Playstation Update Package (PUP): Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
No edit summary
 
(44 intermediate revisions by 10 users not shown)
Line 5: Line 5:
== Location ==
== Location ==


=== PSVita ===
=== PS Vita ===


The PSVita and PSVita TV OS can install the update as /PSP2/UPDATE/PSP2UPDAT.PUP or as /PSVITA/UPDATE/PSVUPDAT.PUP.<br />
The PS Vita and PS Vita TV OS can install the update as /PSP2/UPDATE/PSP2UPDAT.PUP or as /PSVITA/UPDATE/PSVUPDAT.PUP.<br />


The update comes from:
The update comes from:
Line 29: Line 29:
To document.
To document.


=== PSVita ===
=== PS Vita ===


Each PUP contain updates for different partitions of the system. Most packages, once decrypted, decompressed and pieced together are a raw disk image for the partition to update. Sometimes a TAR archive patch is also used along with the disk images but not as often. Sony usually releases three kinds of update files, each to update different components: full, systemdata and preinst.
PUP contains updates for different partitions of the system. Most packages, once decrypted, decompressed and pieced together are a raw disk image for the partition to update. Sometimes, a TAR archive patch is also used along with the disk images but not as often. Sony usually releases three kinds of update files, each to update different components: release, systemdata and preinstall.


There are different types of PSVita .PUP:
There are different types of PS Vita .PUP files:


==== full ====
==== release - full - rel ====
This contains the actual system files. The main components are <code>os0</code>, <code>vs0</code>, and the [[Boot Sequence|bootloader partition]].
 
Release PUPs update most [[Partitions|partitions]]. This contains the actual system files. The main components are <code>os0</code>, <code>vs0</code>, and the [[Boot Sequence|bootloader partition]].
 
==== systemdata - sd ====


==== systemdata ====
Systemdata PUPs only update the <code>sa0</code> [[Partitions|partition]]. It is likely separated from the main update due to it not regularly needing updates and size concerns.
Systemdata PUPs only update the <code>sa0</code> [[Partitions|partition]]. It is likely separated from the main update due to it not regularly needing updates and size concerns.


==== preinst ====
==== preinstall - preinst ====
Preinst PUPs only update the <code>pd0</code> [[Partitions|partition]]. This is the [[Welcome Park]] application and the initial setup movie. It is likely separated from the main update because of the size.
 
Preinstall PUPs only update the <code>pd0</code> [[Partitions|partition]]. This is the [[Welcome Park]] application and the initial setup movie. It is likely separated from the main update due to it not regularly needing updates and size concerns.


==== com ====
==== com ====
Unknown. Maybe stands for Common.
 
Unknown. Maybe stands for Common or for Communication in the case it would target COM PS Vita i.e. PS Vita that have a 3G Modem.


==== modeldiff ====
==== modeldiff ====
Unknown. Maybe stands for Model Differences.


==== Debug ====
Unknown. Stands for Model Differences.
Debug updates for [[PTEL-XXXX]] and [[PDEL-XXXX]] do not separate into different PUPs. A single PUP will update all components. Additionally updates for PDEL units contains updates for the CP and probably other development unit specific components.


== Revisions ==
== Revisions ==


=== PSVita ===
=== PS Vita ===


See [https://playstationdev.wiki/psvitadevwiki/index.php?title=Category:Firmware_revisions].
See [https://psdevwiki.com/vita/index.php?title=Category:Firmware_revisions].


== Regioning ==
== Update List ==


=== PS3 ===
=== PS3 ===


There is no regioning in the .PUP files, they are the same for all different regions (if you were looking for regioninfo, [http://www.ps3devwiki.com/index.php?title=SKU_Models#Regioning see here]).<br />
There is no regioning in the .PUP files i.e. they are the same for all different regions (if you were looking for regioninfo, [[SKU_Regioning|see here]]). The PS3 however gets the [[ps3-updatelist.txt]] from different servers, depending on the region of that model (last 2 numbers in the CECHxxXX SKU name).
The PS3 however gets the [[ps3-updatelist.txt]] from different servers, depending on the region of that model (last 2 numbers in the CECHxxXX SKU name).


<ul>
<ul>
Line 81: Line 82:
<li> [http://fbr01.ps3.update.playstation.net/update/ps3/list/br/ps3-updatelist.txt Brasil, br] (11 > 0x8F)
<li> [http://fbr01.ps3.update.playstation.net/update/ps3/list/br/ps3-updatelist.txt Brasil, br] (11 > 0x8F)
</ul>
</ul>
for completeness see [[Target ID]]: Reference Tool/DECR : 0x81, Debug/DEX : 0x82, and Arcade : 0xA0
 
For completeness, see [[Product Code]]: Reference Tool/DECR : 0x81, Debug/DEX : 0x82, and Arcade : 0xA0


Retail basic structure of the update URL:
Retail basic structure of the update URL:
Line 92: Line 94:


Content:
Content:
 
<pre>
  # JP(shop)
  # JP(shop)
  Dest=83;CompatibleSystemSoftwareVersion=4.7600-;
  Dest=83;CompatibleSystemSoftwareVersion=4.7600-;
Line 128: Line 130:
  Dest=8F;CompatibleSystemSoftwareVersion=4.7600-;
  Dest=8F;CompatibleSystemSoftwareVersion=4.7600-;
  Dest=8F;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dbr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
  Dest=8F;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dbr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 
</pre>


Shop basic structure of the update URL:
Shop basic structure of the update URL:
Line 134: Line 136:
  (TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 22-digits long HASH)
  (TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 22-digits long HASH)


=== PSVita ===
=== PS Vita ===
 
Like on PS3, there is no regioning in the .PUP files: they are the same for all different regions. However, the PS Vita gets the psp2-updatelist.xml from different servers, depending on the region of that model.


Contrarly to PS3, there is no regioning in the .PUP files: they are the same for all different regions.<br />
On retail (CEX) consoles, when you check for updates via WiFi in settings the console will download an XML file based on the console's region code. For example on PS Vitas sold within the United States the URL for the XML file is <code>http://fus01.psp2.update.playstation.net/update/psp2/list/us/psp2-updatelist.xml</code>.
However, the PSVita gets the psp2-updatelist.xml from different servers, depending on the region of that model.
 
When this file is read by the system, the <code>region id</code> MUST match the system region.
 
Possible regions are: <code>jp</code>, <code>us</code>, <code>au</code>, <code>uk</code>, <code>eu</code>, <code>kr</code>, <code>sa</code>, <code>tw</code>, <code>ru</code>, <code>mx</code>, <code>cn</code> and on devkit you must use the region id <code>257</code> and <code>258</code> for testkit's.
 
The file must be no larger than 65535 bytes, and the URL's specifying where to download the .PUP from can be no longer than 1024 characters, it also must be a direct URL to the content *including "http://" protocol*.
 
When selecting "Update via connecting to PC", the console connects to Content Manager Assistant installed on a PC and then CMA downloads the psp2-updatelist.xml file and the PUP files from PC side and sends it back to the PS Vita. Because of this, by using a custom Content Manager Assistant such as QCMA, you can send whatever psp2-updatelist.xml you want to the PS Vita. This is also what happens with "Update via connecting to PS3".
 
On PS Vita DevKit and TestKit, you can configure your own URL for the psp2-updatelist.xml file in <code>Debug Settings > System Update</code> and this setting can be overridden by placing a file at <code>ux0:/PSP2/UPDATE/SERVER_URL.TXT</code> or <code>host0:/PSP2/UPDATE/SERVER_URL.TXT</code>.


Retail:
Retail:
Line 241: Line 254:


Retail basic structure of the update URL:
Retail basic structure of the update URL:
<pre>http://d<TLD>01.psp2.update.playstation.net/update/psp2/image/<YYYY_MMDD>/pre_<md5>/PSP2UPDAT.PUP?dest=<TLD>
<pre>
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, md5 is 22-digits long HASH)</pre>
http://d<TLD>01.psp2.update.playstation.net/update/psp2/image/<YYYY_MMDD>/pre_<md5>/PSP2UPDAT.PUP?dest=<TLD>
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, md5 is 22-digits long HASH)
</pre>
 
'''<?xml''' <span style="color: blue;">version</span><span style="color: red;">="1.0"</span> <span style="color: blue;">encoding</span><span style="color: red;">="UTF-8"</span>'''?>'''
'''<update_data_list>'''
  '''<region''' <span style="color: blue;">id</span><span style="color: red;">="au"</span>'''>'''
    '''<np''' <span style="color: blue;">level0_system_version</span><span style="color: red;">="01.600.000"</span> <span style="color: blue;">level1_system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">level2_system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">map</span><span style="color: red;">="03.610.000"</span>'''/>'''
    '''<np_d''' <span style="color: blue;">level0_system_version</span><span style="color: red;">="01.600.000"</span> <span style="color: blue;">level1_system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">level2_system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">map</span><span style="color: red;">="03.610.000"</span>'''/>'''
      '''<version''' <span style="color: blue;">system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">label</span><span style="color: red;">="3.61"</span>'''>'''
        '''<update_data''' <span style="color: blue;">update_type</span><span style="color: red;">="full"</span>'''>'''
          '''<image''' <span style="color: blue;">size</span><span style="color: red;">="133676544"</span>>http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/rel_99d9ab3e57a677b38e42cc6409b95e3b/PSP2UPDAT.PUP?dest=au'''</image>'''
        '''</update_data>'''
      '''</version>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="systemdata"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.010"</span> <span style="color: blue;">size</span><span style="color: red;">="56768512"</span>>http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/sd_80cefcda06707796a040648aea38da0f/PSP2UPDAT.PUP?dest=au'''</image>'''
      '''</recovery>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="preinst"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.000"</span> <span style="color: blue;">size</span><span style="color: red;">="128788480"</span>>http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/pre_f5e6da7d1213101482300ccaeda35c3c/PSP2UPDAT.PUP?dest=au'''</image>'''
      '''</recovery>'''
  '''</region>'''
'''</update_data_list>'''
 
PS Vita PUP links use the same structure as PS3 PUP links:
 
<nowiki>http://d</nowiki><span style="color: red;">&lt;TLD&gt;</span>01.ps4.update.playstation.net/update/ps4/image/<span style="color: green;">&lt;YYYY_MMDD&gt;</span>/<span style="color: orange;">&lt;TYPE&gt;</span>_<span style="color: blue;">&lt;MD5&gt;</span>/PS4UPDATE.PUP?dest=<span style="color: red;">&lt;TLD&gt;</span>
* <span style="color: red;"><TLD></span>=2 letter region abbreviation (jp, us, ..)
* <span style="color: green;">&lt;YYYY_MMDD&gt;</span> is build date
* <span style="color: orange;">TYPE</span> is PUP type (rel, pre, sd,...)
* <span style="color: blue;">MD5</span> is 22-digits long HASH
 
=== Running your own local update server ===
 
Note: this is untested, please report back!
 
Using a webserver (apache, lighttpd, nginx, etc.) and proxy/firewall to catch http://f**01.psp2.update.playstation.net/update/psp2/list/**/psp2-updatelist.xml" and point it to your local server you could[1] have more control over the updates/bandwith. Of course you need to have every <code>PSP2UPDATE.PUP</code> file you reference to, otherwise it errors out.
 
In this example the webserver is configured at http://192.168.0.254, region is set to <code>eu</code>[2].
 
'''<update_data_list>'''
  '''<region''' <span style="color: blue;">id</span><span style="color: red;">="au"</span>'''>'''
    '''<np''' <span style="color: blue;">level0_system_version</span><span style="color: red;">="01.600.000"</span> <span style="color: blue;">level1_system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">level2_system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">map</span><span style="color: red;">="03.600.000"</span>'''/>'''
    '''<np_d''' <span style="color: blue;">level0_system_version</span><span style="color: red;">="01.600.000"</span> <span style="color: blue;">level1_system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">level2_system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">map</span><span style="color: red;">="03.600.000"</span>'''/>'''
      '''<version''' <span style="color: blue;">system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">label</span><span style="color: red;">="3.60"</span>'''>'''
        '''<update_data''' <span style="color: blue;">update_type</span><span style="color: red;">="full"</span>'''>'''
          '''<image''' <span style="color: blue;">size</span><span style="color: red;">="133676544"</span>>http://192.168.0.254/psp2/update/3_600_00/rel/PSP2UPDAT.PUP'''</image>'''
        '''</update_data>'''
      '''</version>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="systemdata"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.010"</span> <span style="color: blue;">size</span><span style="color: red;">="56768512"</span>>http://192.168.0.254/psp2/update/3_600_00/sd/PSP2UPDAT.PUP'''</image>'''
      '''</recovery>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="preinst"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.000"</span> <span style="color: blue;">size</span><span style="color: red;">="128788480"</span>>http://192.168.0.254/psp2/update/3_600_00/pre/PSP2UPDAT.PUP'''</image>'''
      '''</recovery>'''
      '''<version''' <span style="color: blue;">system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">label</span><span style="color: red;">="3.61"</span>'''>'''
        '''<update_data''' <span style="color: blue;">update_type</span><span style="color: red;">="full"</span>'''>'''
          '''<image''' <span style="color: blue;">size</span><span style="color: red;">="133676544"</span>>http://192.168.0.254/psp2/update/3_600_00/rel/PSP2UPDAT.PUP'''</image>'''
        '''</update_data>'''
      '''</version>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="systemdata"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.010"</span> <span style="color: blue;">size</span><span style="color: red;">="56768512"</span>>http://192.168.0.254/psp2/update/3_600_00/sd/PSP2UPDAT.PUP'''</image>'''
      '''</recovery>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="preinst"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.000"</span> <span style="color: blue;">size</span><span style="color: red;">="128788480"</span>>http://192.168.0.254/psp2/update/3_600_00/pre/PSP2UPDAT.PUP'''</image>'''
      '''</recovery>'''
  '''</region>'''
'''</update_data_list>'''


== Installation ==
== Installation ==
Line 369: Line 448:
  0x8002F2Ex - (Turning On/Off Recovery Mode Flag)
  0x8002F2Ex - (Turning On/Off Recovery Mode Flag)


= File structure =
= Structure =


== Verification ==
== Verification ==


The HMAC key used to verify the packages has been released. Look around for "pup-hmac".
The PUP Header is signed using HMAC, HMAC-SHA1 for PS3 and HMAC-SHA256 for PS Vita.


== Decryption ==
On PS Vita, the PUP Header Digest is signed using RSA2048. The PUP Header RSA signature is RSA-signed along with a message into SCEWM file, which is encrypted using AES128CBC.
 
The PUP Header embeds HMAC signatures for each PUP segment.


To decrypt the files that are unpacked using the tool, the keys are available under [[Keys]].
All the PUP keys are known except RSA private keys.


== Extraction ==
== Extraction ==


The PSVita and PSVita TV update files can be extracted from .PUP using:
=== PS3 ===
* "[http://www.vitadevwiki.com/index.php?title=Tools PS VITA Firmware xTractor]"
 
* pupunpack from [http://www.vitadevwiki.com/index.php?title=Tools#Vitatools vitatools].
=== PS Vita ===
 
The PS Vita and PS Vita TV update files can be extracted from .PUP using:
* "[http://www.psdevwiki.com/vita/index.php?title=Tools PS VITA Firmware xTractor]"
* pupunpack from [http://www.psdevwiki.com/vita/index.php?title=Tools#Vitatools vitatools].
 
== Decryption ==
 
Even though PUP is not encrypted, most files it embeds are.


== PS3 ==
== PS3 ==
<!--// PUP Extractor http://www.megaupload.com/?d=WILOJ5TC (outdated: incompatible output, tool not update since 27 may 2008 - autor:NDT @ ps3news) //-->


=== Header ===
=== Header ===


<source lang="C">
<source lang="C">
typedef struct {
typedef struct ScePupHeader_v1 { // size is 0x30-bytes
   uint64_t magic;
   uint8_t magic[7];
   uint8_t format_flag;
   uint8_t format_flag;
   uint64_t package_version;
   uint64_t package_version;
   uint64_t image_version;
   uint64_t image_version;
   uint64_t segment_num;
   uint64_t segment_num;
   uint64_t header_length;
   uint64_t file_offset;
   uint64_t data_length;
   uint64_t file_size;
} PUPHeader;
} ScePupHeader_v1;
</source>
</source>


Line 409: Line 496:
| 0x0 || 0x7 || unsigned long || Magic
| 0x0 || 0x7 || unsigned long || Magic
|-
|-
| 0x7 || 0x1 || uin8_t || Format Flag
| 0x7 || 0x1 || uint8_t || Format Flag
|-
|-
| 0x8 || 0x8 || unsigned long || Package Version ?really?
| 0x8 || 0x8 || unsigned long || Package Version. ?Might be Format version like on PS Vita?
|-
|-
| 0x10 || 0x8 || unsigned long || Image Version ?what is that?
| 0x10 || 0x8 || unsigned long || Image Version. ?What is this?
|-
|-
| 0x18 || 0x8 || unsigned long || Segment Num (aka file count)
| 0x18 || 0x8 || unsigned long || Segment Number
|-
|-
| 0x20 || 0x8 || unsigned long || Header Length
| 0x20 || 0x8 || unsigned long || File Offset. It corresponds to Header Length.
|-
|-
| 0x28 || 0x8 || unsigned long || Data Length
| 0x28 || 0x8 || unsigned long || File Size. It corresponds to Data Length.
|-
|-
| 0x30 || 0x20 * '''segment_num''' || '''File Table''' || File Table
| 0x30 || 0x20 * '''segment_num''' || '''Segment Table''' || Segment Table
|-
|-
| 0x30 + (0x20 * '''segment_num''') || 0x20 * '''segment_num''' || '''Hash Table''' || Hash Table
| 0x30 + (0x20 * '''segment_num''') || 0x20 * '''segment_num''' || '''Digest Table''' || Digest Table
|-
|-
| 0x30 + (0x40 * '''segment_num''') || 0x14 || bytes || Header Hash
| 0x30 + (0x40 * '''segment_num''') || 0x14 || '''Header Digest''' || Header Digest
|-
|-
| 0x44 + (0x40 * '''segment_num''') || 0xC || bytes || Padding
| 0x44 + (0x40 * '''segment_num''') || 0xC || uint8_t[0xC] || Padding
|}
|}


=== File Table ===
=== Segment Table ===


The file table consists of a number of file entries determined by '''File Count''', with the format below:
The Segment Table consists of a number of Segment Entries determined by '''Segment Num'''.


<source lang="C">
<source lang="C">
typedef struct {
typedef struct ScePupSegmentEntry { // size is 0x20-bytes
   uint64_t entry_id;
   uint64_t id;
   uint64_t data_offset;
   uint64_t offset;
   uint64_t data_length;
   uint64_t size;
   uint8_t padding[8];
   uint32_t sign_algorithm;
} PUPFileEntry;
  uint32_t padding;
} ScePupSegmentEntry;
</source>
</source>


{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset  
! Offset !! Length !! Type !! Information
! Length  
! Type  
! Information
|-
|-
| 0x0  
| 0x0 || 0x8 || unsigned long || ID
| 0x8  
| unsigned long
| Entry ID
|-
|-
| 0x8  
| 0x8 || 0x8 || unsigned long || Offset
| 0x8
| unsigned long  
| Data Offset
|-
|-
| 0x10
| 0x10 || 0x8 || unsigned long || Size
| 0x8
| unsigned long
| Data Length
|-
|-
| 0x18  
| 0x18 || 0x4 || unsigned int || Signature Algorithm. 0 = HMAC-SHA1, 2 = HMAC-SHA256
| 0x8
|-
| unsigned long
| 0x1C || 0x4 || char[4] || Padding
| Unknown
|}
|}


=== Filename IDs ===
=== Segment Entry IDs ===


PUPEntryID entries
It is a mistake to try to connect a Segment Entry ID to any specific file. Nevertheless, there are certain Segment Entry IDs that have been linked with the same data throughout all observed PUPs.
<source lang="C">
static const PUPEntryID entries[] = {
  {0x100, "version.txt"},
  {0x101, "license.xml"},
  {0x102, "promo_flags.txt"},
  {0x103, "update_flags.txt"},
  {0x104, "patch_build.txt"},
  {0x200, "ps3swu.self"},
  {0x201, "vsh.tar"},
  {0x202, "dots.txt"},
  {0x203, "patch_data.pkg"},
  {0x300, "update_files.tar"},
  {0x501, "spkg_hdr.tar"},
  {0x601, "ps3swu2.self"},
  {0, NULL}
};
</source>


{| class="wikitable"
{| class="wikitable sortable"
! Segment Entry ID !! Console !! File name !! Notes
|-
| 0x100 || [[version.txt]] || PS3, PS Vita || Version string
|-
| 0x101 || [[license.xml]] || PS3, PS Vita || License XML. (?aka: resource.txt?)
|-
| 0x102 || [[promo_flags.txt]] || PS3 || (only on {{SHOP}}) (?aka: shop.txt?)
|-
| 0x103 || [[update_flags.txt]] || PS3 ||
|-
| 0x104 || [[patch_build.txt]] || PS3 ||
|-
| 0x200 || [[ps3swu.self]], [[psp2swu.self]] || PS3, PS Vita || Main updater executable
|-
| 0x201 || [[vsh.tar]] / [[font_resource.tar]] || PS3 ||
|-
| 0x202 || [[dots.txt]] || PS3 ||
|-
| 0x203 || [[patch_data.pkg]] || PS3 ||
|-
| 0x204 || [[cui_setupper.self]] || PS Vita || Classical UI updater setupper executable
|-
| 0x221 || [[vs0_patch_tar_info.txt]] || PS Vita || vs0 patch tar archive access permission config
|-
| 0x231 || [[vs0_patch_tar_2_info.txt]] || PS Vita || vs0 patch tar archive 2 access permission config
|-
| 0x300 || [[update_files.tar]] || PS3 ||
|-
| 0x302 ||  || PS Vita || SLB2
|-
| 0x303 ||  || PS Vita || os0
|-
| 0x304 ||  || PS Vita || vs0
|-
| 0x305 ||  || PS Vita ||
|-
| 0x306 ||  || PS Vita ||
|-
| 0x307 ||  || PS Vita ||
|-
| 0x308 ||  || PS Vita ||
|-
| 0x309 ||  || PS Vita ||
|-
| 0x30A ||  || PS Vita ||
|-
| 0x30B ||  || PS Vita ||
|-
| 0x30C ||  || PS Vita ||
|-
| 0x30D ||  || PS Vita ||
|-
| 0x30E ||  || PS Vita ||
|-
| 0x30F ||  || PS Vita ||
|-
| 0x310 ||  || PS Vita ||
|-
| 0x311 ||  || PS Vita || vs0 patch tar archive
|-
| 0x312 ||  || PS Vita || vs0 patch tar archive 2
|-
| 0x313 ||  || PS Vita || Syscon update type 0: 00 24 10 00
|-
| 0x314 ||  || PS Vita || Syscon update type 1: 00 50 31 00, 00 50 40 00
|-
| 0x315 ||  || PS Vita || Syscon update type 2: 00 26 10 00, 00 52 40 00
|-
|-
! Entry ID
| 0x316 ||  || PS Vita || Syscon update type 3: 00 52 31 00
! Filename
|-
|-
| 0x100
| 0x317 ||  || PS Vita || Syscon update type 4:
| [[version.txt]] (aka: ps3version.txt)
|-
|-
| 0x101
| 0x318 ||  || PS Vita || Syscon update type 5:
| [[license.xml]] (aka: resource.txt? )
|-
|-
| 0x102
| 0x319 ||  || PS Vita || Syscon update type 6:
| [[promo_flags.txt]] (only on {{shop}}) (aka: shop.txt?)
|-
|-
| 0x103
| 0x31A ||  || PS Vita || Syscon update type 7:
| [[update_flags.txt]]
|-
|-
| 0x104
| 0x31B ||  || PS Vita || Syscon update type 8:
| [[patch_build.txt]]
|-
|-
| 0x200
| 0x31C ||  || PS Vita || Syscon update type 9: 00 30 70 00
| [[ps3swu.self]]
|-
|-
| 0x201
| 0x400 || [[package_scewm.wm]] || PS Vita || SCEWM file
| [[vsh.tar]] / font_resource.tar
|-
|-
| 0x202
| 0x401 || [[package_sceas.as]] || PS Vita || SCEAS file
| [[dots.txt]]
|-
|-
| 0x203
| 0x501 || [[spkg_hdr.tar]] || PS3 || (added since FW 3.56)
| [[patch_data.pkg]]
|-
|-
| 0x300
| 0x601 || [[ps3swu2.self]] || PS3 || (added since FW 3.56)
| [[update_files.tar]]
|-
|-
| 0x501
| 0x2005 ||  || PS Vita || CP ES1 firmware. In early Tool PUPs only.
| [[spkg_hdr.tar]] (added since FW 3.56)
|-
|-
| 0x601
| 0x2006 ||  || PS Vita || CP ES2 firmware. In recent Tool PUPs only.
| [[ps3swu2.self]] (added since FW 3.56)
|}
|}


=== Hash Table ===
=== Digest Table ===


The hash table contains a hash entry for every file inside the PUP.
The Digest Table contains a Digest Entry for every segment inside the PUP.


<source lang="C">
<source lang="C">
typedef struct {
typedef struct ScePupDigestEntry_v1 { // size is 0x20-bytes
   uint64_t entry_id;
   uint64_t segment_index;
   uint8_t hash[0x14];
   uint8_t digest[0x14];
   uint32_t padding;
   uint32_t padding;
} PUPHashEntry;
} ScePupDigestEntry_v1;
</source>
</source>


Line 550: Line 662:
! Offset !! Length !! Type !! Information
! Offset !! Length !! Type !! Information
|-
|-
| 0x0 || 0x8 || uint64_t || Entry ID
| 0x0 || 0x8 || uint64_t || Segment Index
|-
|-
| 0x8 || 0x14 || uint8_t[0x14] || HMAC-SHA1 hash
| 0x8 || 0x14 || uint8_t[0x14] || Digest (HMAC-SHA1)
|-
|-
| 0x1C || 0x4 || uint32_t || Padding
| 0x1C || 0x4 || uint32_t || Padding
|}
|}


=== Header Hash ===
=== Header Digest ===


<source lang="C">
<source lang="C">
typedef struct {
typedef struct {
   uint8_t hash[0x14];
   uint8_t digest[0x14]; // HMAC-SHA1
} header_hash;
} PUPHeaderDigest_v1;
</source>
</source>


== PSVita ==
== PS Vita ==


=== Differences with PS3 PUPs ===
=== Differences with PS3 PUPs ===


The file structure of the PSVita PUP files is almost identical to the PS3's, although there is a slight difference in the header and the hash algorithm.
The file structure of the PS Vita PUP is almost identical to the PS3 PUP, although there is a slight difference in the header, the hash algorithm and the signature.


* Whereas in PS3 the format is big-endian, for the PSVita it is little endian.
* PS Vita PUP is little-endian. PS3 PUP is big-endian.
* The '''Format Version''' field in PSVita PUP is set to 2 where in PS3 PUPs it was set to 1.
* PS Vita PUP '''Format Version''' is 2. PS3 PUP '''Format Version''' is 1.
* There is 0x50 bytes of extra data in the header.
* There are 0x50 bytes of extra data in the PS Vita PUP Header compared to PS3 PUP.
* The digests used are of a longer length than in PS3 updates: 0x20 bytes (SHA-256 length) in PSVita versus 0x14 bytes (SHA-1 length) in PS3.
* PS Vita PUP digests are longer than the ones in PS3 PUP: 0x20 bytes (SHA-256 length) in PS Vita PUP versus 0x14 bytes (SHA-1 length) in PS3 PUP.
* PS Vita PUP Header Digest is signed using RSA2048 in the SCEWM file. ?PS3 PUP has a RSA signature?


=== Header ===
=== Header ===
<source lang="C">
typedef struct ScePupHeader_v2 { // size is 0x80-bytes
SceUInt8 magic[7];
SceUInt8 format_flag;
SceUInt64 format_version;
SceUInt32 version;
SceUInt32 buildno;
SceUInt64 segment_num;
SceUInt64 file_offset;
SceUInt64 file_size;
SceUInt32 sign_algorithm;
SceUInt32 sign_key_index;
SceUInt8 attribute[4];
SceUInt32 target;
SceUInt32 sub_target;
SceUInt32 support_list;
SceUInt32 base_version;
SceUInt32 base_buildno;
SceUInt8 unk_0x50[0x30];
} ScePupHeader_v2;
</source>


{| class="wikitable"
{| class="wikitable"
Line 583: Line 718:
| 0x0 || 0x7 || char[7] || Magic (hex: 53 43 45 55 46 00 00 ~ ASCII 'SCEUF\0\0')
| 0x0 || 0x7 || char[7] || Magic (hex: 53 43 45 55 46 00 00 ~ ASCII 'SCEUF\0\0')
|-
|-
| 0x7 || 0x1 || uin8_t || Format Flag
| 0x7 || 0x1 || uint8_t || Format Flag
|-
| 0x8 || 0x8 || uint64_t || Format Version (11 digits max)
|-
| 0x10 || 0x4 || uint32_t || Version (ex: 0x01600000 on FW 1.60)
|-
| 0x14 || 0x4 || uint32_t || Build No
|-
|-
| 0x8 || 0x8 || uin64_t || Format Version (11 digits max)
| 0x18 || 0x8 || uint64_t || Segment Num (11 digits max)
|-
|-
| 0x10 || 0x4 || uin32_t || Sdk Version
| 0x20 || 0x8 || uint64_t || Header Length (ex: 0xC00, 0xE00, 0x1000, 0x1600)
|-
|-
| 0x14 || 0x4 || uin32_t || Build No
| 0x28 || 0x8 || uint64_t || Data Length. Equals (PUP file size - PUP Header Length).
|-
|-
| 0x18 || 0x8 || uin64_t || Segment Num (11 digits max)
| 0x30 || 0x4 || uint32_t || Sign Algorithm. PS Vita only. (ex: 2)
|-
|-
| 0x20 || 0x8 || uin64_t || Header Length (ex: 0xE00, 0x1000)
| 0x34 || 0x4 || uint32_t || Sign Key Index. PS Vita only. (ex: 1)
|-
|-
| 0x28 || 0x8 || uin64_t || Data Length. Equals PUP file size - Header Length.
| 0x38 || 0x4 || uint8_t[4] || Attribute. PS Vita only. 0: default, 1: QAF required, 2: manufacturing mode required.
|-
|-
| 0x30 || 0x50 || '''UNKNOWN''' || UNKNOWN, same for all >V1.0 files so far, maybe something for extra security?
| 0x3C || 0x4 || uint32_t || Target. PS Vita only. 1: TOOL, 2: CEX, 4: DEX. cex_for_tool PUPs are set to 1.
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000030  02 00 00 00 01 00 00 00 00 00 00 00 02 00 00 00  ................
00000040  00 00 00 00 0F 00 00 00 00 00 00 00 00 00 00 00  ................
00000050  00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
</pre>
|-
|-
| 0x80 || 0x20 * '''segment_num''' || '''File Table''' || File Table
| 0x40 || 0x4 || uint32_t || Sub Target. PS Vita only. (ex: 0)
|-
|-
| 0x80 + (0x20 * '''segment_num''') || 0x40 * '''segment_num''' || '''Hash Table''' || Hash Table
| 0x44 || 0x4 || uint32_t || Support List. PS Vita only. (ex: 1, 7, 0xC, 0xF, 0x38, 0x78, 0x3F8, 0xFF8, 0xCFF8)
|-
|-
| 0x80 + (0x60 * '''segment_num''') || 0x20 || bytes || Header Hash (maybe SHA-256?)
| 0x48 || 0x4 || uint32_t || Base Version. PS Vita only. (ex: 0)
|}
 
=== File Table ===
 
The file table consists of a number of file entries determined by '''File Count''', with the format below (which is the same as the format in PS3 PUP1 files).
 
{| class="wikitable"
|-
|-
! Offset !! Length !! Type !! Information
| 0x4C || 0x4 || uint32_t || Base Build No. PS Vita only. (ex: 0)
|-
|-
| 0x0 || 0x8 || unsigned long || Entry ID
| 0x50 || 0x30 || char[0x30] || Unknown. PS Vita only. (ex: 0x2000)
|-
|-
| 0x8 || 0x8 || unsigned long || Data Offset
| 0x80 || 0x20 * '''segment_num''' || '''Segment Table''' || Segment Table
|-
|-
| 0x10 || 0x8 || unsigned long || Data Length
| 0x80 + (0x20 * '''segment_num''') || 0x40 * '''segment_num''' || '''Digest Table''' || Digest Table
|-
|-
| 0x18 || 0x8 || unsigned long || Unknown
| 0x80 + (0x60 * '''segment_num''') || 0x20 || '''Header Digest''' || Header Digest (HMAC-SHA256)
|}
|}


=== Filename IDs ===
=== Segment Table ===


It is a mistake to try to connect a file entry ID to any specific file. A better way of organizing the update contents is through the extracted [[SCE]] encrypted file header. Nevertheless, there are certain file entry IDs that have been linked with the same data throughout all observed update packages.
Same as in PS3 PUP.


{| class="wikitable sortable"
=== Digest Table ===
! File Entry ID !! Filename !! Notes
|-
| 0x100 || version.txt || Version string
|-
| 0x101 || license.xml || License XML
|-
| 0x200 || psp2swu.self || main updater
|-
| 0x204 || cui_setupper.self || development updater initializer
|-
| 0x400 || package_scewm.wm || wm means watermark. Same ID for retail PUPs. Different IDs for dev PUPs for each developer.
|-
| 0x401 || package_sceas.as || Unknown SCEAS magic file
|-
| 0x2005 || || CP firmware in early debug updates only
|-
| 0x2006 || || CP firmware in debug updates only
|}


=== Hash Table ===
The Digest Table contains a Digest Entry for every segment inside the PUP.


The hash table contains a hash entry for every file inside the PUP.
<source lang="C">
typedef struct ScePupDigestEntry_v2 { // size is 0x40-bytes
SceUInt64 segment_index;
SceUInt8 digest[0x20];
SceUInt8 padding[0x18];
} ScePupDigestEntry_v2;
</source>


The hash entry format is:
{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Length !! Type !! Information
! Offset !! Length !! Type !! Information
|-
|-
| 0x0 || 0x8 || unsigned long || File Index
| 0x0 || 0x8 || unsigned long || Segment Index
|-
|-
| 0x8 || 0x20 || bytes || File Hash (hmac-sha256 algo?)
| 0x8 || 0x20 || uint8_t[0x20] || Digest (HMAC-SHA256)
|-
|-
| 0x28 || 0x18 || bytes || Unknown
| 0x28 || 0x18 || uint8_t[0x18] || Padding
|}
|}
=== Header Digest ===
<source lang="C">
typedef struct {
  uint8_t digest[0x20]; // HMAC-SHA256
} PUPHeaderDigest_v2;
</source>


= Embedded files =
= Embedded files =
Line 947: Line 1,068:
</pre>
</pre>


== PSVita ==
== PS Vita ==


=== preinst - 01.000.000 ===
=== preinst - 01.000.000 ===

Latest revision as of 20:34, 3 September 2023

Description[edit | edit source]

PUP (Playstation Update Package) files are packages which contain the files used to update a PSP or PS3 system. There are 2 different types: patches (PS3PATCH.PUP) and full updates (PS3UPDAT.PUP). Based on the model, there are 4 different release types: Retail/CEX, Shop/SEX, Debug/DEX and Tool/DECR. Within the Retail/CEX there are 2 file versions: 1 is a PUP with a normal file length which also gets released online. The other PUP file version is the same, except it is zero-filled after the normal PUP content to a fixed filelength of 256MB, which gets released on Gamedisks (if gamecreators build their project to a premaster and give it to Sony for signing, they just use a placeholder of a 256MB PS3UPDAT.PUP which contains no firmwaredata at all - it is completely zerofilled. Sony decides the firmware that gets on the disk and for which firmware the 'Gold' code is signed and mastered).

Location[edit | edit source]

PS Vita[edit | edit source]

The PS Vita and PS Vita TV OS can install the update as /PSP2/UPDATE/PSP2UPDAT.PUP or as /PSVITA/UPDATE/PSVUPDAT.PUP.

The update comes from:

http://djp01.psv.update.playstation.net/update/psv/image/image/<YYYY_MMDD>/pre_<md5>/PSVUPDAT.PUP

It is only used by sony on the website. That's why there is no update list on that server.

Download[edit | edit source]

PUP Download Repositories[edit | edit source]

Links:

Types[edit | edit source]

PS3[edit | edit source]

To document.

PS Vita[edit | edit source]

PUP contains updates for different partitions of the system. Most packages, once decrypted, decompressed and pieced together are a raw disk image for the partition to update. Sometimes, a TAR archive patch is also used along with the disk images but not as often. Sony usually releases three kinds of update files, each to update different components: release, systemdata and preinstall.

There are different types of PS Vita .PUP files:

release - full - rel[edit | edit source]

Release PUPs update most partitions. This contains the actual system files. The main components are os0, vs0, and the bootloader partition.

systemdata - sd[edit | edit source]

Systemdata PUPs only update the sa0 partition. It is likely separated from the main update due to it not regularly needing updates and size concerns.

preinstall - preinst[edit | edit source]

Preinstall PUPs only update the pd0 partition. This is the Welcome Park application and the initial setup movie. It is likely separated from the main update due to it not regularly needing updates and size concerns.

com[edit | edit source]

Unknown. Maybe stands for Common or for Communication in the case it would target COM PS Vita i.e. PS Vita that have a 3G Modem.

modeldiff[edit | edit source]

Unknown. Stands for Model Differences.

Revisions[edit | edit source]

PS Vita[edit | edit source]

See [1].

Update List[edit | edit source]

PS3[edit | edit source]

There is no regioning in the .PUP files i.e. they are the same for all different regions (if you were looking for regioninfo, see here). The PS3 however gets the ps3-updatelist.txt from different servers, depending on the region of that model (last 2 numbers in the CECHxxXX SKU name).

For completeness, see Product Code: Reference Tool/DECR : 0x81, Debug/DEX : 0x82, and Arcade : 0xA0

Retail basic structure of the update URL: 

  http://d<TLD>01.ps3.update.playstation.net/update/ps3/image/<TLD>/YYYY_MMDD_md5/PS3UPDAT.PUP
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 32-digits long HASH)


Shop update check URL: http://fshop01.ps3.update.playstation.net/update/ps3/list/shop/ps3-updatelist.txt

Content: 

 # JP(shop)
 Dest=83;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=83;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://djp01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # US(shop)
 Dest=84;CompatibleSystemSoftwareVersion=4.7600-;
  Dest=84;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dus01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # EU(shop)
 Dest=85;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=85;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://deu01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # KR(shop)
 Dest=86;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=86;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dkr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # UK(shop)
 Dest=87;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=87;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://duk01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # MX(shop)
 Dest=88;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=88;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dmx01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # AU/NZ(shop)
 Dest=89;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=89;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dau01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # SouthAsia(shop)
 Dest=8A;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=8A;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dsa01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # TW(shop)
 Dest=8B;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=8B;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dtw01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # RU(shop)
 Dest=8C;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=8C;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dru01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
 # CN(shop)
 Dest=8D;ImageVersion=00000000;SystemSoftwareVersion=0.0000;CDN=http://dcn01.ps3.update.playstation.net/update/ps3/image/shop/nodata;CDN_Timeout=30;
 # BR(shop)
 Dest=8F;CompatibleSystemSoftwareVersion=4.7600-;
 Dest=8F;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dbr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;

Shop basic structure of the update URL: 

  http://d<TLD>01.ps3.update.playstation.net/update/ps3/image/shop/YYYY_MMDD_md5/PS3UPDAT.PUP
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 22-digits long HASH)

PS Vita[edit | edit source]

Like on PS3, there is no regioning in the .PUP files: they are the same for all different regions. However, the PS Vita gets the psp2-updatelist.xml from different servers, depending on the region of that model.

On retail (CEX) consoles, when you check for updates via WiFi in settings the console will download an XML file based on the console's region code. For example on PS Vitas sold within the United States the URL for the XML file is http://fus01.psp2.update.playstation.net/update/psp2/list/us/psp2-updatelist.xml.

When this file is read by the system, the region id MUST match the system region.

Possible regions are: jp, us, au, uk, eu, kr, sa, tw, ru, mx, cn and on devkit you must use the region id 257 and 258 for testkit's.

The file must be no larger than 65535 bytes, and the URL's specifying where to download the .PUP from can be no longer than 1024 characters, it also must be a direct URL to the content *including "http://" protocol*.

When selecting "Update via connecting to PC", the console connects to Content Manager Assistant installed on a PC and then CMA downloads the psp2-updatelist.xml file and the PUP files from PC side and sends it back to the PS Vita. Because of this, by using a custom Content Manager Assistant such as QCMA, you can send whatever psp2-updatelist.xml you want to the PS Vita. This is also what happens with "Update via connecting to PS3".

On PS Vita DevKit and TestKit, you can configure your own URL for the psp2-updatelist.xml file in Debug Settings > System Update and this setting can be overridden by placing a file at ux0:/PSP2/UPDATE/SERVER_URL.TXT or host0:/PSP2/UPDATE/SERVER_URL.TXT.

Retail:

11 jan 2012 :: full 01.520.000 + systemdata 01.000.010 + preinst 01.000.000: 

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.520.000" level1_system_version="01.520.000" level2_system_version="01.520.000"/>
    <version system_version="01.520.000" label="01.520">
      <update_data update_type="full">
        <image size="94646272">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/rel_01a72de4dd90191f679f648da8d11a48/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/sd_d48c3a2ca8963ffc7ac01c73e873809c/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/pre_5899e51b24eb4ab2c985df08bf6c901b/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

22 dec 2011 :: full 01.510.000 + systemdata 01.000.010 + preinst 01.000.000: 

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.510.000" level1_system_version="01.510.000" level2_system_version="01.510.000"/>
    <version system_version="01.510.000" label="01.510">
      <update_data update_type="full">
        <image size="94500352">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/rel_48ac631ecae3837a7530506de0d73eaf/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/sd_52ff6b714e5f701d15938a6fee68fb66/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/pre_a18a91bb8c86f8c1a101d19fcb15fb6d/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

14 dec 2011 :: full 01.500.000 + systemdata 01.000.010 + preinst 01.000.000: 

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.500.000" level1_system_version="01.500.000" level2_system_version="01.500.000"/>
    <version system_version="01.500.000" label="01.500">
      <update_data update_type="full">
        <image size="94496256">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/rel_f090a69bcf392b5c311b9e786c5cc0b5/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/sd_484243f3964158b38ad1adaac0332a3e/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/pre_24b5601c3b3aa63b51cf5eaeab718a4c/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

Shop: 

<update_data_list>
  <region id="shop">
    <np level0_system_version="00.000.000" level1_system_version="00.000.000" level2_system_version="00.000.000"/>
    <version system_version="00.000.000">
      <update_data update_type="full">
        <image>NA</image>
      </update_data>
    </version>
  </region>
</update_data_list>

Retail basic structure of the update URL: 

http://d<TLD>01.psp2.update.playstation.net/update/psp2/image/<YYYY_MMDD>/pre_<md5>/PSP2UPDAT.PUP?dest=<TLD>
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, md5 is 22-digits long HASH)

<?xml version="1.0" encoding="UTF-8"?>
<update_data_list>
  <region id="au">
    <np level0_system_version="01.600.000" level1_system_version="03.610.000" level2_system_version="03.610.000" map="03.610.000"/>
    <np_d level0_system_version="01.600.000" level1_system_version="03.610.000" level2_system_version="03.610.000" map="03.610.000"/>
      <version system_version="03.610.000" label="3.61">
        <update_data update_type="full">
          <image size="133676544">http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/rel_99d9ab3e57a677b38e42cc6409b95e3b/PSP2UPDAT.PUP?dest=au</image>
        </update_data>
      </version>
      <recovery spkg_type="systemdata">
        <image spkg_version="01.000.010" size="56768512">http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/sd_80cefcda06707796a040648aea38da0f/PSP2UPDAT.PUP?dest=au</image>
      </recovery>
      <recovery spkg_type="preinst">
        <image spkg_version="01.000.000" size="128788480">http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/pre_f5e6da7d1213101482300ccaeda35c3c/PSP2UPDAT.PUP?dest=au</image>
      </recovery>
  </region>
</update_data_list>

PS Vita PUP links use the same structure as PS3 PUP links:

http://d<TLD>01.ps4.update.playstation.net/update/ps4/image/<YYYY_MMDD>/<TYPE>_<MD5>/PS4UPDATE.PUP?dest=<TLD>

  • <TLD>=2 letter region abbreviation (jp, us, ..)
  • <YYYY_MMDD> is build date
  • TYPE is PUP type (rel, pre, sd,...)
  • MD5 is 22-digits long HASH

Running your own local update server[edit | edit source]

Note: this is untested, please report back!

Using a webserver (apache, lighttpd, nginx, etc.) and proxy/firewall to catch http://f**01.psp2.update.playstation.net/update/psp2/list/**/psp2-updatelist.xml" and point it to your local server you could[1] have more control over the updates/bandwith. Of course you need to have every PSP2UPDATE.PUP file you reference to, otherwise it errors out.

In this example the webserver is configured at http://192.168.0.254, region is set to eu[2]. 

<update_data_list>
  <region id="au">
    <np level0_system_version="01.600.000" level1_system_version="03.600.000" level2_system_version="03.600.000" map="03.600.000"/>
    <np_d level0_system_version="01.600.000" level1_system_version="03.600.000" level2_system_version="03.600.000" map="03.600.000"/>
      <version system_version="03.600.000" label="3.60">
        <update_data update_type="full">
          <image size="133676544">http://192.168.0.254/psp2/update/3_600_00/rel/PSP2UPDAT.PUP</image>
        </update_data>
      </version>
      <recovery spkg_type="systemdata">
        <image spkg_version="01.000.010" size="56768512">http://192.168.0.254/psp2/update/3_600_00/sd/PSP2UPDAT.PUP</image>
      </recovery>
      <recovery spkg_type="preinst">
        <image spkg_version="01.000.000" size="128788480">http://192.168.0.254/psp2/update/3_600_00/pre/PSP2UPDAT.PUP</image>
      </recovery>
      <version system_version="03.610.000" label="3.61">
        <update_data update_type="full">
          <image size="133676544">http://192.168.0.254/psp2/update/3_600_00/rel/PSP2UPDAT.PUP</image>
        </update_data>
      </version>
      <recovery spkg_type="systemdata">
        <image spkg_version="01.000.010" size="56768512">http://192.168.0.254/psp2/update/3_600_00/sd/PSP2UPDAT.PUP</image>
      </recovery>
      <recovery spkg_type="preinst">
        <image spkg_version="01.000.000" size="128788480">http://192.168.0.254/psp2/update/3_600_00/pre/PSP2UPDAT.PUP</image>
      </recovery>
  </region>
</update_data_list>

Installation[edit | edit source]

To install firmware via USB Mass Storage Devices (e.g. USB-stick, Memory Stick, SD-card, Compact Flash with at least 256MB free), place the PS3UPDAT.PUP file in the following folder structure: /PS3/UPDATE/PS3UPDAT.PUP

  • The update location for Kiosk is the same as Retail/CEX.
  • The update location for disc media (CD, DVD, BD-ROM) is /PS3_UPDATE/PS3UPDAT.PUP
  • The update data for Reference Tool (Tool/DECR) is %SCE_PS3_ROOT%\target\updater\ref-tool\PS3UPDAT.PUP.NNN.0xx
  • The update data for Debugging Station (Debug/DEX) is %SCE_PS3_ROOT%\target\updater\debugging_station\PS3UPDAT.PUP.NNN.0xx.forDEX.release.yyyymmdd
  • For updating with a single firmware PUP, both the Reference Tool (Tool/DECR) and Debugging Station (Debug/DEX) use the same folder structure as Retail/CEX : /PS3/UPDATE/PS3UPDAT.PUP
  • For updating with a multiple firmware PUP (2.50 or later), the Reference Tool (Tool/DECR) can use the folder structure : /PS3/UPDATE/SEARCH with a maximum of 2 sublevels deeper (e.g. PS3/UPDATE/SEARCH/ReferenceTool/250/PS3UPDAT.PUP.242.001). A maximum of 20 PUP files (including /PS3/UPDATE/PS3UPDAT.PUP if applicable) will be shown in the firmware list.
  • The update location for Arcade is "/dev_hdd0/game/SCEEXE000/ARCDIR/PS3UPDAT.PUP"
  • The update location in Factory Service Mode (used for downgrader and remarry) is /PS3UPDAT.PUP
  • The update location for QA Debug setting : System Update Debug=ON is /dev_hdd0/updater/01/PS3UPDAT.PUP, /dev_hdd0/updater/02/PS3UPDAT.PUP, etc... (or up to 20 updates together with any name and no file extension required in /dev_hdd0/updater/01/)

Problem solving / tips[edit | edit source]

  • Don’t use any USB Mass Storage Device with enhanced functions as: encryption, fingerprintreader, U3, pincode etc. (sometimes marketed under names as SCSI Enclosure Services (SES) thus needing drivers and only working under Windows)
  • Don’t use USB Mass Storage Devices with a long initialisation time (e.g. some MP3 players)
  • Don’t use multipartitioned USB Mass Storage Devices, only use 1 single primary FAT32 partition.
  • Make sure they are formatted according to specifications with FAT32 (e.g. HP USB Format Tool – or TOKIWA / Ridgecrop FAT32 formatter)
  • If the stick is formatted FAT32 and still not working, consider other stick or use this tool: http://www.pendrivelinux.com/restoring-your-usb-key-partition/
  • Most USB Mass Storage Devices that’ll work effortless with PenDrive Linux, will also work with the PS3 (for downgrading, upgrading, storage of your Game dumps and any normal filestorage under the XMB). Those USB Mass Storage Devices are most likely also the ones giving you the least problems under more exotic platforms like PSX/PSone, PS2/PStwo, Xbox/X360, Gamecube/Wii/WiiU etc.
  • Make sure no disc is inside the drive otherwise it will try to install that one instead of the one on USB Mass Storage Device!
  • Make sure the media is not readonly (e.g. SDcard or USB Stick with readonly tab) if using firmwares when doing one of the following:
    • Factory Service Mode reinstallation
    • Remarry BDdrive
    • RSOD Fix
    • or any process that needs to write a log file, in short, write access

Installation descriptive[edit | edit source]

Select via XMB, Settings -> System Update
Update via Internet
Update via Storage Media
Select Update via Storage Media
The following update data was found:
 Version 3.41-@@SUFFIX@@
Location USB Device
Select OK
User Agreement

<str id="msg_update_eula_1">line 1
</str>
...
<str id="msg_update_eula_X">line X
</str>
Select right arrow or left joystick right
Do you accept the user agreement?

Do Not Accept
Accept
Select right arrow or left joystick right
Main Features Revised in System Software Version 3.41-@@SUFFIX@@

<str id="msg_updater_10">FEATURE 1
</str>
...
<str id="msg_updater_X">FEATURE X
</str>

For detailed information including limitations of usage, visit the SCE Web site for your region.
msg_updater_10 - msg_updater_60 tested to work. they appear one after another in the same manner as the EULA.
Could list each feature as a seperate msg_updater_X
Do not turn off the system during the update.  If you do, you may not be able to restart the PS3 system.  Once the update is started
you cannot go back to the previous version of the system software.

CHECKBOX Turn off System Automatically After Update

START
Select start to install
Copying update data to the hard disk...
Do not turn off the system.

System Update

Installing...
Do not turn off the system.
After the install operation has completed, the
system will automatically restart.

PROGRESS BAR

Orientation[edit | edit source]

0x8002F21x - (Set Recovery Mode Flag On (cex/dex/decr)) / (Connecting Controller)
0x8002F22x - (Connect Media containing FW equal or higher)
0x8002F23x - (System Partition formating) / (Search Updater) 
0x8002F24x - (Formatting)
0x8002F25x - hdd probing
0x8002F26x - region searching
0x8002F27x - preparing partitions
0x8002F28x - Setup Updating Environment
0x8002F29x - 
0x8002F2Ax - 
0x8002F2Bx - (Turning Off Recovery Mode Flag)
0x8002F2Cx - Search Updater (Formating preparing Update)
0x8002F2Dx - (Formatting - Preparing to Update)
0x8002F2Ex - (Turning On/Off Recovery Mode Flag)

Structure[edit | edit source]

Verification[edit | edit source]

The PUP Header is signed using HMAC, HMAC-SHA1 for PS3 and HMAC-SHA256 for PS Vita.

On PS Vita, the PUP Header Digest is signed using RSA2048. The PUP Header RSA signature is RSA-signed along with a message into SCEWM file, which is encrypted using AES128CBC.

The PUP Header embeds HMAC signatures for each PUP segment.

All the PUP keys are known except RSA private keys.

Extraction[edit | edit source]

PS3[edit | edit source]

PS Vita[edit | edit source]

The PS Vita and PS Vita TV update files can be extracted from .PUP using:

Decryption[edit | edit source]

Even though PUP is not encrypted, most files it embeds are.

PS3[edit | edit source]

Header[edit | edit source]

typedef struct ScePupHeader_v1 { // size is 0x30-bytes
  uint8_t magic[7];
  uint8_t format_flag;
  uint64_t package_version;
  uint64_t image_version;
  uint64_t segment_num;
  uint64_t file_offset;
  uint64_t file_size;
} ScePupHeader_v1;
Offset Length Type Information
0x0 0x7 unsigned long Magic
0x7 0x1 uint8_t Format Flag
0x8 0x8 unsigned long Package Version. ?Might be Format version like on PS Vita?
0x10 0x8 unsigned long Image Version. ?What is this?
0x18 0x8 unsigned long Segment Number
0x20 0x8 unsigned long File Offset. It corresponds to Header Length.
0x28 0x8 unsigned long File Size. It corresponds to Data Length.
0x30 0x20 * segment_num Segment Table Segment Table
0x30 + (0x20 * segment_num) 0x20 * segment_num Digest Table Digest Table
0x30 + (0x40 * segment_num) 0x14 Header Digest Header Digest
0x44 + (0x40 * segment_num) 0xC uint8_t[0xC] Padding

Segment Table[edit | edit source]

The Segment Table consists of a number of Segment Entries determined by Segment Num. 

typedef struct ScePupSegmentEntry { // size is 0x20-bytes
  uint64_t id;
  uint64_t offset;
  uint64_t size;
  uint32_t sign_algorithm;
  uint32_t padding;
} ScePupSegmentEntry;
Offset Length Type Information
0x0 0x8 unsigned long ID
0x8 0x8 unsigned long Offset
0x10 0x8 unsigned long Size
0x18 0x4 unsigned int Signature Algorithm. 0 = HMAC-SHA1, 2 = HMAC-SHA256
0x1C 0x4 char[4] Padding

Segment Entry IDs[edit | edit source]

It is a mistake to try to connect a Segment Entry ID to any specific file. Nevertheless, there are certain Segment Entry IDs that have been linked with the same data throughout all observed PUPs.

Segment Entry ID Console File name Notes
0x100 version.txt PS3, PS Vita Version string
0x101 license.xml PS3, PS Vita License XML. (?aka: resource.txt?)
0x102 promo_flags.txt PS3 (only on  SHOP ) (?aka: shop.txt?)
0x103 update_flags.txt PS3
0x104 patch_build.txt PS3
0x200 ps3swu.self, psp2swu.self PS3, PS Vita Main updater executable
0x201 vsh.tar / font_resource.tar PS3
0x202 dots.txt PS3
0x203 patch_data.pkg PS3
0x204 cui_setupper.self PS Vita Classical UI updater setupper executable
0x221 vs0_patch_tar_info.txt PS Vita vs0 patch tar archive access permission config
0x231 vs0_patch_tar_2_info.txt PS Vita vs0 patch tar archive 2 access permission config
0x300 update_files.tar PS3
0x302 PS Vita SLB2
0x303 PS Vita os0
0x304 PS Vita vs0
0x305 PS Vita
0x306 PS Vita
0x307 PS Vita
0x308 PS Vita
0x309 PS Vita
0x30A PS Vita
0x30B PS Vita
0x30C PS Vita
0x30D PS Vita
0x30E PS Vita
0x30F PS Vita
0x310 PS Vita
0x311 PS Vita vs0 patch tar archive
0x312 PS Vita vs0 patch tar archive 2
0x313 PS Vita Syscon update type 0: 00 24 10 00
0x314 PS Vita Syscon update type 1: 00 50 31 00, 00 50 40 00
0x315 PS Vita Syscon update type 2: 00 26 10 00, 00 52 40 00
0x316 PS Vita Syscon update type 3: 00 52 31 00
0x317 PS Vita Syscon update type 4:
0x318 PS Vita Syscon update type 5:
0x319 PS Vita Syscon update type 6:
0x31A PS Vita Syscon update type 7:
0x31B PS Vita Syscon update type 8:
0x31C PS Vita Syscon update type 9: 00 30 70 00
0x400 package_scewm.wm PS Vita SCEWM file
0x401 package_sceas.as PS Vita SCEAS file
0x501 spkg_hdr.tar PS3 (added since FW 3.56)
0x601 ps3swu2.self PS3 (added since FW 3.56)
0x2005 PS Vita CP ES1 firmware. In early Tool PUPs only.
0x2006 PS Vita CP ES2 firmware. In recent Tool PUPs only.

Digest Table[edit | edit source]

The Digest Table contains a Digest Entry for every segment inside the PUP. 

typedef struct ScePupDigestEntry_v1 { // size is 0x20-bytes
  uint64_t segment_index;
  uint8_t digest[0x14];
  uint32_t padding;
} ScePupDigestEntry_v1;
Offset Length Type Information
0x0 0x8 uint64_t Segment Index
0x8 0x14 uint8_t[0x14] Digest (HMAC-SHA1)
0x1C 0x4 uint32_t Padding

Header Digest[edit | edit source]

typedef struct {
  uint8_t digest[0x14]; // HMAC-SHA1
} PUPHeaderDigest_v1;

PS Vita[edit | edit source]

Differences with PS3 PUPs[edit | edit source]

The file structure of the PS Vita PUP is almost identical to the PS3 PUP, although there is a slight difference in the header, the hash algorithm and the signature.

  • PS Vita PUP is little-endian. PS3 PUP is big-endian.
  • PS Vita PUP Format Version is 2. PS3 PUP Format Version is 1.
  • There are 0x50 bytes of extra data in the PS Vita PUP Header compared to PS3 PUP.
  • PS Vita PUP digests are longer than the ones in PS3 PUP: 0x20 bytes (SHA-256 length) in PS Vita PUP versus 0x14 bytes (SHA-1 length) in PS3 PUP.
  • PS Vita PUP Header Digest is signed using RSA2048 in the SCEWM file. ?PS3 PUP has a RSA signature?

Header[edit | edit source]

typedef struct ScePupHeader_v2 { // size is 0x80-bytes
	SceUInt8 magic[7];
	SceUInt8 format_flag;
	SceUInt64 format_version;
	SceUInt32 version;
	SceUInt32 buildno;
	SceUInt64 segment_num;
	SceUInt64 file_offset;
	SceUInt64 file_size;
	SceUInt32 sign_algorithm;
	SceUInt32 sign_key_index;
	SceUInt8 attribute[4];
	SceUInt32 target;
	SceUInt32 sub_target;
	SceUInt32 support_list;
	SceUInt32 base_version;
	SceUInt32 base_buildno;
	SceUInt8 unk_0x50[0x30];
} ScePupHeader_v2;
Offset Length Type Information
0x0 0x7 char[7] Magic (hex: 53 43 45 55 46 00 00 ~ ASCII 'SCEUF\0\0')
0x7 0x1 uint8_t Format Flag
0x8 0x8 uint64_t Format Version (11 digits max)
0x10 0x4 uint32_t Version (ex: 0x01600000 on FW 1.60)
0x14 0x4 uint32_t Build No
0x18 0x8 uint64_t Segment Num (11 digits max)
0x20 0x8 uint64_t Header Length (ex: 0xC00, 0xE00, 0x1000, 0x1600)
0x28 0x8 uint64_t Data Length. Equals (PUP file size - PUP Header Length).
0x30 0x4 uint32_t Sign Algorithm. PS Vita only. (ex: 2)
0x34 0x4 uint32_t Sign Key Index. PS Vita only. (ex: 1)
0x38 0x4 uint8_t[4] Attribute. PS Vita only. 0: default, 1: QAF required, 2: manufacturing mode required.
0x3C 0x4 uint32_t Target. PS Vita only. 1: TOOL, 2: CEX, 4: DEX. cex_for_tool PUPs are set to 1.
0x40 0x4 uint32_t Sub Target. PS Vita only. (ex: 0)
0x44 0x4 uint32_t Support List. PS Vita only. (ex: 1, 7, 0xC, 0xF, 0x38, 0x78, 0x3F8, 0xFF8, 0xCFF8)
0x48 0x4 uint32_t Base Version. PS Vita only. (ex: 0)
0x4C 0x4 uint32_t Base Build No. PS Vita only. (ex: 0)
0x50 0x30 char[0x30] Unknown. PS Vita only. (ex: 0x2000)
0x80 0x20 * segment_num Segment Table Segment Table
0x80 + (0x20 * segment_num) 0x40 * segment_num Digest Table Digest Table
0x80 + (0x60 * segment_num) 0x20 Header Digest Header Digest (HMAC-SHA256)

Segment Table[edit | edit source]

Same as in PS3 PUP.

Digest Table[edit | edit source]

The Digest Table contains a Digest Entry for every segment inside the PUP. 

typedef struct ScePupDigestEntry_v2 { // size is 0x40-bytes
	SceUInt64 segment_index;
	SceUInt8 digest[0x20];
	SceUInt8 padding[0x18];
} ScePupDigestEntry_v2;
Offset Length Type Information
0x0 0x8 unsigned long Segment Index
0x8 0x20 uint8_t[0x20] Digest (HMAC-SHA256)
0x28 0x18 uint8_t[0x18] Padding

Header Digest[edit | edit source]

typedef struct {
  uint8_t digest[0x20]; // HMAC-SHA256
} PUPHeaderDigest_v2;

Embedded files[edit | edit source]

Here are examples of the files stored in a PUP.

PS3[edit | edit source]

3.55[edit | edit source]

 PS3UPDAT.PUP
 ├── dots.txt
 ├── license.txt
 ├── ps3swu.self 
 ├── update_files.tar
 │   ├── BDIT_FIRMWARE_PACKAGE.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_301R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_302R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_303R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_304R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_306R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_308R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BLUETOOTH_FIRMWARE.pkg
 │   │   ├── content
 │   │   │   ├── RC29_firmware_footer.dfu
 │   │   │   ├── usb8780-5.0.1-A1-A2.dfu
 │   │   │   └── usb8781-20.0.12.0.dfu
 │   │   ├── info0
 │   │   └── info1
 │   ├── CORE_OS_PACKAGE.pkg
 │   │   ├── aim_spu_module.self
 │   │   ├── appldr
 │   │   ├── creserved_0
 │   │   ├── default.spp
 │   │   ├── emer_init.self
 │   │   ├── eurus_fw.bin
 │   │   ├── hdd_copy.self
 │   │   ├── isoldr
 │   │   ├── lv0
 │   │   ├── lv1ldr
 │   │   ├── lv1.self
 │   │   ├── lv2_kernel.self
 │   │   ├── lv2ldr
 │   │   ├── manu_info_spu_module.self
 │   │   ├── mc_iso_spu_module.self
 │   │   ├── me_iso_spu_module.self
 │   │   ├── sb_iso_spu_module.self
 │   │   ├── sc_iso.self
 │   │   ├── sdk_version
 │   │   ├── spp_verifier.self
 │   │   ├── spu_pkg_rvk_verifier.self
 │   │   ├── spu_token_processor.self
 │   │   ├── spu_utoken_processor.self
 │   │   └── sv_iso_spu_module.self
 │   ├── dev_flash_''XXX''.tar.aa.''DATE/TIME''
 │   ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME''
 │   ├── MULTI_CARD_FIRMWARE.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── RL_FOR_PACKAGE.img
 │   ├── RL_FOR_PROGRAM.img
 │   ├── SYS_CON_FIRMWARE_01000006.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01010303.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01020302
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01030302.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01040402.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01050002.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01050101.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   └── UPL.xml.pkg
 │       ├── content
 │       ├── info0
 │       └── info1
 ├── update_flags.txt
 ├── version.txt
 └── vsh.tar

For a comparison between Retail and Debug firmware : 3.55 firmware.

3.60 - 4.00[edit | edit source]

 PS3UPDAT.PUP
 ├── dots.txt
 ├── license.xml
 ├── ps3swu2.self
 ├── ps3swu.self 
 ├── spkg_hdr.tar
 │   ├── BDIT_FIRMWARE_PACKAGE.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_301R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_302R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_303R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_304R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_306R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_308R.pkg.spkg_hdr.1
 │   ├── BDPT_FIRMWARE_PACKAGE_310R.pkg.spkg_hdr.1
 │   ├── BLUETOOTH_FIRMWARE.pkg.spkg_hdr.1
 │   ├── CORE_OS_PACKAGE.pkg.spkg_hdr.1
 │   ├── dev_flash_''XXX''.tar.aa.''DATE/TIME''.spkg_hdr.1
 │   ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME''.spkg_hdr.1
 │   ├── MULTI_CARD_FIRMWARE.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01000006.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01010303.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01020302.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01030302.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01040402.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01050002.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_01050101.pkg.spkg_hdr.1
 │   ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg.spkg_hdr.1
 │   └── UPL.xml.pkg.spkg_hdr.1
 ├── update_files.tar
 │   ├── BDIT_FIRMWARE_PACKAGE.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_301R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_302R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_303R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_304R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_306R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_308R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BDPT_FIRMWARE_PACKAGE_310R.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── BLUETOOTH_FIRMWARE.pkg
 │   │   ├── content
 │   │   │   ├── RC29_firmware_footer.dfu
 │   │   │   ├── usb8780-5.0.1-A1-A2.dfu
 │   │   │   └── usb8781-20.0.12.0.dfu
 │   │   ├── info0
 │   │   └── info1
 │   ├── CORE_OS_PACKAGE.pkg
 │   │   ├── aim_spu_module.self
 │   │   ├── creserved_0
 │   │   ├── default.spp
 │   │   ├── emer_init.self
 │   │   ├── eurus_fw.bin
 │   │   ├── hdd_copy.self
 │   │   ├── lv0
 │   │   │   ├── appldr
 │   │   │   ├── isoldr
 │   │   │   ├── lv1ldr
 │   │   │   └── lv2ldr
 │   │   ├── lv0.2
 │   │   ├── lv1.self
 │   │   ├── lv2_kernel.self
 │   │   ├── manu_info_spu_module.self
 │   │   ├── mc_iso_spu_module.self
 │   │   ├── me_iso_for_ps2emu.self (3.70+)
 │   │   ├── me_iso_spu_module.self
 │   │   ├── pkg.srvk
 │   │   ├── prog.srvk
 │   │   ├── sb_iso_spu_module.self
 │   │   ├── sc_iso.self
 │   │   ├── sdk_version
 │   │   ├── spp_verifier.self
 │   │   ├── spu_pkg_rvk_verifier.self
 │   │   ├── spu_token_processor.self
 │   │   ├── spu_utoken_processor.self
 │   │   ├── sv_iso_for_ps2emu.self (3.70+)
 │   │   └── sv_iso_spu_module.self
 │   ├── dev_flash_''XXX''.tar.aa.''DATE/TIME''
 │   ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME''
 │   ├── MULTI_CARD_FIRMWARE.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── RL_FOR_PACKAGE.img
 │   ├── RL_FOR_PROGRAM.img
 │   ├── SYS_CON_FIRMWARE_01000006.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01010303.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01020302
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01030302.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01040402.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01050002.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_01050101.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg
 │   │   ├── content
 │   │   ├── info0
 │   │   └── info1
 │   └── UPL.xml.pkg
 │       ├── content
 │       ├── info0
 │       └── info1
 ├── update_flags.txt
 ├── version.txt
 └── vsh.tar
     └── a

PS Vita[edit | edit source]

preinst - 01.000.000[edit | edit source]

Type Header Information Size
ASCII:MM.mmmm (01.500) [none] version.txt 1
cui_setupper.self SCE (SELF) binary0.self 4536
unknown_lib.sprx SCE (SELF) binary1.self 42
XML license.xml 451
SCE package_file_0.pkg 7904
SCE package_file_1.pkg 8130
SCE package_file_2.pkg 8196
SCE package_file_3.pkg 8196
SCE package_file_4.pkg 8196
SCE package_file_5.pkg 7883
SCE package_file_6.pkg 8052
SCE package_file_7.pkg 6943
SCE package_file_8.pkg 7758
SCE package_file_9.pkg 7805
SCE package_file_10.pkg 7804
SCE package_file_11.pkg 8005
SCE package_file_12.pkg 8103
SCE package_file_13.pkg 8084
SCE package_file_14.pkg 8066
SCE package_file_15.pkg 1661
SCEWM package_file_16.pkg 14
SCEAS package_file_17.pkg 1

systemdata - 01.000.010[edit | edit source]

Type Header Information Size
ASCII:MM.mmmm (01.500) [none] version.txt 1
cui_setupper.self SCE (SELF) binary0.self 4536
unknown_lib.sprx SCE (SELF) binary1.self 42
XML license.xml 451
SCE package_file_0.pkg 2625
SCE package_file_1.pkg 4048
SCE package_file_2.pkg 2746
SCE package_file_3.pkg 3874
SCE package_file_4.pkg 4742
SCE package_file_5.pkg 4660
SCE package_file_6.pkg 3946
SCE package_file_7.pkg 4145
SCE package_file_8.pkg 4630
SCE package_file_9.pkg 5476
SCE package_file_10.pkg 4860
SCE package_file_11.pkg 4722
SCEWM package_scewm.wm 4
SCEAS package_sceas.as 1

full - 01.500.000[edit | edit source]

Type Header Information Size
ASCII:MM.mmmm (01.500) [none] version.txt 1
cui_setupper.self SCE (SELF) binary0.self 4536
unknown_lib.sprx SCE (SELF) binary1.self 42
XML license.xml 451
SCE package_file_0.pkg 634
SCE package_file_1.pkg 6718
SCE package_file_2.pkg 8194
SCE package_file_3.pkg 8194
SCE package_file_4.pkg 8194
SCE package_file_5.pkg 8194
SCE package_file_6.pkg 8194
SCE package_file_7.pkg 8194
SCE package_file_8.pkg 8194
SCE package_file_9.pkg 8194
SCE package_file_10.pkg 8194
SCE package_file_11.pkg 6154
SCEWM package_scewm.wm 4
SCEAS package_sceas.as 1

Tools[edit | edit source]

KaKaRoTo's pup.c tool

PS3UPDAT.PUP
Other Entries
Modifications
Tools
CFW Releases
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Playstation_Update_Package_(PUP)&oldid=73300"