Playstation Update Package (PUP)
Jump to navigation
Jump to search
Description
PUP (Playstation Update Package) files are packages which contain the files used to update a PSP or PS3 system. There are 2 different types: patches (PS3PATCH.PUP) and full updates (PS3UPDAT.PUP). Based on the model, there are 4 different release types: Retail/CEX, Shop/SEX, Debug/DEX and Tool/DECR. Within the Retail/CEX there are 2 file versions: 1 is a PUP with a normal file length which also gets released online. The other PUP file version is the same, except it is zero-filled after the normal PUP content to a fixed filelength of 256MB, which gets released on Gamedisks (if gamecreators build their project to a premaster and give it to Sony for signing, they just use a placeholder of a 256MB PS3UPDAT.PUP which contains no firmwaredata at all - it is completely zerofilled. Sony decides the firmware that gets on the disk and for which firmware the 'Gold' code is signed and mastered).
Location
PSVita
The PSVita and PSVita TV OS can install the update as /PSP2/UPDATE/PSP2UPDAT.PUP or as /PSVITA/UPDATE/PSVUPDAT.PUP.
The update comes from:
http://djp01.psv.update.playstation.net/update/psv/image/image/<YYYY_MMDD>/pre_<md5>/PSVUPDAT.PUP
It is only used by sony on the website. That's why there is no update list on that server.
Download
PUP Download Repositories
Links:
Types
PSVita
There are different types of PSVita PUP:
- full -> core system stuff (majority of partitions are found here, most important ones being os0: and vs0:)
- systemdata -> sa0: location
- preinst -> pd0: location
- devkit / testkit: Debug updates for PTEL-XXXX and PDEL-XXXX do not separate into three different PUPs. A single PUP will update all components. Additionally updates for PDEL units contains updates for the CP and probably other development unit specific components.
Revisions
PSVita
See [1].
Regioning
PS3
There is no regioning in the .PUP files, they are the same for all different regions (if you were looking for regioninfo, see here).
The PS3 however gets the ps3-updatelist.txt from different servers, depending on the region of that model (last 2 numbers in the CECHxxXX SKU name).
- Japan, jp (00 > 0x83)
- USA, us (01 > 0x84)
- Europe, eu (04 > 0x85)
- Korea, kr (05 > 0x86)
- United Kingdom, uk (03 > 0x87)
- Mexico, mx (11 > 0x88)
- Australia/New Zealand, au (02 > 0x89)
- South Asia, sa (Asia except China, Japan, Korea and Taiwan) (06 > 0x8A)
- Taiwan, tw (07 > 0x8B)
- Russia, ru (08 > 0x8C)
- China, cn (09 > 0x8D)
- Hong Kong, hk (10 > 0x8D)
- Brasil, br (11 > 0x8F)
for completeness see Target ID: Reference Tool/DECR : 0x81, Debug/DEX : 0x82, and Arcade : 0xA0
Retail basic structure of the update URL:
http://d<TLD>01.ps3.update.playstation.net/update/ps3/image/<TLD>/YYYY_MMDD_md5/PS3UPDAT.PUP (TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 32-digits long HASH)
Shop update check URL: http://fshop01.ps3.update.playstation.net/update/ps3/list/shop/ps3-updatelist.txt
Content:
# JP(shop) Dest=83;CompatibleSystemSoftwareVersion=4.7600-; Dest=83;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://djp01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # US(shop) Dest=84;CompatibleSystemSoftwareVersion=4.7600-; Dest=84;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dus01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # EU(shop) Dest=85;CompatibleSystemSoftwareVersion=4.7600-; Dest=85;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://deu01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # KR(shop) Dest=86;CompatibleSystemSoftwareVersion=4.7600-; Dest=86;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dkr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # UK(shop) Dest=87;CompatibleSystemSoftwareVersion=4.7600-; Dest=87;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://duk01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # MX(shop) Dest=88;CompatibleSystemSoftwareVersion=4.7600-; Dest=88;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dmx01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # AU/NZ(shop) Dest=89;CompatibleSystemSoftwareVersion=4.7600-; Dest=89;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dau01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # SouthAsia(shop) Dest=8A;CompatibleSystemSoftwareVersion=4.7600-; Dest=8A;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dsa01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # TW(shop) Dest=8B;CompatibleSystemSoftwareVersion=4.7600-; Dest=8B;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dtw01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # RU(shop) Dest=8C;CompatibleSystemSoftwareVersion=4.7600-; Dest=8C;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dru01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30; # CN(shop) Dest=8D;ImageVersion=00000000;SystemSoftwareVersion=0.0000;CDN=http://dcn01.ps3.update.playstation.net/update/ps3/image/shop/nodata;CDN_Timeout=30; # BR(shop) Dest=8F;CompatibleSystemSoftwareVersion=4.7600-; Dest=8F;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dbr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
Shop basic structure of the update URL:
http://d<TLD>01.ps3.update.playstation.net/update/ps3/image/shop/YYYY_MMDD_md5/PS3UPDAT.PUP (TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 22-digits long HASH)
PSVita
Contrarly to PS3, there is no regioning in the .PUP files: they are the same for all different regions.
However, the PSVita gets the psp2-updatelist.xml from different servers, depending on the region of that model.
Retail:
11 jan 2012 :: full 01.520.000 + systemdata 01.000.010 + preinst 01.000.000:
<update_data_list>
<region id="jp">
<np level0_system_version="01.520.000" level1_system_version="01.520.000" level2_system_version="01.520.000"/>
<version system_version="01.520.000" label="01.520">
<update_data update_type="full">
<image size="94646272">
http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/rel_01a72de4dd90191f679f648da8d11a48/PSP2UPDAT.PUP?dest=jp
</image>
</update_data>
</version>
<recovery spkg_type="systemdata">
<image spkg_version="01.000.010" size="56817152">
http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/sd_d48c3a2ca8963ffc7ac01c73e873809c/PSP2UPDAT.PUP?dest=jp
</image>
</recovery>
<recovery spkg_type="preinst">
<image spkg_version="01.000.000" size="128837120">
http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/pre_5899e51b24eb4ab2c985df08bf6c901b/PSP2UPDAT.PUP?dest=jp
</image>
</recovery>
</region>
</update_data_list>
22 dec 2011 :: full 01.510.000 + systemdata 01.000.010 + preinst 01.000.000:
<update_data_list>
<region id="jp">
<np level0_system_version="01.510.000" level1_system_version="01.510.000" level2_system_version="01.510.000"/>
<version system_version="01.510.000" label="01.510">
<update_data update_type="full">
<image size="94500352">
http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/rel_48ac631ecae3837a7530506de0d73eaf/PSP2UPDAT.PUP?dest=jp
</image>
</update_data>
</version>
<recovery spkg_type="systemdata">
<image spkg_version="01.000.010" size="56817152">
http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/sd_52ff6b714e5f701d15938a6fee68fb66/PSP2UPDAT.PUP?dest=jp
</image>
</recovery>
<recovery spkg_type="preinst">
<image spkg_version="01.000.000" size="128837120">
http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/pre_a18a91bb8c86f8c1a101d19fcb15fb6d/PSP2UPDAT.PUP?dest=jp
</image>
</recovery>
</region>
</update_data_list>
14 dec 2011 :: full 01.500.000 + systemdata 01.000.010 + preinst 01.000.000:
<update_data_list>
<region id="jp">
<np level0_system_version="01.500.000" level1_system_version="01.500.000" level2_system_version="01.500.000"/>
<version system_version="01.500.000" label="01.500">
<update_data update_type="full">
<image size="94496256">
http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/rel_f090a69bcf392b5c311b9e786c5cc0b5/PSP2UPDAT.PUP?dest=jp
</image>
</update_data>
</version>
<recovery spkg_type="systemdata">
<image spkg_version="01.000.010" size="56817152">
http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/sd_484243f3964158b38ad1adaac0332a3e/PSP2UPDAT.PUP?dest=jp
</image>
</recovery>
<recovery spkg_type="preinst">
<image spkg_version="01.000.000" size="128837120">
http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/pre_24b5601c3b3aa63b51cf5eaeab718a4c/PSP2UPDAT.PUP?dest=jp
</image>
</recovery>
</region>
</update_data_list>
Shop:
<update_data_list>
<region id="shop">
<np level0_system_version="00.000.000" level1_system_version="00.000.000" level2_system_version="00.000.000"/>
<version system_version="00.000.000">
<update_data update_type="full">
<image>NA</image>
</update_data>
</version>
</region>
</update_data_list>
Retail basic structure of the update URL:
http://d<TLD>01.psp2.update.playstation.net/update/psp2/image/<YYYY_MMDD>/pre_<md5>/PSP2UPDAT.PUP?dest=<TLD> (TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, md5 is 22-digits long HASH)
Installation
To install firmware via USB Mass Storage Devices (e.g. USB-stick, Memory Stick, SD-card, Compact Flash with at least 256MB free), place the PS3UPDAT.PUP file in the following folder structure: /PS3/UPDATE/PS3UPDAT.PUP
- The update location for Kiosk is the same as Retail/CEX.
- The update location for disc media (CD, DVD, BD-ROM) is /PS3_UPDATE/PS3UPDAT.PUP
- The update data for Reference Tool (Tool/DECR) is %SCE_PS3_ROOT%\target\updater\ref-tool\PS3UPDAT.PUP.NNN.0xx
- The update data for Debugging Station (Debug/DEX) is %SCE_PS3_ROOT%\target\updater\debugging_station\PS3UPDAT.PUP.NNN.0xx.forDEX.release.yyyymmdd
- For updating with a single firmware PUP, both the Reference Tool (Tool/DECR) and Debugging Station (Debug/DEX) use the same folder structure as Retail/CEX : /PS3/UPDATE/PS3UPDAT.PUP
- For updating with a multiple firmware PUP (2.50 or later), the Reference Tool (Tool/DECR) can use the folder structure : /PS3/UPDATE/SEARCH with a maximum of 2 sublevels deeper (e.g. PS3/UPDATE/SEARCH/ReferenceTool/250/PS3UPDAT.PUP.242.001). A maximum of 20 PUP files (including /PS3/UPDATE/PS3UPDAT.PUP if applicable) will be shown in the firmware list.
- The update location for Arcade is "/dev_hdd0/game/SCEEXE000/ARCDIR/PS3UPDAT.PUP"
- The update location in Factory Service Mode (used for downgrader and remarry) is /PS3UPDAT.PUP
- The update location for QA Debug setting : System Update Debug=ON is /dev_hdd0/updater/01/PS3UPDAT.PUP, /dev_hdd0/updater/02/PS3UPDAT.PUP, etc... (or up to 20 updates together with any name and no file extension required in /dev_hdd0/updater/01/)
Problem solving / tips
- Don’t use any USB Mass Storage Device with enhanced functions as: encryption, fingerprintreader, U3, pincode etc. (sometimes marketed under names as SCSI Enclosure Services (SES) thus needing drivers and only working under Windows)
- Don’t use USB Mass Storage Devices with a long initialisation time (e.g. some MP3 players)
- Don’t use multipartitioned USB Mass Storage Devices, only use 1 single primary FAT32 partition.
- Make sure they are formatted according to specifications with FAT32 (e.g. HP USB Format Tool – or TOKIWA / Ridgecrop FAT32 formatter)
- If the stick is formatted FAT32 and still not working, consider other stick or use this tool: http://www.pendrivelinux.com/restoring-your-usb-key-partition/
- Most USB Mass Storage Devices that’ll work effortless with PenDrive Linux, will also work with the PS3 (for downgrading, upgrading, storage of your Game dumps and any normal filestorage under the XMB). Those USB Mass Storage Devices are most likely also the ones giving you the least problems under more exotic platforms like PSX/PSone, PS2/PStwo, Xbox/X360, Gamecube/Wii/WiiU etc.
- Make sure no disc is inside the drive otherwise it will try to install that one instead of the one on USB Mass Storage Device!
- Make sure the media is not readonly (e.g. SDcard or USB Stick with readonly tab) if using firmwares when doing one of the following:
- Factory Service Mode reinstallation
- Remarry BDdrive
- RSOD Fix
- or any process that needs to write a log file, in short, write access
Installation descriptive
- Select via XMB, Settings -> System Update
Update via Internet Update via Storage Media
- Select Update via Storage Media
The following update data was found: Version 3.41-@@SUFFIX@@ Location USB Device
- Select OK
User Agreement <str id="msg_update_eula_1">line 1 </str> ... <str id="msg_update_eula_X">line X </str>
- Select right arrow or left joystick right
Do you accept the user agreement? Do Not Accept Accept
- Select right arrow or left joystick right
Main Features Revised in System Software Version 3.41-@@SUFFIX@@ <str id="msg_updater_10">FEATURE 1 </str> ... <str id="msg_updater_X">FEATURE X </str> For detailed information including limitations of usage, visit the SCE Web site for your region.
- msg_updater_10 - msg_updater_60 tested to work. they appear one after another in the same manner as the EULA.
- Could list each feature as a seperate msg_updater_X
Do not turn off the system during the update. If you do, you may not be able to restart the PS3 system. Once the update is started you cannot go back to the previous version of the system software. CHECKBOX Turn off System Automatically After Update START
- Select start to install
Copying update data to the hard disk... Do not turn off the system.
System Update Installing... Do not turn off the system. After the install operation has completed, the system will automatically restart. PROGRESS BAR
Orientation
0x8002F21x - (Set Recovery Mode Flag On (cex/dex/decr)) / (Connecting Controller) 0x8002F22x - (Connect Media containing FW equal or higher) 0x8002F23x - (System Partition formating) / (Search Updater) 0x8002F24x - (Formatting) 0x8002F25x - hdd probing 0x8002F26x - region searching 0x8002F27x - preparing partitions 0x8002F28x - Setup Updating Environment 0x8002F29x - 0x8002F2Ax - 0x8002F2Bx - (Turning Off Recovery Mode Flag) 0x8002F2Cx - Search Updater (Formating preparing Update) 0x8002F2Dx - (Formatting - Preparing to Update) 0x8002F2Ex - (Turning On/Off Recovery Mode Flag)
File structure
Verification
The HMAC key used to verify the packages has been released. Look around for "pup-hmac".
Decryption
To decrypt the files that are unpacked using the tool, the keys are available under Keys.
Extraction
The PSVita and PSVita TV update files can be extracted from .PUP using:
- "PS VITA Firmware xTractor"
- pupunpack from vitatools.
PS3
Header
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x8 | unsigned long | Magic |
| 0x8 | 0x8 | unsigned long | Package Version |
| 0x10 | 0x8 | unsigned long | Image Version |
| 0x18 | 0x8 | unsigned long | File Count |
| 0x20 | 0x8 | unsigned long | Header Length |
| 0x28 | 0x8 | unsigned long | File Length |
| 0x30 | 0x20 * File Count | File Table | File Table |
| 0x30 + (0x20 * File Count) | 0x20 * File Count | Hash Table | Hash Table |
| 0x30 + (0x40 * File Count) | 0x14 | bytes | Header Hash |
| 0x44 + (0x40 * File Count) | 0xC | bytes | Unknown |
File Table
The file table consists of a number of file entries determined by File Count, with the format below:
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x8 | unsigned long | Entry ID |
| 0x8 | 0x8 | unsigned long | Data Offset |
| 0x10 | 0x8 | unsigned long | Data Length |
| 0x18 | 0x8 | unsigned long | Unknown |
Filename IDs
PUPEntryID entries
static const PUPEntryID entries[] = {
{0x100, "version.txt"},
{0x101, "license.xml"},
{0x102, "promo_flags.txt"},
{0x103, "update_flags.txt"},
{0x104, "patch_build.txt"},
{0x200, "ps3swu.self"},
{0x201, "vsh.tar"},
{0x202, "dots.txt"},
{0x203, "patch_data.pkg"},
{0x300, "update_files.tar"},
{0x501, "spkg_hdr.tar"},
{0x601, "ps3swu2.self"},
{0, NULL}
};
| Entry ID | Filename |
|---|---|
| 0x100 | version.txt (aka: ps3version.txt) |
| 0x101 | license.xml (aka: resource.txt? ) |
| 0x102 | promo_flags.txt (only on Template:Shop) (aka: shop.txt?) |
| 0x103 | update_flags.txt |
| 0x104 | patch_build.txt |
| 0x200 | ps3swu.self |
| 0x201 | vsh.tar / font_resource.tar |
| 0x202 | dots.txt |
| 0x203 | patch_data.pkg |
| 0x300 | update_files.tar |
| 0x501 | spkg_hdr.tar (added since FW 3.56) |
| 0x601 | ps3swu2.self (added since FW 3.56) |
Hash Table
The hash table contains a hash entry for every file inside the PUP.
The hash entry format is:
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x8 | unsigned long | File Entry ID |
| 0x8 | 0x14 | bytes | HMAC-SHA1 hash |
| 0x1C | 0x4 | unsigned int | Unknown |
PS3 by kakaroto (to merge)
The following information is a copy/paste from the output of KaKaRoTo's pup.c tool. This is an old build, which does not support 3.56/3.60 and higher added entryid's 0x501 and 0x601.
File Structure
HMAC Key
REDACTED
Header
typedef struct {
uint64_t magic;
uint64_t package_version;
uint64_t image_version;
uint64_t file_count;
uint64_t header_length;
uint64_t data_length;
} PUPHeader;
File Entry
typedef struct {
uint64_t entry_id;
uint64_t data_offset;
uint64_t data_length;
uint8_t padding[8];
} PUPFileEntry;
Hash Entry
typedef struct {
uint64_t entry_id;
uint8_t hash[20];
uint8_t padding[4];
} PUPHashEntry;
Footer
typedef struct
{
uint8_t hash[20];
uint8_t padding[12];
} PUPFooter;
Entry Id
typedef struct {
uint64_t id;
const char *filename;
} PUPEntryID;
PUPEntryID entries
static const PUPEntryID entries[] = {
{0x100, "version.txt"},
{0x101, "license.xml"},
{0x102, "promo_flags.txt"},
{0x103, "update_flags.txt"},
{0x104, "patch_build.txt"},
{0x200, "ps3swu.self"},
{0x201, "vsh.tar"},
{0x202, "dots.txt"},
{0x203, "patch_data.pkg"},
{0x300, "update_files.tar"},
{0x501, "spkg_hdr.tar"},
{0x601, "ps3swu2.self"},
{0, NULL}
};
Contents
| Entry Id | Filename |
|---|---|
| 0x100 | version.txt |
| 0x101 | license.xml |
| 0x102 | promo_flags.txt |
| 0x103 | update_flags.txt |
| 0x104 | patch_build.txt |
| 0x200 | ps3swu.self |
| 0x201 | vsh.tar |
| 0x202 | dots.txt |
| 0x203 | patch_data.pkg |
| 0x300 | update_files.tar |
| 0x501 | spkg_hdr.tar |
| 0x601 | ps3swu2.self |
PSVita
Differences with PS3 PUPs
The file structure of the PSVita PUP files is almost identical to the PS3's, although there is a slight difference in the header and the hash algorithm. Whereas in PS3 the format is big-endian, for the PSVita it is little endian. Also the Format Version field in PSVita PUP is set to 2 where in PS3 PUPs it was set to 1. There is also 0x50 bytes of extra data in the header and the hashes used are of a longer length than in PS3 updates: 0x20 bytes (SHA-256 length) in PSVita versus 0x14 bytes (SHA-1 length) in PS3.
SCEUF Header
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x7 | char[7] | Magic (hex: 53 43 45 55 46 00 00 ~ ASCII "SCEUF") |
| 0x7 | 0x1 | uin8_t | Format Flag |
| 0x8 | 0x2 | uin16_t | Format Version |
| 0xA | 0x6 | char[6] | Padding or unk |
| 0x10 | 0x4 | uin32_t | Sdk Version |
| 0x14 | 0x4 | uin32_t | Build No |
| 0x18 | 0x8 | uin32_t | Segment num |
| 0x1C | 0x4 | uin32_t | Padding or unk |
| 0x20 | 0x8 | uin64_t | Header Length (ex: 0xE00, 0x1000) |
| 0x28 | 0x8 | uin64_t | Data Length ( = (PUP filesize - Header Length) / 0x100 ) |
| 0x30 | 0x50 | UNKNOWN | UNKNOWN, same for all >V1.0 files so far, maybe something for extra security? (or maybe to break a PS3 which tries to read the update)
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000030 02 00 00 00 01 00 00 00 00 00 00 00 02 00 00 00 ................ 00000040 00 00 00 00 0F 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
| 0x80 | 0x20 * File Count | File Table | File Table |
| 0x80 + (0x20 * File Count) | 0x40 * File Count | Hash Table | Hash Table |
| 0x80 + (0x60 * File Count) | 0x20 | bytes | Header Hash (maybe SHA-256?) |
File Table
The file table consists of a number of file entries determined by File Count, with the format below (which is the same as the format in PS3 PUP1 files).
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x8 | unsigned long | Entry ID |
| 0x8 | 0x8 | unsigned long | Data Offset |
| 0x10 | 0x8 | unsigned long | Data Length |
| 0x18 | 0x8 | unsigned long | Unknown |
Filename IDs
| File Entry ID | Filename | Notes |
|---|---|---|
| 0x10 | Version string | |
| 0x101 | license.xml | License XML |
| 0x200 | psp2swu.self | main updater |
| 0x204 | cui_setupper.self | development updater initializer |
| 0x301 | package_data01.pkg | |
| 0x302 | package_data02.pkg | |
| 0x303 | package_data03.pkg | |
| 0x304 | package_data04.pkg | |
| 0x305 | package_data05.pkg | |
| 0x306 | package_data06.pkg | |
| 0x307 | package_data07.pkg | |
| 0x308 | package_data08.pkg | |
| 0x309 | package_data09.pkg | |
| 0x30A | package_data10.pkg | |
| 0x30B | package_data11.pkg | |
| 0x30C | package_data12.pkg | |
| 0x30D | package_data13.pkg | |
| 0x30E | package_data14.pkg | |
| 0x30F | package_data15.pkg | |
| 0x400 | package_scewm.wm | wm means watermark. Same ID for retail PUPs. Different IDs for dev PUPs for each developer. |
| 0x401 | package_sceas.as | Unknown SCEAS magic file |
| 0x2005 | CP firmware in early debug updates only | |
| 0x2006 | CP firmware in debug updates only |
Hash Table
The hash table contains a hash entry for every file inside the PUP.
The hash entry format is:
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x8 | unsigned long | File Index |
| 0x8 | 0x20 | bytes | File Hash (hmac-sha256 algo?) |
| 0x28 | 0x18 | bytes | Unknown |
Embedded files
Here are examples of the files stored in a PUP.
PS3
3.55
PS3UPDAT.PUP ├── dots.txt ├── license.txt ├── ps3swu.self ├── update_files.tar │ ├── BDIT_FIRMWARE_PACKAGE.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── BDPT_FIRMWARE_PACKAGE_301R.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── BDPT_FIRMWARE_PACKAGE_302R.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── BDPT_FIRMWARE_PACKAGE_303R.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── BDPT_FIRMWARE_PACKAGE_304R.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── BDPT_FIRMWARE_PACKAGE_306R.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── BDPT_FIRMWARE_PACKAGE_308R.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── BLUETOOTH_FIRMWARE.pkg │ │ ├── content │ │ │ ├── RC29_firmware_footer.dfu │ │ │ ├── usb8780-5.0.1-A1-A2.dfu │ │ │ └── usb8781-20.0.12.0.dfu │ │ ├── info0 │ │ └── info1 │ ├── CORE_OS_PACKAGE.pkg │ │ ├── aim_spu_module.self │ │ ├── appldr │ │ ├── creserved_0 │ │ ├── default.spp │ │ ├── emer_init.self │ │ ├── eurus_fw.bin │ │ ├── hdd_copy.self │ │ ├── isoldr │ │ ├── lv0 │ │ ├── lv1ldr │ │ ├── lv1.self │ │ ├── lv2_kernel.self │ │ ├── lv2ldr │ │ ├── manu_info_spu_module.self │ │ ├── mc_iso_spu_module.self │ │ ├── me_iso_spu_module.self │ │ ├── sb_iso_spu_module.self │ │ ├── sc_iso.self │ │ ├── sdk_version │ │ ├── spp_verifier.self │ │ ├── spu_pkg_rvk_verifier.self │ │ ├── spu_token_processor.self │ │ ├── spu_utoken_processor.self │ │ └── sv_iso_spu_module.self │ ├── dev_flash_''XXX''.tar.aa.''DATE/TIME'' │ ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME'' │ ├── MULTI_CARD_FIRMWARE.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── RL_FOR_PACKAGE.img │ ├── RL_FOR_PROGRAM.img │ ├── SYS_CON_FIRMWARE_01000006.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── SYS_CON_FIRMWARE_01010303.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── SYS_CON_FIRMWARE_01020302 │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── SYS_CON_FIRMWARE_01030302.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── SYS_CON_FIRMWARE_01040402.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── SYS_CON_FIRMWARE_01050002.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── SYS_CON_FIRMWARE_01050101.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg │ │ ├── content │ │ ├── info0 │ │ └── info1 │ └── UPL.xml.pkg │ ├── content │ ├── info0 │ └── info1 ├── update_flags.txt ├── version.txt └── vsh.tar
For a comparison between Retail and Debug firmware : 3.55 firmware.
3.60 - 4.00
PS3UPDAT.PUP
├── dots.txt
├── license.xml
├── ps3swu2.self
├── ps3swu.self
├── spkg_hdr.tar
│ ├── BDIT_FIRMWARE_PACKAGE.pkg.spkg_hdr.1
│ ├── BDPT_FIRMWARE_PACKAGE_301R.pkg.spkg_hdr.1
│ ├── BDPT_FIRMWARE_PACKAGE_302R.pkg.spkg_hdr.1
│ ├── BDPT_FIRMWARE_PACKAGE_303R.pkg.spkg_hdr.1
│ ├── BDPT_FIRMWARE_PACKAGE_304R.pkg.spkg_hdr.1
│ ├── BDPT_FIRMWARE_PACKAGE_306R.pkg.spkg_hdr.1
│ ├── BDPT_FIRMWARE_PACKAGE_308R.pkg.spkg_hdr.1
│ ├── BDPT_FIRMWARE_PACKAGE_310R.pkg.spkg_hdr.1
│ ├── BLUETOOTH_FIRMWARE.pkg.spkg_hdr.1
│ ├── CORE_OS_PACKAGE.pkg.spkg_hdr.1
│ ├── dev_flash_''XXX''.tar.aa.''DATE/TIME''.spkg_hdr.1
│ ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME''.spkg_hdr.1
│ ├── MULTI_CARD_FIRMWARE.pkg.spkg_hdr.1
│ ├── SYS_CON_FIRMWARE_01000006.pkg.spkg_hdr.1
│ ├── SYS_CON_FIRMWARE_01010303.pkg.spkg_hdr.1
│ ├── SYS_CON_FIRMWARE_01020302.pkg.spkg_hdr.1
│ ├── SYS_CON_FIRMWARE_01030302.pkg.spkg_hdr.1
│ ├── SYS_CON_FIRMWARE_01040402.pkg.spkg_hdr.1
│ ├── SYS_CON_FIRMWARE_01050002.pkg.spkg_hdr.1
│ ├── SYS_CON_FIRMWARE_01050101.pkg.spkg_hdr.1
│ ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg.spkg_hdr.1
│ └── UPL.xml.pkg.spkg_hdr.1
├── update_files.tar
│ ├── BDIT_FIRMWARE_PACKAGE.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── BDPT_FIRMWARE_PACKAGE_301R.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── BDPT_FIRMWARE_PACKAGE_302R.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── BDPT_FIRMWARE_PACKAGE_303R.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── BDPT_FIRMWARE_PACKAGE_304R.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── BDPT_FIRMWARE_PACKAGE_306R.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── BDPT_FIRMWARE_PACKAGE_308R.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── BDPT_FIRMWARE_PACKAGE_310R.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── BLUETOOTH_FIRMWARE.pkg
│ │ ├── content
│ │ │ ├── RC29_firmware_footer.dfu
│ │ │ ├── usb8780-5.0.1-A1-A2.dfu
│ │ │ └── usb8781-20.0.12.0.dfu
│ │ ├── info0
│ │ └── info1
│ ├── CORE_OS_PACKAGE.pkg
│ │ ├── aim_spu_module.self
│ │ ├── creserved_0
│ │ ├── default.spp
│ │ ├── emer_init.self
│ │ ├── eurus_fw.bin
│ │ ├── hdd_copy.self
│ │ ├── lv0
│ │ │ ├── appldr
│ │ │ ├── isoldr
│ │ │ ├── lv1ldr
│ │ │ └── lv2ldr
│ │ ├── lv0.2
│ │ ├── lv1.self
│ │ ├── lv2_kernel.self
│ │ ├── manu_info_spu_module.self
│ │ ├── mc_iso_spu_module.self
│ │ ├── me_iso_for_ps2emu.self (3.70+)
│ │ ├── me_iso_spu_module.self
│ │ ├── pkg.srvk
│ │ ├── prog.srvk
│ │ ├── sb_iso_spu_module.self
│ │ ├── sc_iso.self
│ │ ├── sdk_version
│ │ ├── spp_verifier.self
│ │ ├── spu_pkg_rvk_verifier.self
│ │ ├── spu_token_processor.self
│ │ ├── spu_utoken_processor.self
│ │ ├── sv_iso_for_ps2emu.self (3.70+)
│ │ └── sv_iso_spu_module.self
│ ├── dev_flash_''XXX''.tar.aa.''DATE/TIME''
│ ├── dev_flash3_''XXX''.tar.aa.''DATE/TIME''
│ ├── MULTI_CARD_FIRMWARE.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── RL_FOR_PACKAGE.img
│ ├── RL_FOR_PROGRAM.img
│ ├── SYS_CON_FIRMWARE_01000006.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── SYS_CON_FIRMWARE_01010303.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── SYS_CON_FIRMWARE_01020302
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── SYS_CON_FIRMWARE_01030302.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── SYS_CON_FIRMWARE_01040402.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── SYS_CON_FIRMWARE_01050002.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── SYS_CON_FIRMWARE_01050101.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ ├── SYS_CON_FIRMWARE_S1_00010002083E0832.pkg
│ │ ├── content
│ │ ├── info0
│ │ └── info1
│ └── UPL.xml.pkg
│ ├── content
│ ├── info0
│ └── info1
├── update_flags.txt
├── version.txt
└── vsh.tar
└── a
PSVita
preinst - 01.000.000
| Type | Header | Information | Size |
|---|---|---|---|
| ASCII:MM.mmmm (01.500) | [none] | version.txt | 1 |
| cui_setupper.self | SCE (SELF) | binary0.self | 4536 |
| unknown_lib.sprx | SCE (SELF) | binary1.self | 42 |
| XML | license.xml | 451 | |
| SCE | package_file_0.pkg | 7904 | |
| SCE | package_file_1.pkg | 8130 | |
| SCE | package_file_2.pkg | 8196 | |
| SCE | package_file_3.pkg | 8196 | |
| SCE | package_file_4.pkg | 8196 | |
| SCE | package_file_5.pkg | 7883 | |
| SCE | package_file_6.pkg | 8052 | |
| SCE | package_file_7.pkg | 6943 | |
| SCE | package_file_8.pkg | 7758 | |
| SCE | package_file_9.pkg | 7805 | |
| SCE | package_file_10.pkg | 7804 | |
| SCE | package_file_11.pkg | 8005 | |
| SCE | package_file_12.pkg | 8103 | |
| SCE | package_file_13.pkg | 8084 | |
| SCE | package_file_14.pkg | 8066 | |
| SCE | package_file_15.pkg | 1661 | |
| SCEWM | package_file_16.pkg | 14 | |
| SCEAS | package_file_17.pkg | 1 |
systemdata - 01.000.010
| Type | Header | Information | Size |
|---|---|---|---|
| ASCII:MM.mmmm (01.500) | [none] | version.txt | 1 |
| cui_setupper.self | SCE (SELF) | binary0.self | 4536 |
| unknown_lib.sprx | SCE (SELF) | binary1.self | 42 |
| XML | license.xml | 451 | |
| SCE | package_file_0.pkg | 2625 | |
| SCE | package_file_1.pkg | 4048 | |
| SCE | package_file_2.pkg | 2746 | |
| SCE | package_file_3.pkg | 3874 | |
| SCE | package_file_4.pkg | 4742 | |
| SCE | package_file_5.pkg | 4660 | |
| SCE | package_file_6.pkg | 3946 | |
| SCE | package_file_7.pkg | 4145 | |
| SCE | package_file_8.pkg | 4630 | |
| SCE | package_file_9.pkg | 5476 | |
| SCE | package_file_10.pkg | 4860 | |
| SCE | package_file_11.pkg | 4722 | |
| SCEWM | package_scewm.wm | 4 | |
| SCEAS | package_sceas.as | 1 |
full - 01.500.000
| Type | Header | Information | Size |
|---|---|---|---|
| ASCII:MM.mmmm (01.500) | [none] | version.txt | 1 |
| cui_setupper.self | SCE (SELF) | binary0.self | 4536 |
| unknown_lib.sprx | SCE (SELF) | binary1.self | 42 |
| XML | license.xml | 451 | |
| SCE | package_file_0.pkg | 634 | |
| SCE | package_file_1.pkg | 6718 | |
| SCE | package_file_2.pkg | 8194 | |
| SCE | package_file_3.pkg | 8194 | |
| SCE | package_file_4.pkg | 8194 | |
| SCE | package_file_5.pkg | 8194 | |
| SCE | package_file_6.pkg | 8194 | |
| SCE | package_file_7.pkg | 8194 | |
| SCE | package_file_8.pkg | 8194 | |
| SCE | package_file_9.pkg | 8194 | |
| SCE | package_file_10.pkg | 8194 | |
| SCE | package_file_11.pkg | 6154 | |
| SCEWM | package_scewm.wm | 4 | |
| SCEAS | package_sceas.as | 1 |
| |||||||||||||||||||||
