http://fshop01.ps3.update.playstation.net/update/ps3/list/shop/ps3-updatelist.txt

Content:

 # JP(shop)
 Dest=83;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=83;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://djp01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # US(shop)
 Dest=84;CompatibleSystemSoftwareVersion=4.7600-;
  Dest=84;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dus01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # EU(shop)
 Dest=85;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=85;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://deu01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # KR(shop)
 Dest=86;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=86;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dkr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # UK(shop)
 Dest=87;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=87;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://duk01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # MX(shop)
 Dest=88;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=88;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dmx01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # AU/NZ(shop)
 Dest=89;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=89;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dau01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # SouthAsia(shop)
 Dest=8A;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=8A;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dsa01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # TW(shop)
 Dest=8B;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=8B;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dtw01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # RU(shop)
 Dest=8C;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=8C;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dru01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # CN(shop)
 Dest=8D;ImageVersion=00000000;SystemSoftwareVersion=0.0000;CDN=http://dcn01.ps3.update.playstation.net/update/ps3/image/shop/nodata;CDN_Timeout=30;
 # BR(shop)
 Dest=8F;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=8F;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dbr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;

Shop basic structure of the update URL:

  http://d<TLD>01.ps3.update.playstation.net/update/ps3/image/shop/YYYY_MMDD_md5/PS3UPDAT.PUP
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 22-digits long HASH)

PS Vita

Like on PS3, there is no regioning in the .PUP files: they are the same for all different regions. However, the PS Vita gets the psp2-updatelist.xml from different servers, depending on the region of that model.

On retail (CEX) consoles, when you check for updates via WiFi in settings the console will download an XML file based on the console's region code. For example on PS Vitas sold within the United States the URL for the XML file is http://fus01.psp2.update.playstation.net/update/psp2/list/us/psp2-updatelist.xml.

When this file is read by the system, the region id MUST match the system region.

Possible regions are: jp, us, au, uk, eu, kr, sa, tw, ru, mx, cn and on devkit you must use the region id 257 and 258 for testkit's.

The file must be no larger than 65535 bytes, and the URL's specifying where to download the .PUP from can be no longer than 1024 characters, it also must be a direct URL to the content *including "http://" protocol*.

When selecting "Update via connecting to PC", the console connects to Content Manager Assistant installed on a PC and then CMA downloads the psp2-updatelist.xml file and the PUP files from PC side and sends it back to the PS Vita. Because of this, by using a custom Content Manager Assistant such as QCMA, you can send whatever psp2-updatelist.xml you want to the PS Vita. This is also what happens with "Update via connecting to PS3".

On PS Vita DevKit and TestKit, you can configure your own URL for the psp2-updatelist.xml file in Debug Settings > System Update and this setting can be overridden by placing a file at ux0:/PSP2/UPDATE/SERVER_URL.TXT or host0:/PSP2/UPDATE/SERVER_URL.TXT.

Retail:

• Japan (jp)
• USA (us)
• Europe (eu)

11 jan 2012 :: full 01.520.000 + systemdata 01.000.010 + preinst 01.000.000:

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.520.000" level1_system_version="01.520.000" level2_system_version="01.520.000"/>
    <version system_version="01.520.000" label="01.520">
      <update_data update_type="full">
        <image size="94646272">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/rel_01a72de4dd90191f679f648da8d11a48/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/sd_d48c3a2ca8963ffc7ac01c73e873809c/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/pre_5899e51b24eb4ab2c985df08bf6c901b/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

22 dec 2011 :: full 01.510.000 + systemdata 01.000.010 + preinst 01.000.000:

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.510.000" level1_system_version="01.510.000" level2_system_version="01.510.000"/>
    <version system_version="01.510.000" label="01.510">
      <update_data update_type="full">
        <image size="94500352">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/rel_48ac631ecae3837a7530506de0d73eaf/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/sd_52ff6b714e5f701d15938a6fee68fb66/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/pre_a18a91bb8c86f8c1a101d19fcb15fb6d/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

14 dec 2011 :: full 01.500.000 + systemdata 01.000.010 + preinst 01.000.000:

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.500.000" level1_system_version="01.500.000" level2_system_version="01.500.000"/>
    <version system_version="01.500.000" label="01.500">
      <update_data update_type="full">
        <image size="94496256">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/rel_f090a69bcf392b5c311b9e786c5cc0b5/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/sd_484243f3964158b38ad1adaac0332a3e/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/pre_24b5601c3b3aa63b51cf5eaeab718a4c/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

Shop:

• shop
• Japan (jp)
• USA (us)
• Europe (eu)

<update_data_list>
  <region id="shop">
    <np level0_system_version="00.000.000" level1_system_version="00.000.000" level2_system_version="00.000.000"/>
    <version system_version="00.000.000">
      <update_data update_type="full">
        <image>NA</image>
      </update_data>
    </version>
  </region>
</update_data_list>

Retail basic structure of the update URL:

http://d<TLD>01.psp2.update.playstation.net/update/psp2/image/<YYYY_MMDD>/pre_<md5>/PSP2UPDAT.PUP?dest=<TLD>
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, md5 is 22-digits long HASH)

<?xml version="1.0" encoding="UTF-8"?>
<update_data_list>
  <region id="au">
    <np level0_system_version="01.600.000" level1_system_version="03.610.000" level2_system_version="03.610.000" map="03.610.000"/>
    <np_d level0_system_version="01.600.000" level1_system_version="03.610.000" level2_system_version="03.610.000" map="03.610.000"/>
      <version system_version="03.610.000" label="3.61">
        <update_data update_type="full">
          <image size="133676544">http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/rel_99d9ab3e57a677b38e42cc6409b95e3b/PSP2UPDAT.PUP?dest=au</image>
        </update_data>
      </version>
      <recovery spkg_type="systemdata">
        <image spkg_version="01.000.010" size="56768512">http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/sd_80cefcda06707796a040648aea38da0f/PSP2UPDAT.PUP?dest=au</image>
      </recovery>
      <recovery spkg_type="preinst">
        <image spkg_version="01.000.000" size="128788480">http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/pre_f5e6da7d1213101482300ccaeda35c3c/PSP2UPDAT.PUP?dest=au</image>
      </recovery>
  </region>
</update_data_list>

PS Vita PUP links use the same structure as PS3 PUP links:

http://d<TLD>01.ps4.update.playstation.net/update/ps4/image/<YYYY_MMDD>/<TYPE>_<MD5>/PS4UPDATE.PUP?dest=<TLD>

• <TLD>=2 letter region abbreviation (jp, us, ..)
• <YYYY_MMDD> is build date
• TYPE is PUP type (rel, pre, sd,...)
• MD5 is 22-digits long HASH

Running your own local update server

Note: this is untested, please report back!

Using a webserver (apache, lighttpd, nginx, etc.) and proxy/firewall to catch http://f**01.psp2.update.playstation.net/update/psp2/list/**/psp2-updatelist.xml" and point it to your local server you could[1] have more control over the updates/bandwith. Of course you need to have every PSP2UPDATE.PUP file you reference to, otherwise it errors out.

In this example the webserver is configured at http://192.168.0.254, region is set to eu[2].

<update_data_list>
  <region id="au">
    <np level0_system_version="01.600.000" level1_system_version="03.600.000" level2_system_version="03.600.000" map="03.600.000"/>
    <np_d level0_system_version="01.600.000" level1_system_version="03.600.000" level2_system_version="03.600.000" map="03.600.000"/>
      <version system_version="03.600.000" label="3.60">
        <update_data update_type="full">
          <image size="133676544">http://192.168.0.254/psp2/update/3_600_00/rel/PSP2UPDAT.PUP</image>
        </update_data>
      </version>
      <recovery spkg_type="systemdata">
        <image spkg_version="01.000.010" size="56768512">http://192.168.0.254/psp2/update/3_600_00/sd/PSP2UPDAT.PUP</image>
      </recovery>
      <recovery spkg_type="preinst">
        <image spkg_version="01.000.000" size="128788480">http://192.168.0.254/psp2/update/3_600_00/pre/PSP2UPDAT.PUP</image>
      </recovery>
      <version system_version="03.610.000" label="3.61">
        <update_data update_type="full">
          <image size="133676544">http://192.168.0.254/psp2/update/3_600_00/rel/PSP2UPDAT.PUP</image>
        </update_data>
      </version>
      <recovery spkg_type="systemdata">
        <image spkg_version="01.000.010" size="56768512">http://192.168.0.254/psp2/update/3_600_00/sd/PSP2UPDAT.PUP</image>
      </recovery>
      <recovery spkg_type="preinst">
        <image spkg_version="01.000.000" size="128788480">http://192.168.0.254/psp2/update/3_600_00/pre/PSP2UPDAT.PUP</image>
      </recovery>
  </region>
</update_data_list>

Installation

To install firmware via USB Mass Storage Devices (e.g. USB-stick, Memory Stick, SD-card, Compact Flash with at least 256MB free), place the PS3UPDAT.PUP file in the following folder structure: /PS3/UPDATE/PS3UPDAT.PUP

• The update location for Kiosk is the same as Retail/CEX.
• The update location for disc media (CD, DVD, BD-ROM) is /PS3_UPDATE/PS3UPDAT.PUP
• The update data for Reference Tool (Tool/DECR) is %SCE_PS3_ROOT%\target\updater\ref-tool\PS3UPDAT.PUP.NNN.0xx
• The update data for Debugging Station (Debug/DEX) is %SCE_PS3_ROOT%\target\updater\debugging_station\PS3UPDAT.PUP.NNN.0xx.forDEX.release.yyyymmdd
• For updating with a single firmware PUP, both the Reference Tool (Tool/DECR) and Debugging Station (Debug/DEX) use the same folder structure as Retail/CEX : /PS3/UPDATE/PS3UPDAT.PUP
• For updating with a multiple firmware PUP (2.50 or later), the Reference Tool (Tool/DECR) can use the folder structure : /PS3/UPDATE/SEARCH with a maximum of 2 sublevels deeper (e.g. PS3/UPDATE/SEARCH/ReferenceTool/250/PS3UPDAT.PUP.242.001). A maximum of 20 PUP files (including /PS3/UPDATE/PS3UPDAT.PUP if applicable) will be shown in the firmware list.
• The update location for Arcade is "/dev_hdd0/game/SCEEXE000/ARCDIR/PS3UPDAT.PUP"
• The update location in Factory Service Mode (used for downgrader and remarry) is /PS3UPDAT.PUP
• The update location for QA Debug setting : System Update Debug=ON is /dev_hdd0/updater/01/PS3UPDAT.PUP, /dev_hdd0/updater/02/PS3UPDAT.PUP, etc... (or up to 20 updates together with any name and no file extension required in /dev_hdd0/updater/01/)

Problem solving / tips

• Don’t use any USB Mass Storage Device with enhanced functions as: encryption, fingerprintreader, U3, pincode etc. (sometimes marketed under names as SCSI Enclosure Services (SES) thus needing drivers and only working under Windows)
• Don’t use USB Mass Storage Devices with a long initialisation time (e.g. some MP3 players)
• Don’t use multipartitioned USB Mass Storage Devices, only use 1 single primary FAT32 partition.
• Make sure they are formatted according to specifications with FAT32 (e.g. HP USB Format Tool – or TOKIWA / Ridgecrop FAT32 formatter)
• If the stick is formatted FAT32 and still not working, consider other stick or use this tool: http://www.pendrivelinux.com/restoring-your-usb-key-partition/
• Most USB Mass Storage Devices that’ll work effortless with PenDrive Linux, will also work with the PS3 (for downgrading, upgrading, storage of your Game dumps and any normal filestorage under the XMB). Those USB Mass Storage Devices are most likely also the ones giving you the least problems under more exotic platforms like PSX/PSone, PS2/PStwo, Xbox/X360, Gamecube/Wii/WiiU etc.
• Make sure no disc is inside the drive otherwise it will try to install that one instead of the one on USB Mass Storage Device!
• Make sure the media is not readonly (e.g. SDcard or USB Stick with readonly tab) if using firmwares when doing one of the following:
  • Factory Service Mode reinstallation
  • Remarry BDdrive
  • RSOD Fix
  • or any process that needs to write a log file, in short, write access

Installation descriptive

Select via XMB, Settings -> System Update

Update via Internet
Update via Storage Media

Select Update via Storage Media

The following update data was found:
 Version 3.41-@@SUFFIX@@
Location USB Device

Select OK

User Agreement

<str id="msg_update_eula_1">line 1
</str>
...
<str id="msg_update_eula_X">line X
</str>

Select right arrow or left joystick right

Do you accept the user agreement?

Do Not Accept
Accept

Select right arrow or left joystick right

Main Features Revised in System Software Version 3.41-@@SUFFIX@@

<str id="msg_updater_10">FEATURE 1
</str>
...
<str id="msg_updater_X">FEATURE X
</str>

For detailed information including limitations of usage, visit the SCE Web site for your region.

msg_updater_10 - msg_updater_60 tested to work. they appear one after another in the same manner as the EULA.

Could list each feature as a seperate msg_updater_X

Do not turn off the system during the update.  If you do, you may not be able to restart the PS3 system.  Once the update is started
you cannot go back to the previous version of the system software.

CHECKBOX Turn off System Automatically After Update

START

Select start to install

Copying update data to the hard disk...
Do not turn off the system.

System Update

Installing...
Do not turn off the system.
After the install operation has completed, the
system will automatically restart.

PROGRESS BAR

Orientation

0x8002F21x - (Set Recovery Mode Flag On (cex/dex/decr)) / (Connecting Controller)
0x8002F22x - (Connect Media containing FW equal or higher)
0x8002F23x - (System Partition formating) / (Search Updater) 
0x8002F24x - (Formatting)
0x8002F25x - hdd probing
0x8002F26x - region searching
0x8002F27x - preparing partitions
0x8002F28x - Setup Updating Environment
0x8002F29x - 
0x8002F2Ax - 
0x8002F2Bx - (Turning Off Recovery Mode Flag)
0x8002F2Cx - Search Updater (Formating preparing Update)
0x8002F2Dx - (Formatting - Preparing to Update)
0x8002F2Ex - (Turning On/Off Recovery Mode Flag)

Structure

Verification

The PUP Header is signed using HMAC, HMAC-SHA1 for PS3 and HMAC-SHA256 for PS Vita.

On PS Vita, the PUP Header Digest is signed using RSA2048. The PUP Header RSA signature is RSA-signed along with a message into SCEWM file, which is encrypted using AES128CBC.

The PUP Header embeds HMAC signatures for each PUP segment.

All the PUP keys are known except RSA private keys.

Extraction

PS Vita

The PS Vita and PS Vita TV update files can be extracted from .PUP using:

• "PS VITA Firmware xTractor"
• pupunpack from vitatools.

Decryption

Even though PUP is not encrypted, most files it embeds are.

PS3

Header

typedef struct ScePupHeader_v1 { // size is 0x30-bytes
  uint8_t magic[7];
  uint8_t format_flag;
  uint64_t package_version;
  uint64_t image_version;
  uint64_t segment_num;
  uint64_t file_offset;
  uint64_t file_size;
} ScePupHeader_v1;

Offset	Length	Type	Information
0x0	0x7	unsigned long	Magic
0x7	0x1	uint8_t	Format Flag
0x8	0x8	unsigned long	Package Version. ?Might be Format version like on PS Vita?
0x10	0x8	unsigned long	Image Version. ?What is this?
0x18	0x8	unsigned long	Segment Number
0x20	0x8	unsigned long	File Offset. It corresponds to Header Length.
0x28	0x8	unsigned long	File Size. It corresponds to Data Length.
0x30	0x20 * segment_num	Segment Table	Segment Table
0x30 + (0x20 * segment_num)	0x20 * segment_num	Digest Table	Digest Table
0x30 + (0x40 * segment_num)	0x14	Header Digest	Header Digest
0x44 + (0x40 * segment_num)	0xC	uint8_t[0xC]	Padding

Segment Table

The Segment Table consists of a number of Segment Entries determined by Segment Num.

typedef struct ScePupSegmentEntry { // size is 0x20-bytes
  uint64_t id;
  uint64_t offset;
  uint64_t size;
  uint32_t sign_algorithm;
  uint32_t padding;
} ScePupSegmentEntry;

Offset	Length	Type	Information
0x0	0x8	unsigned long	ID
0x8	0x8	unsigned long	Offset
0x10	0x8	unsigned long	Size
0x18	0x4	unsigned int	Signature Algorithm. 0 = HMAC-SHA1, 2 = HMAC-SHA256
0x1C	0x4	char[4]	Padding

Segment Entry IDs

It is a mistake to try to connect a Segment Entry ID to any specific file. Nevertheless, there are certain Segment Entry IDs that have been linked with the same data throughout all observed PUPs.

Segment Entry ID	Console	File name	Notes
0x100	version.txt	PS3, PS Vita	Version string
0x101	license.xml	PS3, PS Vita	License XML. (?aka: resource.txt?)
0x102	promo_flags.txt	PS3	(only on  SHOP ) (?aka: shop.txt?)
0x103	update_flags.txt	PS3
0x104	patch_build.txt	PS3
0x200	ps3swu.self, psp2swu.self	PS3, PS Vita	Main updater executable
0x201	vsh.tar / font_resource.tar	PS3
0x202	dots.txt	PS3
0x203	patch_data.pkg	PS3
0x204	cui_setupper.self	PS Vita	Classical UI updater setupper executable
0x221	vs0_patch_tar_info.txt	PS Vita	vs0 patch tar archive access permission config
0x231	vs0_patch_tar_2_info.txt	PS Vita	vs0 patch tar archive 2 access permission config
0x300	update_files.tar	PS3
0x302		PS Vita	SLB2
0x303		PS Vita	os0
0x304		PS Vita	vs0
0x305		PS Vita
0x306		PS Vita
0x307		PS Vita
0x308		PS Vita
0x309		PS Vita
0x30A		PS Vita
0x30B		PS Vita
0x30C		PS Vita
0x30D		PS Vita
0x30E		PS Vita
0x30F		PS Vita
0x310		PS Vita
0x311		PS Vita	vs0 patch tar archive
0x312		PS Vita	vs0 patch tar archive 2
0x313		PS Vita	Syscon update type 0: 00 24 10 00
0x314		PS Vita	Syscon update type 1: 00 50 31 00, 00 50 40 00
0x315		PS Vita	Syscon update type 2: 00 26 10 00, 00 52 40 00
0x316		PS Vita	Syscon update type 3: 00 52 31 00
0x317		PS Vita	Syscon update type 4:
0x318		PS Vita	Syscon update type 5:
0x319		PS Vita	Syscon update type 6:
0x31A		PS Vita	Syscon update type 7:
0x31B		PS Vita	Syscon update type 8:
0x31C		PS Vita	Syscon update type 9: 00 30 70 00
0x400	package_scewm.wm	PS Vita	SCEWM file
0x401	package_sceas.as	PS Vita	SCEAS file
0x501	spkg_hdr.tar	PS3	(added since FW 3.56)
0x601	ps3swu2.self	PS3	(added since FW 3.56)
0x2005		PS Vita	CP ES1 firmware. In early Tool PUPs only.
0x2006		PS Vita	CP ES2 firmware. In recent Tool PUPs only.

Digest Table

The Digest Table contains a Digest Entry for every segment inside the PUP.

typedef struct ScePupDigestEntry_v1 { // size is 0x20-bytes
  uint64_t segment_index;
  uint8_t digest[0x14];
  uint32_t padding;
} ScePupDigestEntry_v1;

Offset	Length	Type	Information
0x0	0x8	uint64_t	Segment Index
0x8	0x14	uint8_t[0x14]	Digest (HMAC-SHA1)
0x1C	0x4	uint32_t	Padding

Header Digest

typedef struct {
  uint8_t digest[0x14]; // HMAC-SHA1
} PUPHeaderDigest_v1;

PS Vita

Differences with PS3 PUPs

The file structure of the PS Vita PUP is almost identical to the PS3 PUP, although there is a slight difference in the header, the hash algorithm and the signature.

• PS Vita PUP is little-endian. PS3 PUP is big-endian.
• PS Vita PUP Format Version is 2. PS3 PUP Format Version is 1.
• There are 0x50 bytes of extra data in the PS Vita PUP Header compared to PS3 PUP.
• PS Vita PUP digests are longer than the ones in PS3 PUP: 0x20 bytes (SHA-256 length) in PS Vita PUP versus 0x14 bytes (SHA-1 length) in PS3 PUP.
• PS Vita PUP Header Digest is signed using RSA2048 in the SCEWM file. ?PS3 PUP has a RSA signature?

Header

typedef struct ScePupHeader_v2 { // size is 0x80-bytes
	SceUInt8 magic[7];
	SceUInt8 format_flag;
	SceUInt64 format_version;
	SceUInt32 version;
	SceUInt32 buildno;
	SceUInt64 segment_num;
	SceUInt64 file_offset;
	SceUInt64 file_size;
	SceUInt32 sign_algorithm;
	SceUInt32 sign_key_index;
	SceUInt8 attribute[4];
	SceUInt32 target;
	SceUInt32 sub_target;
	SceUInt32 support_list;
	SceUInt32 base_version;
	SceUInt32 base_buildno;
	SceUInt8 unk_0x50[0x30];
} ScePupHeader_v2;

Offset	Length	Type	Information
0x0	0x7	char[7]	Magic (hex: 53 43 45 55 46 00 00 ~ ASCII 'SCEUF\0\0')
0x7	0x1	uint8_t	Format Flag
0x8	0x8	uint64_t	Format Version (11 digits max)
0x10	0x4	uint32_t	Version (ex: 0x01600000 on FW 1.60)
0x14	0x4	uint32_t	Build No
0x18	0x8	uint64_t	Segment Num (11 digits max)
0x20	0x8	uint64_t	Header Length (ex: 0xC00, 0xE00, 0x1000, 0x1600)
0x28	0x8	uint64_t	Data Length. Equals (PUP file size - PUP Header Length).
0x30	0x4	uint32_t	Sign Algorithm. PS Vita only. (ex: 2)
0x34	0x4	uint32_t	Sign Key Index. PS Vita only. (ex: 1)
0x38	0x4	uint8_t[4]	Attribute. PS Vita only. 0: default, 1: QAF required, 2: manufacturing mode required.
0x3C	0x4	uint32_t	Target. PS Vita only. 1: TOOL, 2: CEX, 4: DEX. cex_for_tool PUPs are set to 1.
0x40	0x4	uint32_t	Sub Target. PS Vita only. (ex: 0)
0x44	0x4	uint32_t	Support List. PS Vita only. (ex: 1, 7, 0xC, 0xF, 0x38, 0x78, 0x3F8, 0xFF8, 0xCFF8)
0x48	0x4	uint32_t	Base Version. PS Vita only. (ex: 0)
0x4C	0x4	uint32_t	Base Build No. PS Vita only. (ex: 0)
0x50	0x30	char[0x30]	Unknown. PS Vita only. (ex: 0x2000)
0x80	0x20 * segment_num	Segment Table	Segment Table
0x80 + (0x20 * segment_num)	0x40 * segment_num	Digest Table	Digest Table
0x80 + (0x60 * segment_num)	0x20	Header Digest	Header Digest (HMAC-SHA256)

Segment Table

Same as in PS3 PUP.

Digest Table

The Digest Table contains a Digest Entry for every segment inside the PUP.

typedef struct ScePupDigestEntry_v2 { // size is 0x40-bytes
	SceUInt64 segment_index;
	SceUInt8 digest[0x20];
	SceUInt8 padding[0x18];
} ScePupDigestEntry_v2;

Offset	Length	Type	Information
0x0	0x8	unsigned long	Segment Index
0x8	0x20	uint8_t[0x20]	Digest (HMAC-SHA256)
0x28	0x18	uint8_t[0x18]	Padding

Header Digest

typedef struct {
  uint8_t digest[0x20]; // HMAC-SHA256
} PUPHeaderDigest_v2;

Embedded files

Here are examples of the files stored in a PUP.

PS3

3.55

 PS3UPDAT.PUP
 ├── dots.txt
 ├── license.txt
 ├── ps3swu.self 
 ├── update_files.tar
 │   ├── BDIT_FIRMWARE_PACKAGE.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_301R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_302R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_303R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_304R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_306R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_308R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BLUETOOTH_FIRMWARE.pkg
 │   │   ├── content
 │   │   │   ├── RC29_firmware_footer.dfu
 │   │   │   ├── usb8780-5.0.1-A1-A2.dfu
 │   │   │   └── usb8781-20.0.12.0.dfu
 │   │   ├── info0
 │   │   └── info1
 │   ├── CORE_OS_PACKAGE.pkg
 │   │   ├── aim_spu_module.self
 │   │   ├── appldr
 │   │   ├── creserved_0
 │   │   ├── default.spp
 │   │   ├── emer_init.self
 │   │   ├── eurus_fw.bin
 │   │   ├── hdd_copy.self
 │   │   ├── isoldr
 │   │   ├── lv0
 │   │   ├── lv1ldr
 │   │   ├── lv1.self
 │   │   ├── lv2_kernel.self
 │   │   ├── lv2ldr
 │   │   ├── manu_info_spu_module.self
 │   │   ├── mc_iso_spu_module.self
 │   │   ├── me_iso_spu_module.self
 │   │   ├── sb_iso_spu_module.self
 │   │   ├── sc_iso.self
 │   │   ├── sdk_version
 │   │   ├── spp_verifier.self
 │   │   ├── spu_pkg_rvk_verifier.self
 │   │   ├── spu_token_processor.self
 │   │   ├── spu_utoken_processor.self
 │   │   └── sv_iso_spu_module.self
 │   ├── dev_flash_''XXX''.tar.aa.''DATE/TIME''
 │   ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME''
 │   ├── MULTI_CARD_FIRMWARE.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── RL_FOR_PACKAGE.img
 │   ├── RL_FOR_PROGRAM.img
 │   ├── SYS_CON_FIRMWARE_01000006.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01010303.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01020302
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01030302.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01040402.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01050002.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01050101.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   └── UPL.xml.pkg
 │       ├── content
 │       ├── info0
 │       └── info1
 ├── update_flags.txt
 ├── version.txt
 └── vsh.tar

For a comparison between Retail and Debug firmware : 3.55 firmware.

3.60 - 4.00

 PS3UPDAT.PUP
 ├── dots.txt
 ├── license.xml
 ├── ps3swu2.self
 ├── ps3swu.self 
 ├── spkg_hdr.tar
 │   ├── BDIT_FIRMWARE_PACKAGE.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_301R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_302R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_303R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_304R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_306R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_308R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_310R.pkg.spkg_hdr.1
 │   ├── BLUETOOTH_FIRMWARE.pkg.spkg_hdr.1
 │   ├── CORE_OS_PACKAGE.pkg.spkg_hdr.1
 │   ├── dev_flash_''XXX''.tar.aa.''DATE/TIME''.spkg_hdr.1
 │   ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME''.spkg_hdr.1
 │   ├── MULTI_CARD_FIRMWARE.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01000006.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01010303.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01020302.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01030302.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01040402.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01050002.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01050101.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg.spkg_hdr.1
 │   └── UPL.xml.pkg.spkg_hdr.1
 ├── update_files.tar
 │   ├── BDIT_FIRMWARE_PACKAGE.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_301R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_302R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_303R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_304R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_306R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_308R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_310R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BLUETOOTH_FIRMWARE.pkg
 │   │   ├── content
 │   │   │   ├── RC29_firmware_footer.dfu
 │   │   │   ├── usb8780-5.0.1-A1-A2.dfu
 │   │   │   └── usb8781-20.0.12.0.dfu
 │   │   ├── info0
 │   │   └── info1
 │   ├── CORE_OS_PACKAGE.pkg
 │   │   ├── aim_spu_module.self
 │   │   ├── creserved_0
 │   │   ├── default.spp
 │   │   ├── emer_init.self
 │   │   ├── eurus_fw.bin
 │   │   ├── hdd_copy.self
 │   │   ├── lv0
 │   │   │   ├── appldr
 │   │   │   ├── isoldr
 │   │   │   ├── lv1ldr
 │   │   │   └── lv2ldr
 │   │   ├── lv0.2
 │   │   ├── lv1.self
 │   │   ├── lv2_kernel.self
 │   │   ├── manu_info_spu_module.self
 │   │   ├── mc_iso_spu_module.self
 │   │   ├── me_iso_for_ps2emu.self (3.70+)
 │   │   ├── me_iso_spu_module.self
 │   │   ├── pkg.srvk
 │   │   ├── prog.srvk
 │   │   ├── sb_iso_spu_module.self
 │   │   ├── sc_iso.self
 │   │   ├── sdk_version
 │   │   ├── spp_verifier.self
 │   │   ├── spu_pkg_rvk_verifier.self
 │   │   ├── spu_token_processor.self
 │   │   ├── spu_utoken_processor.self
 │   │   ├── sv_iso_for_ps2emu.self (3.70+)
 │   │   └── sv_iso_spu_module.self
 │   ├── dev_flash_''XXX''.tar.aa.''DATE/TIME''
 │   ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME''
 │   ├── MULTI_CARD_FIRMWARE.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── RL_FOR_PACKAGE.img
 │   ├── RL_FOR_PROGRAM.img
 │   ├── SYS_CON_FIRMWARE_01000006.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01010303.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01020302
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01030302.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01040402.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01050002.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01050101.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   └── UPL.xml.pkg
 │       ├── content
 │       ├── info0
 │       └── info1
 ├── update_flags.txt
 ├── version.txt
 └── vsh.tar
     └── a

PS Vita

preinst - 01.000.000

Type	Header	Information	Size
ASCII:MM.mmmm (01.500)	[none]	version.txt	1
cui_setupper.self	SCE (SELF)	binary0.self	4536
unknown_lib.sprx	SCE (SELF)	binary1.self	42
	XML	license.xml	451
	SCE	package_file_0.pkg	7904
	SCE	package_file_1.pkg	8130
	SCE	package_file_2.pkg	8196
	SCE	package_file_3.pkg	8196
	SCE	package_file_4.pkg	8196
	SCE	package_file_5.pkg	7883
	SCE	package_file_6.pkg	8052
	SCE	package_file_7.pkg	6943
	SCE	package_file_8.pkg	7758
	SCE	package_file_9.pkg	7805
	SCE	package_file_10.pkg	7804
	SCE	package_file_11.pkg	8005
	SCE	package_file_12.pkg	8103
	SCE	package_file_13.pkg	8084
	SCE	package_file_14.pkg	8066
	SCE	package_file_15.pkg	1661
	SCEWM	package_file_16.pkg	14
	SCEAS	package_file_17.pkg	1

systemdata - 01.000.010

Type	Header	Information	Size
ASCII:MM.mmmm (01.500)	[none]	version.txt	1
cui_setupper.self	SCE (SELF)	binary0.self	4536
unknown_lib.sprx	SCE (SELF)	binary1.self	42
	XML	license.xml	451
	SCE	package_file_0.pkg	2625
	SCE	package_file_1.pkg	4048
	SCE	package_file_2.pkg	2746
	SCE	package_file_3.pkg	3874
	SCE	package_file_4.pkg	4742
	SCE	package_file_5.pkg	4660
	SCE	package_file_6.pkg	3946
	SCE	package_file_7.pkg	4145
	SCE	package_file_8.pkg	4630
	SCE	package_file_9.pkg	5476
	SCE	package_file_10.pkg	4860
	SCE	package_file_11.pkg	4722
	SCEWM	package_scewm.wm	4
	SCEAS	package_sceas.as	1

full - 01.500.000

Type	Header	Information	Size
ASCII:MM.mmmm (01.500)	[none]	version.txt	1
cui_setupper.self	SCE (SELF)	binary0.self	4536
unknown_lib.sprx	SCE (SELF)	binary1.self	42
	XML	license.xml	451
	SCE	package_file_0.pkg	634
	SCE	package_file_1.pkg	6718
	SCE	package_file_2.pkg	8194
	SCE	package_file_3.pkg	8194
	SCE	package_file_4.pkg	8194
	SCE	package_file_5.pkg	8194
	SCE	package_file_6.pkg	8194
	SCE	package_file_7.pkg	8194
	SCE	package_file_8.pkg	8194
	SCE	package_file_9.pkg	8194
	SCE	package_file_10.pkg	8194
	SCE	package_file_11.pkg	6154
	SCEWM	package_scewm.wm	4
	SCEAS	package_sceas.as	1

Tools

KaKaRoTo's pup.c tool