SLB2

SLB2 structure

PS4 SLB PUP container format - SKFU

 /* file structure of SLB goes as following, if unpacking make sure you use 64 bits little endian on windows os */
 typedef unsigned char u8;
 typedef unsigned long int u32;
 typedef unsigned long long int u64;
 
 typedef struct{
 	u32 offset; //1 block is headersize (512 padded)
 	u32 cryptSize;
 	u64 reserved; //probably file alignment
 	u8 fileName[32];
 } fileEntry;
 
 typedef struct{
 	u32 magic; //SLB2
 	u64 version; //1
 	u32 fileCount;
 	u32 blockCount;
 	u8 reserved[12];
 	fileEntry files[10];
 } ps4pup;

SLB2 files to play with

1.500.000:

• http://www.mirrorcreator.com/files/056CKD7J/PS4UPDATE.PUP.rar_links

* https://mega.co.nz/#!WE8zUAyb!ZuZy5Vxrd4eCc4bTvFW_ZC7lu7Ub0tcdyE08xbJtrok (Main)

• https://mega.co.nz/#!GEdQkRRR!KSCLLQEGlWfQwsA3yBo3pkZqqqE6w-Jwk-5CvLd4GR0 (Recovery)

1.501.000 :

• http://dus01.ps4.update.playstation.net/update/ps4/image/2013_1112/sys_df008b5601f4a214a3cc65030a02ac4a/PS4UPDATE.PUP?dest=us (Main)
• http://dus01.ps4.update.playstation.net/update/ps4/image/2013_1112/rec_cedada625478db608d5878c019454380/PS4UPDATE.PUP?dest=us (Recovery)

Unpacking

• http://pastie.org/private/4wgojewhp2pq7declhkhw (flatz)
• PS4 PUP Extractor v2 (xerpi)
• PS4 FW Tool v1.0.0 (skfu)
• https://github.com/Hykem/ps4tools (hykem, based on flatz)
• https://github.com/Jakes625/PS4-PUP-Tool (Jakes625)

SLB PUP Files

These files are contained inside of SLB2 containers. They contain data pertaining to system firmware.

You are able to decrypt inner pup files using the follow keys: erk=DB7A24EC38BDB45B98CCD7D363EA2AF0C326E65081E0630CB9AB2D215865878A riv=C9205F46F6021697E670F13DFA726212 pub=A8FD6DB24532D094EFA08BD35C9A72287D905C6B27B42BE4AB925AAF4AFFF34D41EEB54DD128700D priv=001AD976FCDE86F5B8F63453EF3A7F94E861975BA3 ctype=30

1st 40 bytes are encrypted with aes-256-cbc and the result is used as erk and riv for the next 240 bytes.now that is decrypted through aes-128-ctr and now you can find the location for encrypted sections+hmac key+erk/riv keys the rest sections are also encrypted with aes-128-ctr