Playstation Update Package (PUP)

Description

The PSVita and PSVita TV OS can install the update as /PSP2/UPDATE/PSP2UPDAT.PUP or as /PSVITA/UPDATE/PSVUPDAT.PUP.

The update comes from:

http://djp01.psv.update.playstation.net/update/psv/image/image/<YYYY_MMDD>/pre_<md5>/PSVUPDAT.PUP

It is only used by sony on the website; that's why there is no update list on that server.

Types of PSVita PUP

There are different types of PSVita PUP:

• full -> core system stuff (majority of partitions are found here, most important ones being os0: and vs0:)
• systemdata -> sa0: location
• preinst -> pd0: location
• devkit / testkit: Debug updates for PTEL-XXXX and PDEL-XXXX do not separate into three different PUPs. A single PUP will update all components. Additionally updates for PDEL units contains updates for the CP and probably other development unit specific components.

Extraction

The PSVita and PSVita TV update files can be extracted using:

• "PS VITA Firmware xTractor"
• pupunpack from vitatools.

Decryption

To decrypt the files that are unpacked using the tool, the key is available under PSVita Keys.

Structure

Differences with PS3 PUPs

The file structure of the PSVita PUP files is almost identical to the PS3's, although there is a slight difference in the header and the hash algorithm. Whereas in PS3 the format was big-endian for the Vita it has been switched to little endian. Also the Format Version field in PSVita PUP is set to 2 where in PS3 PUPs it was set to 1. There is also 0x50 bytes of extra data in the header and the hashes used are of a longer length than in PS3 updates: 0x20 bytes (SHA-256 length) in PSVita vs 0x14 (SHA-1 length) in PS3.

SCEUF Header

Offset	Length	Type	Information
0x0	0x7	char[7]	Magic (hex: 53 43 45 55 46 00 00 ~ ASCII "SCEUF")
0x7	0x1	uin8_t	Format Flag
0x8	0x2	uin16_t	Format Version
0xA	0x6	char[6]	Padding or unk
0x10	0x4	uin32_t	Sdk Version
0x14	0x4	uin32_t	Build No
0x18	0x8	uin32_t	Segment num
0x1C	0x4	uin32_t	Padding or unk
0x20	0x8	unsigned long	Header Length (ex: 0xE00, 0x1000)
0x28	0x8	unsigned long	Data Length ( = (PUP filesize - Header Length) / 0x100 )
0x30	0x50	UNKNOWN	UNKNOWN, same for all >V1.0 files so far, maybe something for extra security? (or maybe to break a PS3 which tries to read the update) Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000030 02 00 00 00 01 00 00 00 00 00 00 00 02 00 00 00 ................ 00000040 00 00 00 00 0F 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x80	0x20 * File Count	File Table	File Table
0x80 + (0x20 * File Count)	0x40 * File Count	Hash Table	Hash Table
0x80 + (0x60 * File Count)	0x20	bytes	Header Hash (maybe SHA-256?)

File Table

The file table consists of a number of file entries determined by File Count, with the format below (which is the same as the format in PS3 PUP1 files).

Offset	Length	Type	Information
0x0	0x8	unsigned long	Entry ID
0x8	0x8	unsigned long	Data Offset
0x10	0x8	unsigned long	Data Length
0x18	0x8	unsigned long	Unknown

Filename IDs

File Entry ID	Filename	Notes
0x10		Version string
0x101	license.xml	License XML
0x200	psp2swu.self	main updater
0x204	cui_setupper.self	development updater initializer
0x301	package_data01.pkg
0x302	package_data02.pkg
0x303	package_data03.pkg
0x304	package_data04.pkg
0x305	package_data05.pkg
0x306	package_data06.pkg
0x307	package_data07.pkg
0x308	package_data08.pkg
0x309	package_data09.pkg
0x30A	package_data10.pkg
0x30B	package_data11.pkg
0x30C	package_data12.pkg
0x30D	package_data13.pkg
0x30E	package_data14.pkg
0x30F	package_data15.pkg
0x400	package_scewm.wm	wm means watermark. Same ID for retail PUPs. Different IDs for dev PUPs for each developer.
0x401	package_sceas.as	Unknown SCEAS magic file
0x2005		CP firmware in early debug updates only
0x2006		CP firmware in debug updates only

Hash Table

The hash table contains a hash entry for every file inside the PUP.

The hash entry format is:

Offset	Length	Type	Information
0x0	0x8	unsigned long	File Index
0x8	0x20	bytes	File Hash (hmac-sha256 algo?)
0x28	0x18	bytes	Unknown

preinst - 01.000.000

Type	Header	Information	Size
ASCII:MM.mmmm (01.500)	[none]	version.txt	1
cui_setupper.self	SCE (SELF)	binary0.self	4536
unknown_lib.sprx	SCE (SELF)	binary1.self	42
	XML	license.xml	451
	SCE	package_file_0.pkg	7904
	SCE	package_file_1.pkg	8130
	SCE	package_file_2.pkg	8196
	SCE	package_file_3.pkg	8196
	SCE	package_file_4.pkg	8196
	SCE	package_file_5.pkg	7883
	SCE	package_file_6.pkg	8052
	SCE	package_file_7.pkg	6943
	SCE	package_file_8.pkg	7758
	SCE	package_file_9.pkg	7805
	SCE	package_file_10.pkg	7804
	SCE	package_file_11.pkg	8005
	SCE	package_file_12.pkg	8103
	SCE	package_file_13.pkg	8084
	SCE	package_file_14.pkg	8066
	SCE	package_file_15.pkg	1661
	SCEWM	package_file_16.pkg	14
	SCEAS	package_file_17.pkg	1

systemdata - 01.000.010

Type	Header	Information	Size
ASCII:MM.mmmm (01.500)	[none]	version.txt	1
cui_setupper.self	SCE (SELF)	binary0.self	4536
unknown_lib.sprx	SCE (SELF)	binary1.self	42
	XML	license.xml	451
	SCE	package_file_0.pkg	2625
	SCE	package_file_1.pkg	4048
	SCE	package_file_2.pkg	2746
	SCE	package_file_3.pkg	3874
	SCE	package_file_4.pkg	4742
	SCE	package_file_5.pkg	4660
	SCE	package_file_6.pkg	3946
	SCE	package_file_7.pkg	4145
	SCE	package_file_8.pkg	4630
	SCE	package_file_9.pkg	5476
	SCE	package_file_10.pkg	4860
	SCE	package_file_11.pkg	4722
	SCEWM	package_scewm.wm	4
	SCEAS	package_sceas.as	1

full - 01.500.000

Type	Header	Information	Size
ASCII:MM.mmmm (01.500)	[none]	version.txt	1
cui_setupper.self	SCE (SELF)	binary0.self	4536
unknown_lib.sprx	SCE (SELF)	binary1.self	42
	XML	license.xml	451
	SCE	package_file_0.pkg	634
	SCE	package_file_1.pkg	6718
	SCE	package_file_2.pkg	8194
	SCE	package_file_3.pkg	8194
	SCE	package_file_4.pkg	8194
	SCE	package_file_5.pkg	8194
	SCE	package_file_6.pkg	8194
	SCE	package_file_7.pkg	8194
	SCE	package_file_8.pkg	8194
	SCE	package_file_9.pkg	8194
	SCE	package_file_10.pkg	8194
	SCE	package_file_11.pkg	6154
	SCEWM	package_scewm.wm	4
	SCEAS	package_sceas.as	1

Regioning

Contrarly to PS3, there is no regioning in the .PUP files: they are the same for all different regions.
However, the PSVita gets the psp2-updatelist.xml from different servers, depending on the region of that model.

Retail:

• Japan (jp)
• USA (us)
• Europe (eu)

11 jan 2012 :: full 01.520.000 + systemdata 01.000.010 + preinst 01.000.000:

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.520.000" level1_system_version="01.520.000" level2_system_version="01.520.000"/>
    <version system_version="01.520.000" label="01.520">
      <update_data update_type="full">
        <image size="94646272">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/rel_01a72de4dd90191f679f648da8d11a48/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/sd_d48c3a2ca8963ffc7ac01c73e873809c/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/pre_5899e51b24eb4ab2c985df08bf6c901b/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

22 dec 2011 :: full 01.510.000 + systemdata 01.000.010 + preinst 01.000.000:

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.510.000" level1_system_version="01.510.000" level2_system_version="01.510.000"/>
    <version system_version="01.510.000" label="01.510">
      <update_data update_type="full">
        <image size="94500352">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/rel_48ac631ecae3837a7530506de0d73eaf/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/sd_52ff6b714e5f701d15938a6fee68fb66/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/pre_a18a91bb8c86f8c1a101d19fcb15fb6d/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

14 dec 2011 :: full 01.500.000 + systemdata 01.000.010 + preinst 01.000.000:

<update_data_list>
  <region id="jp">
    <np level0_system_version="01.500.000" level1_system_version="01.500.000" level2_system_version="01.500.000"/>
    <version system_version="01.500.000" label="01.500">
      <update_data update_type="full">
        <image size="94496256">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/rel_f090a69bcf392b5c311b9e786c5cc0b5/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/sd_484243f3964158b38ad1adaac0332a3e/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/pre_24b5601c3b3aa63b51cf5eaeab718a4c/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>

Shop:

• shop
• Japan (jp)
• USA (us)
• Europe (eu)

<update_data_list>
  <region id="shop">
    <np level0_system_version="00.000.000" level1_system_version="00.000.000" level2_system_version="00.000.000"/>
    <version system_version="00.000.000">
      <update_data update_type="full">
        <image>NA</image>
      </update_data>
    </version>
  </region>
</update_data_list>

Retail basic structure of the update URL:

http://d<TLD>01.psp2.update.playstation.net/update/psp2/image/<YYYY_MMDD>/pre_<md5>/PSP2UPDAT.PUP?dest=<TLD>
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, md5 is 22-digits long HASH)

PUP Download Repositories

Links:

• https://darthsternie.net/index.php/ps-vita-firmwares/
• https://darksoftware.xyz/VITA/FWList