PUP: Difference between revisions

From PS4 Developer wiki
Jump to navigation Jump to search
 
(35 intermediate revisions by 5 users not shown)
Line 1: Line 1:
PUP (Playstation Update Package) is the file format of the PSP, PS3, PSVita and PS4 system software update packages.
PUP (Playstation Update Package) is the file format of the PSP, PS3, PSVita, PS4, and PS5 system software update packages. It contains updated firmware and files for devices such as the GameOS, Syscon, Wi-Fi, Bluetooth, Communication Processor, Southbridge, Bluray Drive, and more.


PUP embed updates for devices such as the GameOS, Syscon, Wi-Fi, Bluetooth, Communication Processor, Southbridge, BD drive.
== PUP Structure ==


== Structure ==
PS4 update files differ from previous PlayStation consoles in that they embed multiple PUP fragments. The "main" file that is distributed and downloaded to the PS4 console is a SLB2-packed (or "BLS") file which contains PUP fragment files. On retail and TestKit, it typically contains two PUPs (`PS4UPDATE1.PUP` and `PS4UPDATE2.PUP`), while DevKit may have four. These PS4 PUP files are similar in structure to PS4 Signed ELFs (SELFs). Each PUP fragment is responsible for containing different sets of files.


PS4 PUP is special because it embeds single other PUPs.
* PS4UPDATE1 is the "core" update file and contains updates for GameOS/x86 kernel and usermode, Bluray Drive, EAP, EMC, Syscon, SAM, and other firmware stored on the SPI flash.
* PS4UPDATE2 contains the `system_ex` partition of system applications.
* PS4UPDATE3 (DevKit only) contains the preinstall image for DevKit.
* PS4UPDATE4 (DevKit only) contains a seemingly empty preinstall part 2 image for DevKit (maybe reserved?).


=== Header ===
All PUP fragments contain the end-user license agreement, the Orbis Software Updater (orbis_swu), and a watermark.


Have a feeling the header for the new PS4 PUPs ends with a LZMA dictionary and file size… (ie a normal lzma header without the properties byte) anyone else done research into that? As in:
=== File Header ===
 
The file header for the main PUP file is an SLB2 file. Each PUP fragment packed into it has the following header (note: after the initial 0x10 bytes, the remaining 0x10 bytes are encrypted along with the metadata that follows it).
 
<source lang="c">
struct ScePupHeader {
uint32_t magic;                 // 0x00 - PS4PUPMAGIC "\x4F\x15\x3D\x1D"
uint16_t version;              // 0x04 - Big Endian (??)
uint16_t unknown_one;          // 0x06
uint16_t unknown_two;          // 0x08
uint16_t flags;                // 0x0A
uint16_t header_size;          // 0x0C
uint16_t metadata_size;        // 0x0E
 
// From this point on, the header is encrypted...
uint16_t file_size;            // 0x10
uint16_t segment_count;        // 0x18
uint16_t metadata_entries;      // 0x1A
uint32_t unknown_three;        // 0x1C
}; // Size: 0x20
</source>
 
=== Segments ===
 
From this point on, the remaining structures are encrypted in raw update files (though this section can be seen by using the system as an oracle to decrypt PUPs). Following the header is the segment table, which has segment entries that contain information about update entries (a list of which can be found in the "Indices" section).
 
<source lang="c">
struct ScePupSegmentHeader {
uint64_t flags;                // 0x00
uint64_t offset;                // 0x08
uint64_t compressed_size;      // 0x10
uint64_t uncompressed_size;    // 0x18
}; // Size: 0x20
</source>
 
While offset, compressed_size, and uncompressed_size fields are self-explanatory, the flags field packs a lot of information. Below are known flags:
 
<source lang="c">
#define PUP_SEGMENT_ID(x)                  (x->flags >> 20)
#define PUP_SEGMENT_IS_INFO(x)              ((x->flags & (1 << 0)) != 0)
#define PUP_SEGMENT_IS_ENCRYPTED(x)        ((x->flags & (1 << 1)) != 0)
#define PUP_SEGMENT_IS_SIGNED(x)            ((x->flags & (1 << 2)) != 0)
#define PUP_SEGMENT_IS_COMPRESSED(x)        ((x->flags & (1 << 3)) != 0)
#define PUP_SEGMENT_HAS_BLOCKS(x)          ((x->flags & (1 << 11)) != 0)
#define PUP_SEGMENT_HAS_DIGESTS(x)          ((x->flags & (1 << 16)) != 0)
#define PUP_SEGMENT_BLOCK_SIZE(x)          (1 << (((x->flags >> 12) & 0xF) + PAGE_SHIFT)) // Note: PAGE_SHIFT = 0xC
</source>
 
In most cases (ie. "data" segments as opposed to info segments), the segment ID indicates the type of firmware or file to update (see [[#Indices]] table). In the case of info segments, the segment ID points to the index of the "data" segment it contains information for. Info segments are typically only seen when the file or firmware utilizes block-based segments.
 
=== PUP Info ===
 
After the segment table is a section that has additional information on the PUP, such as its target firmware and various flags.


<source lang="c">
<source lang="c">
struct PUPPS4Header {
struct ScePupInfo {
uint32_t magic; // PS4PUPMAGIC "\x4F\x15\x3D\x1D"
uint32_t fw_ver;               // 0x00 - Firmware version in integer format (ie. FW 9.50 is 0x95080000000)
uint16_t version; // Big Endian (??)
char unknown_one[0x14];         // 0x04
uint16_t unknownOne;
uint32_t type;                 // 0x18 - Beta/Retail/Testkit/Devkit/Proto
uint16_t unknownTwo;
char unknown_two[0x4];         // 0x1C
uint16_t unknownThree;
uint32_t flags;                 // 0x20
uint32_t dictSize; // LE afaics
uint32_t req_fw_ver;           // 0x24
uint32_t uncompressedSize; // LE afaics
char unknown_three[0x8];       // 0x28
}
}
</source>
</source>
=== Metadata ===
Following the info structure is the metadata table. These entries contain crypto material such as intermediate keys for decrypting and verifying segments. Each segment should have a metadata table entry.
<source lang="c">
struct ScePupMetadataEntry {
char aes128_key[0x10];          // 0x00 - AES128 data decryption key
char aes128_iv[0x10];          // 0x10 - AES128 data decryption initialization vector
char digest[0x20];              // 0x20 - SHA256 digest
char digest_key[0x10];          // 0x40 - SHA256 digest HMAC key
}; // Size: 0x50
</source>
=== Unpacking Notes ===
* Encryption is applied on segments post-compression.
* Non-blocked segments are a straight copy or decompression operation.
* Processing blocked segments requires looking up the accompanying info segments and parsing the block tables within them.
* Large disk images and most SLB2/BLS files will be block-based.


== Tools ==
== Tools ==
Line 27: Line 102:
=== Decrypter (first step) ===
=== Decrypter (first step) ===


* [https://github.com/idc/ps4-pup_decrypt ps4-pup_decrypt by idc]
* [https://github.com/zecoxao/ps5-pup-decrypt PS5 PUP decryptor based on the one for PS4 (2022-10-14 to 2024-05-25)]
* [https://github.com/EchoStretch/ps4-pup-decrypt PS4 PUP decryptor based on idc's by EchoStretch (2024-06-07)]
* [https://github.com/andy-man/ps4-pup-decrypt PS4 PUP decryptor based on idc's by andy-man (2024-04-07)]
* [https://github.com/Creeeeger/PS4-dec PS4 PUP decryptor based on idc's by Creeger (2024-02-20)]
* [https://github.com/SocraticBliss/ps4-pup_decrypt PS4 PUP decryptor based on idc's by SocraticBliss and l0lhax (2019-05-28)]
* [https://github.com/idc/ps4-pup_decrypt ps4-pup_decrypt by idc (2016-06-05 to 2017-11-24)]


=== Unpacker (second step) ===
=== Unpacker (second step) ===


* [https://github.com/idc/ps4-pup_unpack ps4-pup-unpack by idc]
* [https://github.com/seregonwar/PFU-PupFileUnpacker PupFileUnpacker by seregonwar (2023-04-08 to 2024-09-30)] (based on ps4_dec_pup_info by SocraticBliss)
* [https://github.com/Zer0xFF/ps4-pup-unpacker ps4-pup-unpacker by Zer0xFF] (based on ps4-pup-unpack by idc)
* [https://github.com/SocraticBliss/ps4_dec_pup_info ps4_dec_pup_info by SocraticBliss (2020-09-23)]
* [https://github.com/Zer0xFF/ps4-pup-unpacker ps4-pup-unpacker by Zer0xFF (2017-11-24 to 2018-01-14)] (based on ps4-pup-unpack by idc)
* [https://github.com/idc/ps4-pup_unpack ps4-pup-unpack by idc (2016-06-05 to 2017-12-12)]


== Indices ==


== Indices ==
{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
! Index !! Decimal !! Description !! Perconsole ? !! Notes !! Added !! Deprecated?
! Index !! Decimal !! Description !! Perconsole? !! Notes !! Added !! Deprecated? || Cipher Note || Component Name
|-
| 1 || 1 || EMC IPL || {{no}} || sflash0s0x32/b Aeolia 1st Revision || [[0.910.040]] || {{yes}} , since 2.00 || Same body as 0x0D || ??
|-
| 2 || 2 || EAP KBL || {{no}} || sflash0s0x33 Aeolia 1st Revision || [[0.910.040]] || {{yes}} , since 2.00 || Same body as 0x0E || ??
|-
|-
| 1 || 1 || EMC IPL || NO || sflash0s0x32/b Aeolia 1st Revision || 0_910_040 ||  
| 3 || 3 || WIFI FW || {{no}} || torus2 Aeolia A2 || [[0.910.040]] || || || --
|-
|-
| 2 || 2 || EAP KBL || NO || sflash0s0x33 Aeolia 1st Revision || 0_910_040 ||
| 4 || 4 || SECURE LOADER || {{yes}} || sflash0s1.cryptx2/b 1st SOCUID || [[0.910.040]] || || (Confirmed by anon) Same body as 0x23 || [[CXD90026G]]
|-
|-
| 3 || 3 || WIFI FW || NO || torus2 || 0_910_040 ||
| 5 || 5 || COREOS || {{no}} || secure_modules || [[0.910.040]] || || || GEN1,2,3 Universal
|-
|-
| 4 || 4 || SAM IPL || YES || sflash0s1.cryptx2/b 1st SOCUID || 0_910_040 ||
| 6 || 6 || SYSTEM || {{no}} || system fs (FAT32/TEXFAT later)  || [[0.910.040]] || || || GEN1,2,3 Universal
|-
|-
| 5 || 5 || COREOS || NO || secure_modules || 0_910_040 ||
| 7 || 7 || EAP KERNEL || {{no}} || da0x2 || [[0.910.040]] || || || GEN1,2,3 Universal
|-
|-
| 6 || 6 || SYSTEM || NO || system fs (FAT32/TEXFAT later) || 0_910_040 ||
| 8 || 8 || EAP VSH || {{no}} || eap_vsh fs (FAT16) || [[0.910.040]] || || || GEN1,2,3 Universal
|-
|-
| 7 || 7 || EAP KERNEL || NO || da0x2 || 0_910_040 ||
| 9 || 9 || PREINST || {{no}} || preinst fs (FAT32) || [[0.910.040]] || || || GEN1,2,3 Universal
|-
|-
| 8 || 8 || EAP VSH || NO || eap_vsh fs (FAT16) || 0_910_040 ||
| 0xA || 10 || ??? || {{no}} || sflash0s1.cryptx40 || {{no}} || || || ??
|-
|-
| 9 || 9 || PREINST || NO || preinst fs (FAT32) || 0_910_040 ||
| 0xB || 11 || PREINST2 || {{no}} || preinst2 fs (FAT32) || [[0.910.040]] || || || GEN1,2,3 Universal
|-
|-
| 0xA || 10 || ??? || NO || sflash0s1.cryptx40 || ||
| 0xC || 12 || SYSTEM_EX || {{no}} || system_ex fs (FAT32/TEXFAT later) || [[0.910.040]] || || || GEN1,2,3 Universal
|-
|-
| 0xB || 11 || PREINST2 || NO || preinst2 fs (FAT32) || 0_910_040 ||
| 0xD || 13 || EMC IPL || {{no}} || sflash0s0x32/b Aeolia A2 || [[0.910.040]] || || Same body as 0x1 || [[CXD90025G]]
|-
|-
| 0xC || 12 || SYSTEM_EX || NO || system_ex fs (FAT32/TEXFAT later) || 0_910_040 ||
| 0xE || 14 || EAP KBL || {{no}} || sflash0s0x33 Aeolia A2 || [[0.910.040]] || || Same body as 0x2 || [[CXD90025G]]
|-
|-
| 0xD || 13 || EMC IPL || NO || sflash0s0x32/b Aeolia 2nd Revision || 0_910_040 ||
| 0xF || 15 || ??? || {{no}} || test || {{no}} || || || ??
|-
|-
| 0xE || 14 || EAP KBL || NO || sflash0s0x33 Aeolia 2nd Revision || 0_910_040 ||
| 0x10-0x16 || 16-22 || ??? || {{no}} || sbram0 || {{no}} || || || ??
|-
|-
| 0xF || 15 || ??? || NO || test || ||
| 0x20 || 32 || EMC IPL || {{no}} || sflash0s0x32/b Belize 1st Revision || 2.00 || || Same body as 0x2A || [[CXD90036G]]
|-
|-
| 0x10-0x16 || 16-22 || ??? || NO || sbram0 || ||
| 0x21 || 33 || EAP KBL || {{no}} || sflash0s0x33 Belize 1st Revision || 2.00 || ||  Same body as 0x2B and 0x25 || [[CXD90036G]]
|-
|-
| 0x20 || 32 || EMC IPL || NO || sflash0s0x32/b Belize 1st Revision || ||
| 0x22 || 34 || WIFI FW || {{no}} || torus2 || 2.00 || || || ??
|-
|-
| 0x21 || 33 || EAP KBL || NO || sflash0s0x33 Belize 1st Revision || ||
| 0x23 || 35 || SECURE LOADER || {{yes}} || sflash0s1.cryptx2/b 2nd SOCUID || 2.00 || || (Confirmed by anon) Same body as 0x04 || [[CXD90026AG]]
|-
|-
| 0x22 || 34 || WIFI FW || NO || torus2 || ||
| 0x24 || 36 || EMC IPL || {{no}} || sflash0s0x32/b Baikal B1  || 3.00 || || || [[CXD90046GG]]
|-
|-
| 0x23 || 35 || SAM IPL || YES || sflash0s1.cryptx2/b 2nd SOCUID || ||
| 0x25 || 37 || EAP KBL || {{no}} || sflash0s0x33 Baikal B1  || 3.00 || || Same body as 0x2B and 0x21 || [[CXD90046GG]]
|-
|-
| 0x24 || 36 || EMC IPL || NO || sflash0s0x32/b Belize 2nd Revision || ||
| 0x26 || 38 || SECURE LOADER || {{yes}} || sflash0s1.cryptx2/b 3rd SOCUID || 3.00 || || (Confirmed by anon) Same body as 0x2D and 0x32 || [[CXD90037G]]
|-
|-
| 0x25 || 37 || EAP KBL || NO || sflash0s0x33 Belize 2nd Revision || ||
| 0x27 || 39 || SECURE LOADER || {{yes}} || sflash0s1.cryptx2/b 4th SOCUID || 3.00 || || (Confirmed by anon) Same body as 0x31 || [[CXD90043GB]]
|-
|-
| 0x26 || 38 || SAM IPL || YES || sflash0s1.cryptx2/b 3rd SOCUID || ||
| 0x28 || 40 || EMC IPL || {{no}} || sflash0s0x32/b Baikal 1st Revision || 3.00 || || Same body as 0x2C ||
|-
|-
| 0x27 || 39 || SAM IPL || YES || sflash0s1.cryptx2/b 4th SOCUID || ||
| 0x2A || 42 || EMC IPL || {{no}} || sflash0s0x32/b Belize 2 A0  || 4.00 ||  || Same body as 0x20 ||
|-
|-
| 0x28 || 40 || EMC IPL || NO || sflash0s0x32/b Belize 2 1st Revision || ||
| 0x2B || 43 || EAP KBL || {{no}} || sflash0s0x33 Belize 2 A0 || 4.00 || || Same body as 0x25 and 0x21 ||
|-
|-
| 0x2A || 42 || EMC IPL || NO || sflash0s0x32/b Belize 2 2nd Revision || ||
| 0x2C || 44 || EMC IPL || {{no}} || sflash0s0x32/b Baikal2 1st Revision || 4.00 || || Same body as 0x28 ||
|-
|-
| 0x2B || 43 || EAP KBL || NO || sflash0s0x33 Belize 2 1st/2nd Revision || ||
| 0x2D || 45 || SECURE LOADER || {{yes}} || sflash0s1.cryptx2/b 5th SOCUID || 4.50 || || (Confirmed by anon) Same body as 0x26 and 0x32 || [[CXD90044GB]]
|-
|-
| 0x2C || 44 || EMC IPL || NO || sflash0s0x32/b Baikal 1st Revision || ||
| 0x2E || 46 || EMC IPL || {{no}} || sflash0s0x32/b Belize2 3rd Revision?  || 5.00 || || ||
|-
|-
| 0x2D || 45 || SAM IPL || YES || sflash0s1.cryptx2/b 5th SOCUID || ||
| 0x30 || 48 || WIFI FW || {{no}} || sflash0s0x38 trooper Belize 2 A0 || 5.00 || || || --
|-
|-
| 0x2E || 46 || EMC IPL || NO || sflash0s0x32/b Baikal 2nd Revision || ||
| 0x31 || 49 || SECURE LOADER || {{yes}} || sflash0s1.cryptx2/b 6th SOCUID || 5.50 || || (Confirmed by anon) Same body as 0x27 || [[CXD90051GB]]
|-
|-
| 0x30 || 48 || WIFI FW || NO || sflash0s0x38 trooper || ||
| 0x32 || 50 || SECURE LOADER || {{yes}} || sflash0s1.cryptx2/b 7th SOCUID || 6.50 || || (Confirmed by anon) Same body as 0x26 and 0x2D || [[CXD90055GB]]
|-
|-
| 0x101 || 257 || EULA.XML || NO || Sony Agreement XML || 1.00 ||
| 0x101 || 257 || EULA.XML || {{no}} || Sony Agreement XML || 1.00 || || || Universal
|-
|-
| 0x200 || 512 || ORBIS_SWU.SELF || NO || Sony SoftWareUpdater (ELF) || 0_910_040 ||
| 0x200 || 512 || ORBIS_SWU.SELF || {{no}} || Sony SoftWareUpdater (ELF) || [[0.910.040]] || || || Universal
|-
|-
| 0x202 || 514 || ORBIS_SWU.SELF || NO || Sony SoftWareUpdater (Encrypted SELF) || 0_920_030 ||
| 0x202 || 514 || ORBIS_SWU.SELF || {{no}} || Sony SoftWareUpdater (Encrypted SELF) || [[0.920.030]] || || || Universal
|-
|-
| 0x301 || 769 || ??? || NO || /update related || ||
| 0x301 || 769 || ??? || {{no}} || /update related || {{no}} || || || ??
|-
|-
| 0x302 || 770 || ??? || NO || /update related || ||
| 0x302 || 770 || ??? || {{no}} || /update related || {{no}} || || || ??
|-
|-
| 0xD00 || 3328 || SYSCON FW || NO || sc_fw_update0 firmware (4000XXXX)  || 0_915_010 ||
| 0xD00 || 3328 || SYSCON FW || {{no}} || sc_fw_update0 firmware (4000XXXX)  || [[0.915.010]] || || || Universal Syscon
|-
|-
| 0xD01 || 3329 || BLURAY FW || NO || bluray firmware (all revisions) (4XXR) || 0_920_030 ||
| 0xD01 || 3329 || BLURAY DRIVE FW || {{no}} || Bluray drive firmware (all revisions) (4XXR) || [[0.920.030]] || || || Universal Bluray Drive
|-
|-
| 0xD02 || 3330 || USB SATA BRIDGE FW || NO || usb sata bridge firmware (da0) || 1.00 ||
| 0xD02 || 3330 || USB SATA BRIDGE FW || {{no}} || USB SATA bridge firmware (da0) || 1.00 || || || [[MB86C311B]]
|-
|-
| 0xD07 || 3335 || SYSCON PATCH || NO || sc_fw_update0 patch (4001XXXX)  || ||
| 0xD07 || 3335 || SYSCON PATCH || {{no}} || sc_fw_update0 patch (4001XXXX)  || 2.50 Test/Retail || || || Universal Syscon
|-
|-
| 0xD08 || 3336 || SYSCON FW || NO || sc_fw_update0 firmware (4000XXXX)  || ||
| 0xD08 || 3336 || SYSCON FW || {{no}} || sc_fw_update0 firmware (4000XXXX)  || 1.00 Devkit || || || Universal Syscon
|-
|-
| 0xD09 || 3337 || COMMUNICATION PROCESSOR FW || NO || cpfirm || 3.50 Devkit ||
| 0xD09 || 3337 || COMMUNICATION PROCESSOR FW || {{no}} || cpfirm || 3.50 Devkit || || || Neo DevKit Component (unknown)
|-
|-
|}
|}

Latest revision as of 02:28, 26 October 2024

PUP (Playstation Update Package) is the file format of the PSP, PS3, PSVita, PS4, and PS5 system software update packages. It contains updated firmware and files for devices such as the GameOS, Syscon, Wi-Fi, Bluetooth, Communication Processor, Southbridge, Bluray Drive, and more.

PUP Structure[edit | edit source]

PS4 update files differ from previous PlayStation consoles in that they embed multiple PUP fragments. The "main" file that is distributed and downloaded to the PS4 console is a SLB2-packed (or "BLS") file which contains PUP fragment files. On retail and TestKit, it typically contains two PUPs (`PS4UPDATE1.PUP` and `PS4UPDATE2.PUP`), while DevKit may have four. These PS4 PUP files are similar in structure to PS4 Signed ELFs (SELFs). Each PUP fragment is responsible for containing different sets of files.

  • PS4UPDATE1 is the "core" update file and contains updates for GameOS/x86 kernel and usermode, Bluray Drive, EAP, EMC, Syscon, SAM, and other firmware stored on the SPI flash.
  • PS4UPDATE2 contains the `system_ex` partition of system applications.
  • PS4UPDATE3 (DevKit only) contains the preinstall image for DevKit.
  • PS4UPDATE4 (DevKit only) contains a seemingly empty preinstall part 2 image for DevKit (maybe reserved?).

All PUP fragments contain the end-user license agreement, the Orbis Software Updater (orbis_swu), and a watermark.

File Header[edit | edit source]

The file header for the main PUP file is an SLB2 file. Each PUP fragment packed into it has the following header (note: after the initial 0x10 bytes, the remaining 0x10 bytes are encrypted along with the metadata that follows it). 

struct ScePupHeader {
	uint32_t magic;	                // 0x00 - PS4PUPMAGIC "\x4F\x15\x3D\x1D"
	uint16_t version;               // 0x04 - Big Endian (??)
	uint16_t unknown_one;           // 0x06
	uint16_t unknown_two;           // 0x08
	uint16_t flags;                 // 0x0A
	uint16_t header_size;           // 0x0C
	uint16_t metadata_size;         // 0x0E

	// From this point on, the header is encrypted...
	uint16_t file_size;             // 0x10
	uint16_t segment_count;         // 0x18
	uint16_t metadata_entries;      // 0x1A
	uint32_t unknown_three;         // 0x1C
}; // Size: 0x20

Segments[edit | edit source]

From this point on, the remaining structures are encrypted in raw update files (though this section can be seen by using the system as an oracle to decrypt PUPs). Following the header is the segment table, which has segment entries that contain information about update entries (a list of which can be found in the "Indices" section). 

struct ScePupSegmentHeader {
	uint64_t flags;                 // 0x00
	uint64_t offset;                // 0x08
	uint64_t compressed_size;       // 0x10
	uint64_t uncompressed_size;     // 0x18
}; // Size: 0x20

While offset, compressed_size, and uncompressed_size fields are self-explanatory, the flags field packs a lot of information. Below are known flags: 

#define PUP_SEGMENT_ID(x)                   (x->flags >> 20)
#define PUP_SEGMENT_IS_INFO(x)              ((x->flags & (1 << 0)) != 0)
#define PUP_SEGMENT_IS_ENCRYPTED(x)         ((x->flags & (1 << 1)) != 0)
#define PUP_SEGMENT_IS_SIGNED(x)            ((x->flags & (1 << 2)) != 0)
#define PUP_SEGMENT_IS_COMPRESSED(x)        ((x->flags & (1 << 3)) != 0)
#define PUP_SEGMENT_HAS_BLOCKS(x)           ((x->flags & (1 << 11)) != 0)
#define PUP_SEGMENT_HAS_DIGESTS(x)          ((x->flags & (1 << 16)) != 0)
#define PUP_SEGMENT_BLOCK_SIZE(x)           (1 << (((x->flags >> 12) & 0xF) + PAGE_SHIFT)) // Note: PAGE_SHIFT = 0xC

In most cases (ie. "data" segments as opposed to info segments), the segment ID indicates the type of firmware or file to update (see #Indices table). In the case of info segments, the segment ID points to the index of the "data" segment it contains information for. Info segments are typically only seen when the file or firmware utilizes block-based segments.

PUP Info[edit | edit source]

After the segment table is a section that has additional information on the PUP, such as its target firmware and various flags. 

struct ScePupInfo {
	uint32_t fw_ver;                // 0x00 - Firmware version in integer format (ie. FW 9.50 is 0x95080000000)
	char unknown_one[0x14];         // 0x04
	uint32_t type;                  // 0x18 - Beta/Retail/Testkit/Devkit/Proto
	char unknown_two[0x4];          // 0x1C
	uint32_t flags;                 // 0x20
	uint32_t req_fw_ver;            // 0x24
	char unknown_three[0x8];        // 0x28
}

Metadata[edit | edit source]

Following the info structure is the metadata table. These entries contain crypto material such as intermediate keys for decrypting and verifying segments. Each segment should have a metadata table entry. 

struct ScePupMetadataEntry {
	char aes128_key[0x10];          // 0x00 - AES128 data decryption key
	char aes128_iv[0x10];           // 0x10 - AES128 data decryption initialization vector
	char digest[0x20];              // 0x20 - SHA256 digest
	char digest_key[0x10];          // 0x40 - SHA256 digest HMAC key
}; // Size: 0x50

Unpacking Notes[edit | edit source]

  • Encryption is applied on segments post-compression.
  • Non-blocked segments are a straight copy or decompression operation.
  • Processing blocked segments requires looking up the accompanying info segments and parsing the block tables within them.
  • Large disk images and most SLB2/BLS files will be block-based.

Tools[edit | edit source]

Decrypter (first step)[edit | edit source]

Unpacker (second step)[edit | edit source]

Indices[edit | edit source]

Index Decimal Description Perconsole? Notes Added Deprecated? Cipher Note Component Name
1 1 EMC IPL No sflash0s0x32/b Aeolia 1st Revision 0.910.040 Yes , since 2.00 Same body as 0x0D ??
2 2 EAP KBL No sflash0s0x33 Aeolia 1st Revision 0.910.040 Yes , since 2.00 Same body as 0x0E ??
3 3 WIFI FW No torus2 Aeolia A2 0.910.040 --
4 4 SECURE LOADER Yes sflash0s1.cryptx2/b 1st SOCUID 0.910.040 (Confirmed by anon) Same body as 0x23 CXD90026G
5 5 COREOS No secure_modules 0.910.040 GEN1,2,3 Universal
6 6 SYSTEM No system fs (FAT32/TEXFAT later) 0.910.040 GEN1,2,3 Universal
7 7 EAP KERNEL No da0x2 0.910.040 GEN1,2,3 Universal
8 8 EAP VSH No eap_vsh fs (FAT16) 0.910.040 GEN1,2,3 Universal
9 9 PREINST No preinst fs (FAT32) 0.910.040 GEN1,2,3 Universal
0xA 10 ??? No sflash0s1.cryptx40 No ??
0xB 11 PREINST2 No preinst2 fs (FAT32) 0.910.040 GEN1,2,3 Universal
0xC 12 SYSTEM_EX No system_ex fs (FAT32/TEXFAT later) 0.910.040 GEN1,2,3 Universal
0xD 13 EMC IPL No sflash0s0x32/b Aeolia A2 0.910.040 Same body as 0x1 CXD90025G
0xE 14 EAP KBL No sflash0s0x33 Aeolia A2 0.910.040 Same body as 0x2 CXD90025G
0xF 15 ??? No test No ??
0x10-0x16 16-22 ??? No sbram0 No ??
0x20 32 EMC IPL No sflash0s0x32/b Belize 1st Revision 2.00 Same body as 0x2A CXD90036G
0x21 33 EAP KBL No sflash0s0x33 Belize 1st Revision 2.00 Same body as 0x2B and 0x25 CXD90036G
0x22 34 WIFI FW No torus2 2.00 ??
0x23 35 SECURE LOADER Yes sflash0s1.cryptx2/b 2nd SOCUID 2.00 (Confirmed by anon) Same body as 0x04 CXD90026AG
0x24 36 EMC IPL No sflash0s0x32/b Baikal B1 3.00 CXD90046GG
0x25 37 EAP KBL No sflash0s0x33 Baikal B1 3.00 Same body as 0x2B and 0x21 CXD90046GG
0x26 38 SECURE LOADER Yes sflash0s1.cryptx2/b 3rd SOCUID 3.00 (Confirmed by anon) Same body as 0x2D and 0x32 CXD90037G
0x27 39 SECURE LOADER Yes sflash0s1.cryptx2/b 4th SOCUID 3.00 (Confirmed by anon) Same body as 0x31 CXD90043GB
0x28 40 EMC IPL No sflash0s0x32/b Baikal 1st Revision 3.00 Same body as 0x2C
0x2A 42 EMC IPL No sflash0s0x32/b Belize 2 A0 4.00 Same body as 0x20
0x2B 43 EAP KBL No sflash0s0x33 Belize 2 A0 4.00 Same body as 0x25 and 0x21
0x2C 44 EMC IPL No sflash0s0x32/b Baikal2 1st Revision 4.00 Same body as 0x28
0x2D 45 SECURE LOADER Yes sflash0s1.cryptx2/b 5th SOCUID 4.50 (Confirmed by anon) Same body as 0x26 and 0x32 CXD90044GB
0x2E 46 EMC IPL No sflash0s0x32/b Belize2 3rd Revision? 5.00
0x30 48 WIFI FW No sflash0s0x38 trooper Belize 2 A0 5.00 --
0x31 49 SECURE LOADER Yes sflash0s1.cryptx2/b 6th SOCUID 5.50 (Confirmed by anon) Same body as 0x27 CXD90051GB
0x32 50 SECURE LOADER Yes sflash0s1.cryptx2/b 7th SOCUID 6.50 (Confirmed by anon) Same body as 0x26 and 0x2D CXD90055GB
0x101 257 EULA.XML No Sony Agreement XML 1.00 Universal
0x200 512 ORBIS_SWU.SELF No Sony SoftWareUpdater (ELF) 0.910.040 Universal
0x202 514 ORBIS_SWU.SELF No Sony SoftWareUpdater (Encrypted SELF) 0.920.030 Universal
0x301 769 ??? No /update related No ??
0x302 770 ??? No /update related No ??
0xD00 3328 SYSCON FW No sc_fw_update0 firmware (4000XXXX) 0.915.010 Universal Syscon
0xD01 3329 BLURAY DRIVE FW No Bluray drive firmware (all revisions) (4XXR) 0.920.030 Universal Bluray Drive
0xD02 3330 USB SATA BRIDGE FW No USB SATA bridge firmware (da0) 1.00 MB86C311B
0xD07 3335 SYSCON PATCH No sc_fw_update0 patch (4001XXXX) 2.50 Test/Retail Universal Syscon
0xD08 3336 SYSCON FW No sc_fw_update0 firmware (4000XXXX) 1.00 Devkit Universal Syscon
0xD09 3337 COMMUNICATION PROCESSOR FW No cpfirm 3.50 Devkit Neo DevKit Component (unknown)


Versions
Retail (to sort)
1.01  ·   1.05  ·   1.06  ·   1.07  ·   1.500.000  ·   1.501.000  ·   1.510.000  ·   1.520.000  ·   1.600.000  ·   1.610.000  ·   1.620.000  ·   1.700.000  ·   1.710.000  ·   1.720.000  ·   1.740.000  ·   1.750.000  ·   1.760.000  ·   2.000.000  ·   2.010.000  ·   2.020.000  ·   2.030.000  ·   2.040.000  ·   2.501.000  ·   2.508.000  ·   2.510.000  ·   2.520.000  ·   2.550.000  ·   2.560.000  ·   2.570.000  ·   3.000.000  ·   3.008.000  ·   3.100.000  ·   3.110.000  ·   3.150.000  ·   3.5XX.XXX  ·   3.500.000  ·   3.550.000  ·   3.700.000  ·   4.000.000  ·   4.060.000  ·   4.070.000  ·   4.500.000  ·   4.550.000  ·   4.700.000  ·   4.710.000  ·   4.720.000  ·   4.730.000  ·   4.740.000  ·   5.008.000  ·   5.010.000  ·   5.020.000  ·   5.030.000  ·   5.050.000  ·   5.070.000  ·   5.508.000  ·   5.530.000  ·   5.550.000  ·   5.560.000  ·   6.000.000  ·   6.020.000  ·   6.200.000  ·   6.508.000  ·   6.510.000  ·   6.700.000  ·   6.710.000  ·   6.720.000  ·   7.008.000  ·   7.010.000  ·   7.020.000  ·   7.508.000  ·   7.510.000  ·   7.550.000  ·   8.008.000
TestKit Gen 3 (to sort)
1.000.051  ·   1.000.071  ·   1.000.091‎  ·   1.010.031  ·   1.020.010  ·   1.020.041  ·   1.020.051  ·   1.030.001  ·   1.040.011‎  ·   1.050.011  ·   1.060.001  ·   1.070.001  ·   1.500.101  ·   1.501.001  ·   1.501.041  ·   1.510.011  ·   1.520.001  ·   1.610.001  ·   1.620.031  ·   1.700.081  ·   1.710.001  ·   1.720.001  ·   1.740.001  ·   1.750.061  ·   1.760.001  ·   2.000.071  ·   2.010.001  ·   2.020.011  ·   2.030.001  ·   2.040.001  ·   2.508.051  ·   2.510.011  ·   2.550.071  ·   2.570.001  ·   3.008.041  ·   3.100.001‎  ·   3.110.001‎  ·   3.150.001  ·   3.508.041  ·   3.550.001  ·   3.700.001‎  ·   4.008.001  ·   4.008.071‎  ·   4.010.001  ·   4.050.001  ·   4.060.001  ·   4.070.001  ·   4.508.001  ·   4.508.021‎  ·   4.550.001  ·   4.550.011‎  ·   4.700.001  ·   4.700.021‎  ·   4.710.001  ·   4.720.001  ·   4.730.001  ·   4.740.001  ·   5.000.001  ·   5.008.031‎  ·   5.010.001  ·   5.020.001  ·   5.030.001  ·   5.030.061  ·   5.050.001  ·   5.050.031  ·   5.500.011  ·   5.508.011  ·   5.530.000  ·   5.530.011  ·   5.550.021  ·   6.008.021  ·   6.020.001  ·   6.200.011  ·   6.508.011  ·   6.510.011  ·   6.700.061  ·   6.710.001  ·   6.720.001  ·   7.008.021  ·   7.008.610  ·   7.010.001  ·   7.020.001  ·   7.508.011  ·   7.510.001  ·   7.550.001  ·  
0.800.030  ·   0.810.030  ·   0.820.020  ·   0.910.040  ·   0.911.000  ·   0.915.010  ·   0.915.040  ·   0.920.020  ·   0.920.030  ·   0.920.040  ·   0.930.020  ·   0.930.030  ·   0.930.050  ·   0.930.068  ·   0.990.020  ·   0.990.060  ·   0.990.070  ·   1.010.031  ·   1.020.041  ·   1.020.051  ·   1.030.001  ·   2.508.051
1.000.051  ·   1.000.071  ·   1.000.091‎  ·   1.010.031  ·   1.020.010  ·   1.020.041  ·   1.020.051  ·   1.030.001  ·   1.040.011‎  ·   1.050.011  ·   1.060.001  ·   1.070.001  ·   1.500.101  ·   1.501.001  ·   1.501.041  ·   1.510.011  ·   1.520.001  ·   1.610.001  ·   1.620.031  ·   1.700.081  ·   1.710.001  ·   1.720.001  ·   1.740.001  ·   1.750.061  ·   1.760.001  ·   2.000.071  ·   2.010.001  ·   2.020.011  ·   2.030.001  ·   2.040.001  ·   2.508.051  ·   2.510.011  ·   2.550.071  ·   2.570.001  ·   3.008.041  ·   3.100.001‎  ·   3.110.001‎  ·   3.150.001  ·   3.508.041  ·   3.550.001  ·   3.700.001‎  ·   4.008.001  ·   4.008.071‎  ·   4.010.001  ·   4.050.001  ·   4.060.001  ·   4.070.001  ·   4.508.001  ·   4.508.021‎  ·   4.550.001  ·   4.550.011‎  ·   4.700.001  ·   4.700.021‎  ·   4.710.001  ·   4.720.001  ·   4.730.001  ·   4.740.001  ·   5.000.001  ·   5.008.031‎  ·   5.010.001  ·   5.020.001  ·   5.030.001  ·   5.030.061  ·   5.050.001  ·   5.050.031  ·   5.500.011  ·   5.508.011  ·   5.530.000  ·   5.530.011  ·   5.550.021  ·   6.008.021  ·   6.020.001  ·   6.200.011  ·   6.508.011  ·   6.510.011  ·   6.700.061  ·   6.710.001  ·   6.720.001  ·   7.008.021  ·   7.008.610  ·   7.010.001  ·   7.020.001  ·   7.508.011  ·   7.510.001  ·   7.550.001  ·  
System Software
Software Titles
Retrieved from "http://www.psdevwiki.com/ps4/index.php?title=PUP&oldid=294027"