Editing Playstation Update Package (PUP)

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
== Description ==
==Description==


'''PUP''' ('''P'''laystation '''U'''pdate '''P'''ackage) files are packages which contain the files used to update a PSP or PS3 system. There are 2 different types: patches (PS3PATCH.PUP) and full updates (PS3UPDAT.PUP). Based on the model, there are 4 different release types: Retail/CEX, Shop/SEX, Debug/DEX and Tool/DECR. Within the Retail/CEX there are 2 file versions: 1 is a PUP with a normal file length which also gets released online. The other PUP file version is the same, except it is zero-filled after the normal PUP content to a fixed filelength of 256MB, which gets released on Gamedisks (if gamecreators build their project to a premaster and give it to Sony for signing, they just use a placeholder of a 256MB PS3UPDAT.PUP which contains no firmwaredata at all - it is completely zerofilled. Sony decides the firmware that gets on the disk and for which firmware the 'Gold' code is signed and mastered).
'''PUP''' ('''P'''laystation '''U'''pdate '''P'''ackage) files are packages which contain the files used to update a PSP or PS3 system. There are 2 different types: patches (PS3PATCH.PUP) and full updates (PS3UPDAT.PUP). Based on the model, there are 4 different release types: Retail/CEX, Shop/SEX, Debug/DEX and Tool/DECR. Within the Retail/CEX there are 2 file versions: 1 is a PUP with a normal file length which also gets released online. The other PUP file version is the same, except it is zero-filled after the normal PUP content to a fixed filelength of 256MB, which gets released on Gamedisks (if gamecreators build their project to a premaster and give it to Sony for signing, they just use a placeholder of a 256MB PS3UPDAT.PUP which contains no firmwaredata at all - it is completely zerofilled. Sony decides the firmware that gets on the disk and for which firmware the 'Gold' code is signed and mastered).


== Location ==
==Regioning==
 
There is no regioning in the .PUP files, they are the same for all different regions (if you were looking for regioninfo, [http://www.ps3devwiki.com/index.php?title=SKU_Models#Regioning see here]).<br />
=== PS Vita ===
The PS3 however gets the [[ps3-updatelist.txt]] from different servers, depending on the region of that model (last 2 numbers in the CECHxxXX SKU name).
 
The PS Vita and PS Vita TV OS can install the update as /PSP2/UPDATE/PSP2UPDAT.PUP or as /PSVITA/UPDATE/PSVUPDAT.PUP.<br />
 
The update comes from:
 
http://djp01.psv.update.playstation.net/update/psv/image/image/<YYYY_MMDD>/pre_<md5>/PSVUPDAT.PUP
 
It is only used by sony on the website. That's why there is no update list on that server.
 
== Download ==
 
=== PUP Download Repositories ===
 
Links:
* https://darthsternie.net/index.php/ps-vita-firmwares/
* https://darksoftware.xyz/VITA/FWList
 
== Types ==
 
=== PS3 ===
 
To document.
 
=== PS Vita ===
 
PUP contains updates for different partitions of the system. Most packages, once decrypted, decompressed and pieced together are a raw disk image for the partition to update. Sometimes, a TAR archive patch is also used along with the disk images but not as often. Sony usually releases three kinds of update files, each to update different components: release, systemdata and preinstall.
 
There are different types of PS Vita .PUP files:
 
==== release - full - rel ====
 
Release PUPs update most [[Partitions|partitions]]. This contains the actual system files. The main components are <code>os0</code>, <code>vs0</code>, and the [[Boot Sequence|bootloader partition]].
 
==== systemdata - sd ====
 
Systemdata PUPs only update the <code>sa0</code> [[Partitions|partition]]. It is likely separated from the main update due to it not regularly needing updates and size concerns.
 
==== preinstall - preinst ====
 
Preinstall PUPs only update the <code>pd0</code> [[Partitions|partition]]. This is the [[Welcome Park]] application and the initial setup movie. It is likely separated from the main update due to it not regularly needing updates and size concerns.
 
==== com ====
 
Unknown. Maybe stands for Common or for Communication in the case it would target COM PS Vita i.e. PS Vita that have a 3G Modem.
 
==== modeldiff ====
 
Unknown. Stands for Model Differences.
 
== Revisions ==
 
=== PS Vita ===
 
See [https://psdevwiki.com/vita/index.php?title=Category:Firmware_revisions].
 
== Update List ==
 
=== PS3 ===
 
There is no regioning in the .PUP files i.e. they are the same for all different regions (if you were looking for regioninfo, [[SKU_Regioning|see here]]). The PS3 however gets the [[ps3-updatelist.txt]] from different servers, depending on the region of that model (last 2 numbers in the CECHxxXX SKU name).


<ul>
<ul>
Line 82: Line 22:
<li> [http://fbr01.ps3.update.playstation.net/update/ps3/list/br/ps3-updatelist.txt Brasil, br] (11 > 0x8F)
<li> [http://fbr01.ps3.update.playstation.net/update/ps3/list/br/ps3-updatelist.txt Brasil, br] (11 > 0x8F)
</ul>
</ul>
 
for completeness see [[Target ID]]: Reference Tool/DECR : 0x81, Debug/DEX : 0x82, and Arcade : 0xA0
For completeness, see [[Product Code]]: Reference Tool/DECR : 0x81, Debug/DEX : 0x82, and Arcade : 0xA0


Retail basic structure of the update URL:
Retail basic structure of the update URL:
Line 94: Line 33:


Content:
Content:
<pre>
 
  # JP(shop)
  # JP(shop)
  Dest=83;CompatibleSystemSoftwareVersion=4.7600-;
  Dest=83;CompatibleSystemSoftwareVersion=4.7600-;
Line 130: Line 69:
  Dest=8F;CompatibleSystemSoftwareVersion=4.7600-;
  Dest=8F;CompatibleSystemSoftwareVersion=4.7600-;
  Dest=8F;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dbr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
  Dest=8F;ImageVersion=00010015;SystemSoftwareVersion=4.7600;CDN=http://dbr01.ps3.update.playstation.net/update/ps3/image/shop/2015_0903_6f462b5aaaed64263d72e1e989e4b336/PS3UPDAT.PUP;CDN_Timeout=30;
</pre>
 


Shop basic structure of the update URL:
Shop basic structure of the update URL:
Line 136: Line 75:
  (TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 22-digits long HASH)
  (TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, MD5 is 22-digits long HASH)


=== PS Vita ===
==Installation==
 
Like on PS3, there is no regioning in the .PUP files: they are the same for all different regions. However, the PS Vita gets the psp2-updatelist.xml from different servers, depending on the region of that model.
 
On retail (CEX) consoles, when you check for updates via WiFi in settings the console will download an XML file based on the console's region code. For example on PS Vitas sold within the United States the URL for the XML file is <code>http://fus01.psp2.update.playstation.net/update/psp2/list/us/psp2-updatelist.xml</code>.
 
When this file is read by the system, the <code>region id</code> MUST match the system region.
 
Possible regions are: <code>jp</code>, <code>us</code>, <code>au</code>, <code>uk</code>, <code>eu</code>, <code>kr</code>, <code>sa</code>, <code>tw</code>, <code>ru</code>, <code>mx</code>, <code>cn</code> and on devkit you must use the region id <code>257</code> and <code>258</code> for testkit's.
 
The file must be no larger than 65535 bytes, and the URL's specifying where to download the .PUP from can be no longer than 1024 characters, it also must be a direct URL to the content *including "http://" protocol*.
 
When selecting "Update via connecting to PC", the console connects to Content Manager Assistant installed on a PC and then CMA downloads the psp2-updatelist.xml file and the PUP files from PC side and sends it back to the PS Vita. Because of this, by using a custom Content Manager Assistant such as QCMA, you can send whatever psp2-updatelist.xml you want to the PS Vita. This is also what happens with "Update via connecting to PS3".
 
On PS Vita DevKit and TestKit, you can configure your own URL for the psp2-updatelist.xml file in <code>Debug Settings > System Update</code> and this setting can be overridden by placing a file at <code>ux0:/PSP2/UPDATE/SERVER_URL.TXT</code> or <code>host0:/PSP2/UPDATE/SERVER_URL.TXT</code>.
 
Retail:
* [http://fjp01.psp2.update.playstation.net/update/psp2/list/jp/psp2-updatelist.xml Japan (jp)]
* [http://fus01.psp2.update.playstation.net/update/psp2/list/us/psp2-updatelist.xml USA (us)]
* [http://feu01.psp2.update.playstation.net/update/psp2/list/eu/psp2-updatelist.xml Europe (eu)]
 
11 jan 2012 :: full 01.520.000 + systemdata 01.000.010 + preinst 01.000.000:
<pre>
<update_data_list>
  <region id="jp">
    <np level0_system_version="01.520.000" level1_system_version="01.520.000" level2_system_version="01.520.000"/>
    <version system_version="01.520.000" label="01.520">
      <update_data update_type="full">
        <image size="94646272">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/rel_01a72de4dd90191f679f648da8d11a48/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/sd_d48c3a2ca8963ffc7ac01c73e873809c/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2012_0111/pre_5899e51b24eb4ab2c985df08bf6c901b/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>
</pre>
 
22 dec 2011 :: full 01.510.000 + systemdata 01.000.010 + preinst 01.000.000:
<pre>
<update_data_list>
  <region id="jp">
    <np level0_system_version="01.510.000" level1_system_version="01.510.000" level2_system_version="01.510.000"/>
    <version system_version="01.510.000" label="01.510">
      <update_data update_type="full">
        <image size="94500352">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/rel_48ac631ecae3837a7530506de0d73eaf/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/sd_52ff6b714e5f701d15938a6fee68fb66/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1222/pre_a18a91bb8c86f8c1a101d19fcb15fb6d/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>
</pre>
 
14 dec 2011 :: full 01.500.000 + systemdata 01.000.010 + preinst 01.000.000:
<pre>
<update_data_list>
  <region id="jp">
    <np level0_system_version="01.500.000" level1_system_version="01.500.000" level2_system_version="01.500.000"/>
    <version system_version="01.500.000" label="01.500">
      <update_data update_type="full">
        <image size="94496256">
          http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/rel_f090a69bcf392b5c311b9e786c5cc0b5/PSP2UPDAT.PUP?dest=jp
        </image>
      </update_data>
    </version>
    <recovery spkg_type="systemdata">
      <image spkg_version="01.000.010" size="56817152">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/sd_484243f3964158b38ad1adaac0332a3e/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
    <recovery spkg_type="preinst">
      <image spkg_version="01.000.000" size="128837120">
        http://djp01.psp2.update.playstation.net/update/psp2/image/2011_1214/pre_24b5601c3b3aa63b51cf5eaeab718a4c/PSP2UPDAT.PUP?dest=jp
      </image>
    </recovery>
  </region>
</update_data_list>
</pre>
 
Shop:
* [http://fshop01.psp2.update.playstation.net/update/psp2/list/shop/psp2-updatelist.xml shop]
* [http://fjp01.psp2.update.playstation.net/update/psp2/list/shop/psp2-updatelist.xml Japan (jp)]
* [http://fus01.psp2.update.playstation.net/update/psp2/list/shop/psp2-updatelist.xml USA (us)]
* [http://feu01.psp2.update.playstation.net/update/psp2/list/shop/psp2-updatelist.xml Europe (eu)]
<pre>
<update_data_list>
  <region id="shop">
    <np level0_system_version="00.000.000" level1_system_version="00.000.000" level2_system_version="00.000.000"/>
    <version system_version="00.000.000">
      <update_data update_type="full">
        <image>NA</image>
      </update_data>
    </version>
  </region>
</update_data_list>
</pre>
 
Retail basic structure of the update URL:
<pre>
http://d<TLD>01.psp2.update.playstation.net/update/psp2/image/<YYYY_MMDD>/pre_<md5>/PSP2UPDAT.PUP?dest=<TLD>
(TLD=2 letter abbreviation from above region, YYYY_MMDD is release date, md5 is 22-digits long HASH)
</pre>
 
'''<?xml''' <span style="color: blue;">version</span><span style="color: red;">="1.0"</span> <span style="color: blue;">encoding</span><span style="color: red;">="UTF-8"</span>'''?>'''
'''<update_data_list>'''
  '''<region''' <span style="color: blue;">id</span><span style="color: red;">="au"</span>'''>'''
    '''<np''' <span style="color: blue;">level0_system_version</span><span style="color: red;">="01.600.000"</span> <span style="color: blue;">level1_system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">level2_system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">map</span><span style="color: red;">="03.610.000"</span>'''/>'''
    '''<np_d''' <span style="color: blue;">level0_system_version</span><span style="color: red;">="01.600.000"</span> <span style="color: blue;">level1_system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">level2_system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">map</span><span style="color: red;">="03.610.000"</span>'''/>'''
      '''<version''' <span style="color: blue;">system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">label</span><span style="color: red;">="3.61"</span>'''>'''
        '''<update_data''' <span style="color: blue;">update_type</span><span style="color: red;">="full"</span>'''>'''
          '''<image''' <span style="color: blue;">size</span><span style="color: red;">="133676544"</span>>http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/rel_99d9ab3e57a677b38e42cc6409b95e3b/PSP2UPDAT.PUP?dest=au'''</image>'''
        '''</update_data>'''
      '''</version>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="systemdata"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.010"</span> <span style="color: blue;">size</span><span style="color: red;">="56768512"</span>>http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/sd_80cefcda06707796a040648aea38da0f/PSP2UPDAT.PUP?dest=au'''</image>'''
      '''</recovery>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="preinst"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.000"</span> <span style="color: blue;">size</span><span style="color: red;">="128788480"</span>>http://dau01.psp2.update.playstation.net/update/psp2/image/2016_0804/pre_f5e6da7d1213101482300ccaeda35c3c/PSP2UPDAT.PUP?dest=au'''</image>'''
      '''</recovery>'''
  '''</region>'''
'''</update_data_list>'''
 
PS Vita PUP links use the same structure as PS3 PUP links:
 
<nowiki>http://d</nowiki><span style="color: red;">&lt;TLD&gt;</span>01.ps4.update.playstation.net/update/ps4/image/<span style="color: green;">&lt;YYYY_MMDD&gt;</span>/<span style="color: orange;">&lt;TYPE&gt;</span>_<span style="color: blue;">&lt;MD5&gt;</span>/PS4UPDATE.PUP?dest=<span style="color: red;">&lt;TLD&gt;</span>
* <span style="color: red;"><TLD></span>=2 letter region abbreviation (jp, us, ..)
* <span style="color: green;">&lt;YYYY_MMDD&gt;</span> is build date
* <span style="color: orange;">TYPE</span> is PUP type (rel, pre, sd,...)
* <span style="color: blue;">MD5</span> is 22-digits long HASH
 
=== Running your own local update server ===
 
Note: this is untested, please report back!
 
Using a webserver (apache, lighttpd, nginx, etc.) and proxy/firewall to catch http://f**01.psp2.update.playstation.net/update/psp2/list/**/psp2-updatelist.xml" and point it to your local server you could[1] have more control over the updates/bandwith. Of course you need to have every <code>PSP2UPDATE.PUP</code> file you reference to, otherwise it errors out.
 
In this example the webserver is configured at http://192.168.0.254, region is set to <code>eu</code>[2].
 
'''<update_data_list>'''
  '''<region''' <span style="color: blue;">id</span><span style="color: red;">="au"</span>'''>'''
    '''<np''' <span style="color: blue;">level0_system_version</span><span style="color: red;">="01.600.000"</span> <span style="color: blue;">level1_system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">level2_system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">map</span><span style="color: red;">="03.600.000"</span>'''/>'''
    '''<np_d''' <span style="color: blue;">level0_system_version</span><span style="color: red;">="01.600.000"</span> <span style="color: blue;">level1_system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">level2_system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">map</span><span style="color: red;">="03.600.000"</span>'''/>'''
      '''<version''' <span style="color: blue;">system_version</span><span style="color: red;">="03.600.000"</span> <span style="color: blue;">label</span><span style="color: red;">="3.60"</span>'''>'''
        '''<update_data''' <span style="color: blue;">update_type</span><span style="color: red;">="full"</span>'''>'''
          '''<image''' <span style="color: blue;">size</span><span style="color: red;">="133676544"</span>>http://192.168.0.254/psp2/update/3_600_00/rel/PSP2UPDAT.PUP'''</image>'''
        '''</update_data>'''
      '''</version>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="systemdata"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.010"</span> <span style="color: blue;">size</span><span style="color: red;">="56768512"</span>>http://192.168.0.254/psp2/update/3_600_00/sd/PSP2UPDAT.PUP'''</image>'''
      '''</recovery>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="preinst"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.000"</span> <span style="color: blue;">size</span><span style="color: red;">="128788480"</span>>http://192.168.0.254/psp2/update/3_600_00/pre/PSP2UPDAT.PUP'''</image>'''
      '''</recovery>'''
      '''<version''' <span style="color: blue;">system_version</span><span style="color: red;">="03.610.000"</span> <span style="color: blue;">label</span><span style="color: red;">="3.61"</span>'''>'''
        '''<update_data''' <span style="color: blue;">update_type</span><span style="color: red;">="full"</span>'''>'''
          '''<image''' <span style="color: blue;">size</span><span style="color: red;">="133676544"</span>>http://192.168.0.254/psp2/update/3_600_00/rel/PSP2UPDAT.PUP'''</image>'''
        '''</update_data>'''
      '''</version>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="systemdata"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.010"</span> <span style="color: blue;">size</span><span style="color: red;">="56768512"</span>>http://192.168.0.254/psp2/update/3_600_00/sd/PSP2UPDAT.PUP'''</image>'''
      '''</recovery>'''
      '''<recovery''' <span style="color: blue;">spkg_type</span><span style="color: red;">="preinst"</span>'''>'''
        '''<image''' <span style="color: blue;">spkg_version</span><span style="color: red;">="01.000.000"</span> <span style="color: blue;">size</span><span style="color: red;">="128788480"</span>>http://192.168.0.254/psp2/update/3_600_00/pre/PSP2UPDAT.PUP'''</image>'''
      '''</recovery>'''
  '''</region>'''
'''</update_data_list>'''
 
== Installation ==


To install firmware via USB Mass Storage Devices (e.g. USB-stick, Memory Stick, SD-card, Compact Flash with at least 256MB free), place the PS3UPDAT.PUP file in the following folder structure: /PS3/UPDATE/PS3UPDAT.PUP
To install firmware via USB Mass Storage Devices (e.g. USB-stick, Memory Stick, SD-card, Compact Flash with at least 256MB free), place the PS3UPDAT.PUP file in the following folder structure: /PS3/UPDATE/PS3UPDAT.PUP
Line 448: Line 200:
  0x8002F2Ex - (Turning On/Off Recovery Mode Flag)
  0x8002F2Ex - (Turning On/Off Recovery Mode Flag)


= Structure =
==Firmware .PUP structure==
 
== Verification ==
 
The PUP Header is signed using HMAC, HMAC-SHA1 for PS3 and HMAC-SHA256 for PS Vita.
 
On PS Vita, the PUP Header Digest is signed using RSA2048. The PUP Header RSA signature is RSA-signed along with a message into SCEWM file, which is encrypted using AES128CBC.
 
The PUP Header embeds HMAC signatures for each PUP segment.
 
All the PUP keys are known except RSA private keys.
 
== Extraction ==
 
=== PS3 ===
 
=== PS Vita ===
 
The PS Vita and PS Vita TV update files can be extracted from .PUP using:
* "[http://www.psdevwiki.com/vita/index.php?title=Tools PS VITA Firmware xTractor]"
* pupunpack from [http://www.psdevwiki.com/vita/index.php?title=Tools#Vitatools vitatools].
 
== Decryption ==


Even though PUP is not encrypted, most files it embeds are.
The HMAC key used to verify the packages has been released. Look around for "pup-hmac"


== PS3 ==
<!--// PUP Extractor http://www.megaupload.com/?d=WILOJ5TC  (outdated : incompatible output, tool not update since 27 may 2008 - autor:NDT @ ps3news) //-->


=== Header ===
===Header===
 
<source lang="C">
typedef struct ScePupHeader_v1 { // size is 0x30-bytes
  uint8_t magic[7];
  uint8_t format_flag;
  uint64_t package_version;
  uint64_t image_version;
  uint64_t segment_num;
  uint64_t file_offset;
  uint64_t file_size;
} ScePupHeader_v1;
</source>


{| class="wikitable"
{| class="wikitable"
Line 494: Line 212:
! Offset !! Length !! Type !! Information
! Offset !! Length !! Type !! Information
|-
|-
| 0x0 || 0x7 || unsigned long || Magic
| 0x0 || 0x8 || unsigned long || Magic
|-
|-
| 0x7 || 0x1 || uint8_t || Format Flag
| 0x8 || 0x8 || unsigned long || Package Version
|-
|-
| 0x8 || 0x8 || unsigned long || Package Version. ?Might be Format version like on PS Vita?
| 0x10 || 0x8 || unsigned long || Image Version
|-
|-
| 0x10 || 0x8 || unsigned long || Image Version. ?What is this?
| 0x18 || 0x8 || unsigned long || File Count
|-
|-
| 0x18 || 0x8 || unsigned long || Segment Number
| 0x20 || 0x8 || unsigned long || Header Length
|-
|-
| 0x20 || 0x8 || unsigned long || File Offset. It corresponds to Header Length.
| 0x28 || 0x8 || unsigned long || File Length
|-
|-
| 0x28 || 0x8 || unsigned long || File Size. It corresponds to Data Length.
| 0x30 || 0x20 * '''File Count''' || '''File Table''' || File Table
|-
|-
| 0x30 || 0x20 * '''segment_num''' || '''Segment Table''' || Segment Table
| 0x30 + (0x20 * '''File Count''') || 0x20 * '''File Count''' || '''Hash Table''' || Hash Table
|-
|-
| 0x30 + (0x20 * '''segment_num''') || 0x20 * '''segment_num''' || '''Digest Table''' || Digest Table
| 0x30 + (0x40 * '''File Count''') || 0x14 || bytes || Header Hash
|-
|-
| 0x30 + (0x40 * '''segment_num''') || 0x14 || '''Header Digest''' || Header Digest
| 0x44 + (0x40 * '''File Count''') || 0xC || bytes || Unknown
|-
|-
| 0x44 + (0x40 * '''segment_num''') || 0xC || uint8_t[0xC] || Padding
|}
|}


=== Segment Table ===
===File Table===
 
The Segment Table consists of a number of Segment Entries determined by '''Segment Num'''.


<source lang="C">
The file table consists of a number of file entries determined by '''File Count''', with the format below:
typedef struct ScePupSegmentEntry { // size is 0x20-bytes
  uint64_t id;
  uint64_t offset;
  uint64_t size;
  uint32_t sign_algorithm;
  uint32_t padding;
} ScePupSegmentEntry;
</source>


{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Length !! Type !! Information
! Offset  
|-
! Length  
| 0x0 || 0x8 || unsigned long || ID
! Type  
|-
! Information
| 0x8 || 0x8 || unsigned long || Offset
|-
| 0x10 || 0x8 || unsigned long || Size
|-
| 0x18 || 0x4 || unsigned int || Signature Algorithm. 0 = HMAC-SHA1, 2 = HMAC-SHA256
|-
| 0x1C || 0x4 || char[4] || Padding
|}
 
=== Segment Entry IDs ===
 
It is a mistake to try to connect a Segment Entry ID to any specific file. Nevertheless, there are certain Segment Entry IDs that have been linked with the same data throughout all observed PUPs.
 
{| class="wikitable sortable"
! Segment Entry ID !! Console !! File name !! Notes
|-
| 0x100 || [[version.txt]] || PS3, PS Vita || Version string
|-
| 0x101 || [[license.xml]] || PS3, PS Vita || License XML. (?aka: resource.txt?)
|-
| 0x102 || [[promo_flags.txt]] || PS3 || (only on {{SHOP}}) (?aka: shop.txt?)
|-
| 0x103 || [[update_flags.txt]] || PS3 ||
|-
| 0x104 || [[patch_build.txt]] || PS3 ||
|-
| 0x200 || [[ps3swu.self]], [[psp2swu.self]] || PS3, PS Vita || Main updater executable
|-
| 0x201 || [[vsh.tar]] / [[font_resource.tar]] || PS3 ||
|-
| 0x202 || [[dots.txt]] || PS3 ||
|-
| 0x203 || [[patch_data.pkg]] || PS3 ||
|-
| 0x204 || [[cui_setupper.self]] || PS Vita || Classical UI updater setupper executable
|-
| 0x221 || [[vs0_patch_tar_info.txt]] || PS Vita || vs0 patch tar archive access permission config
|-
| 0x231 || [[vs0_patch_tar_2_info.txt]] || PS Vita || vs0 patch tar archive 2 access permission config
|-
| 0x300 || [[update_files.tar]] || PS3 ||
|-
| 0x302 ||  || PS Vita || SLB2
|-
| 0x303 ||  || PS Vita || os0
|-
| 0x304 ||  || PS Vita || vs0
|-
| 0x305 ||  || PS Vita ||
|-
| 0x306 ||  || PS Vita ||
|-
| 0x307 ||  || PS Vita ||
|-
| 0x308 ||  || PS Vita ||
|-
| 0x309 ||  || PS Vita ||
|-
| 0x30A ||  || PS Vita ||
|-
| 0x30B ||  || PS Vita ||
|-
| 0x30C ||  || PS Vita ||
|-
| 0x30D ||  || PS Vita ||
|-
| 0x30E ||  || PS Vita ||
|-
| 0x30F ||  || PS Vita ||
|-
| 0x310 ||  || PS Vita ||
|-
| 0x311 ||  || PS Vita || vs0 patch tar archive
|-
| 0x312 ||  || PS Vita || vs0 patch tar archive 2
|-
| 0x313 ||  || PS Vita || Syscon update type 0: 00 24 10 00
|-
| 0x314 ||  || PS Vita || Syscon update type 1: 00 50 31 00, 00 50 40 00
|-
| 0x315 ||  || PS Vita || Syscon update type 2: 00 26 10 00, 00 52 40 00
|-
| 0x316 ||  || PS Vita || Syscon update type 3: 00 52 31 00
|-
| 0x317 ||  || PS Vita || Syscon update type 4:
|-
| 0x318 ||  || PS Vita || Syscon update type 5:
|-
| 0x319 ||  || PS Vita || Syscon update type 6:
|-
| 0x31A ||  || PS Vita || Syscon update type 7:
|-
| 0x31B ||  || PS Vita || Syscon update type 8:
|-
| 0x31C ||  || PS Vita || Syscon update type 9: 00 30 70 00
|-
| 0x400 || [[package_scewm.wm]] || PS Vita || SCEWM file
|-
| 0x401 || [[package_sceas.as]] || PS Vita || SCEAS file
|-
| 0x501 || [[spkg_hdr.tar]] || PS3 || (added since FW 3.56)
|-
| 0x601 || [[ps3swu2.self]] || PS3 || (added since FW 3.56)
|-
| 0x2005 ||  || PS Vita || CP ES1 firmware. In early Tool PUPs only.
|-
| 0x2006 ||  || PS Vita || CP ES2 firmware. In recent Tool PUPs only.
|}
 
=== Digest Table ===
 
The Digest Table contains a Digest Entry for every segment inside the PUP.
 
<source lang="C">
typedef struct ScePupDigestEntry_v1 { // size is 0x20-bytes
  uint64_t segment_index;
  uint8_t digest[0x14];
  uint32_t padding;
} ScePupDigestEntry_v1;
</source>
 
{| class="wikitable"
|-
|-
! Offset !! Length !! Type !! Information
| 0x0
| 0x8
| unsigned long
| Entry ID
|-
|-
| 0x0 || 0x8 || uint64_t || Segment Index
| 0x8
| 0x8
| unsigned long
| Data Offset
|-
|-
| 0x8 || 0x14 || uint8_t[0x14] || Digest (HMAC-SHA1)
| 0x10
| 0x8
| unsigned long
| Data Length
|-
|-
| 0x1C || 0x4 || uint32_t || Padding
| 0x18
| 0x8
| unsigned long
| Unknown
|}
|}


=== Header Digest ===
===Filename IDs===
 
<source lang="C">
typedef struct {
  uint8_t digest[0x14]; // HMAC-SHA1
} PUPHeaderDigest_v1;
</source>
 
== PS Vita ==
 
=== Differences with PS3 PUPs ===
 
The file structure of the PS Vita PUP is almost identical to the PS3 PUP, although there is a slight difference in the header, the hash algorithm and the signature.
 
* PS Vita PUP is little-endian. PS3 PUP is big-endian.
* PS Vita PUP '''Format Version''' is 2. PS3 PUP '''Format Version''' is 1.
* There are 0x50 bytes of extra data in the PS Vita PUP Header compared to PS3 PUP.
* PS Vita PUP digests are longer than the ones in PS3 PUP: 0x20 bytes (SHA-256 length) in PS Vita PUP versus 0x14 bytes (SHA-1 length) in PS3 PUP.
* PS Vita PUP Header Digest is signed using RSA2048 in the SCEWM file. ?PS3 PUP has a RSA signature?
 
=== Header ===
 
<source lang="C">
typedef struct ScePupHeader_v2 { // size is 0x80-bytes
SceUInt8 magic[7];
SceUInt8 format_flag;
SceUInt64 format_version;
SceUInt32 version;
SceUInt32 buildno;
SceUInt64 segment_num;
SceUInt64 file_offset;
SceUInt64 file_size;
SceUInt32 sign_algorithm;
SceUInt32 sign_key_index;
SceUInt8 attribute[4];
SceUInt32 target;
SceUInt32 sub_target;
SceUInt32 support_list;
SceUInt32 base_version;
SceUInt32 base_buildno;
SceUInt8 unk_0x50[0x30];
} ScePupHeader_v2;
</source>


{| class="wikitable"
{| class="wikitable"
! Offset !! Length !! Type !! Information
|-
| 0x0 || 0x7 || char[7] || Magic (hex: 53 43 45 55 46 00 00 ~ ASCII 'SCEUF\0\0')
|-
|-
| 0x7 || 0x1 || uint8_t || Format Flag
! File Entry ID
! Filename
|-
|-
| 0x8 || 0x8 || uint64_t || Format Version (11 digits max)
| 0x100
| [[version.txt]] (aka: ps3version.txt)
|-
|-
| 0x10 || 0x4 || uint32_t || Version (ex: 0x01600000 on FW 1.60)
| 0x101
| [[license.xml]] (aka: resource.txt? )
|-
|-
| 0x14 || 0x4 || uint32_t || Build No
| 0x102
| [[promo_flags.txt]] (only on {{shop}}) (aka: shop.txt?)
|-
|-
| 0x18 || 0x8 || uint64_t || Segment Num (11 digits max)
| 0x103
| [[update_flags.txt]]
|-
|-
| 0x20 || 0x8 || uint64_t || Header Length (ex: 0xC00, 0xE00, 0x1000, 0x1600)
| 0x104
| [[patch_build.txt]]
|-
|-
| 0x28 || 0x8 || uint64_t || Data Length. Equals (PUP file size - PUP Header Length).
| 0x200
| [[ps3swu.self]]
|-
|-
| 0x30 || 0x4 || uint32_t || Sign Algorithm. PS Vita only. (ex: 2)
| 0x201
| [[vsh.tar]] / font_resource.tar
|-
|-
| 0x34 || 0x4 || uint32_t || Sign Key Index. PS Vita only. (ex: 1)
| 0x202
| [[dots.txt]]
|-
|-
| 0x38 || 0x4 || uint8_t[4] || Attribute. PS Vita only. 0: default, 1: QAF required, 2: manufacturing mode required.
| 0x203
| [[patch_data.pkg]]
|-
|-
| 0x3C || 0x4 || uint32_t || Target. PS Vita only. 1: TOOL, 2: CEX, 4: DEX. cex_for_tool PUPs are set to 1.
| 0x300
| [[update_files.tar]]
|-
|-
| 0x40 || 0x4 || uint32_t || Sub Target. PS Vita only. (ex: 0)
| 0x501
| [[spkg_hdr.tar]] (added since FW 3.56)
|-
|-
| 0x44 || 0x4 || uint32_t || Support List. PS Vita only. (ex: 1, 7, 0xC, 0xF, 0x38, 0x78, 0x3F8, 0xFF8, 0xCFF8)
| 0x601
|-
| [[ps3swu2.self]] (added since FW 3.56)
| 0x48 || 0x4 || uint32_t || Base Version. PS Vita only. (ex: 0)
|-
| 0x4C || 0x4 || uint32_t || Base Build No. PS Vita only. (ex: 0)
|-
| 0x50 || 0x30 || char[0x30] || Unknown. PS Vita only. (ex: 0x2000)
|-
| 0x80 || 0x20 * '''segment_num''' || '''Segment Table''' || Segment Table
|-
| 0x80 + (0x20 * '''segment_num''') || 0x40 * '''segment_num''' || '''Digest Table''' || Digest Table
|-
| 0x80 + (0x60 * '''segment_num''') || 0x20 || '''Header Digest''' || Header Digest (HMAC-SHA256)
|}
|}


=== Segment Table ===
===Hash Table===
 
The hash table contains a hash entry for every file inside the PUP.
Same as in PS3 PUP.
 
=== Digest Table ===
 
The Digest Table contains a Digest Entry for every segment inside the PUP.
 
<source lang="C">
typedef struct ScePupDigestEntry_v2 { // size is 0x40-bytes
SceUInt64 segment_index;
SceUInt8 digest[0x20];
SceUInt8 padding[0x18];
} ScePupDigestEntry_v2;
</source>


The hash entry format is:
{| class="wikitable"
{| class="wikitable"
|-
|-
! Offset !! Length !! Type !! Information
! Offset  
! Length  
! Type  
! Information
|-
|-
| 0x0 || 0x8 || unsigned long || Segment Index
| 0x0  
| 0x8  
| unsigned long
| File Entry ID
|-
|-
| 0x8 || 0x20 || uint8_t[0x20] || Digest (HMAC-SHA256)
| 0x8  
| 0x14
| bytes
| HMAC-SHA1 hash
|-
|-
| 0x28 || 0x18 || uint8_t[0x18] || Padding
| 0x1C
| 0x4
| unsigned int
| Unknown
|}
|}


=== Header Digest ===
==Files in tree example==
 
<source lang="C">
typedef struct {
  uint8_t digest[0x20]; // HMAC-SHA256
} PUPHeaderDigest_v2;
</source>
 
= Embedded files =
 
Here are examples of the files stored in a PUP.


== PS3 ==
Here are two examples of the files stored in a PUP.


=== 3.55 ===
=== 3.55 ===
<pre>
  PS3UPDAT.PUP
  PS3UPDAT.PUP
  ├── dots.txt
  ├── dots.txt
Line 913: Line 454:
  ├── version.txt
  ├── version.txt
  └── vsh.tar
  └── vsh.tar
</pre>
For a comparison between Retail and Debug firmware : [[3.55 firmware]]
 
For a comparison between Retail and Debug firmware : [[3.55 firmware]].


=== 3.60 - 4.00 ===
=== 3.60 - 4.00 ===


<pre>
  PS3UPDAT.PUP
  PS3UPDAT.PUP
  ├── dots.txt
  ├── dots.txt
Line 1,066: Line 604:
  └── vsh.tar
  └── vsh.tar
     └── a
     └── a
==Content of different versions==
The following information is a copy/paste from the output of [https://github.com/omgneeq/ps3utils KaKaRoTo's pup.c tool]. This is an old build, which does not support 3.56/3.60 and higher added entryid's x501 &amp; 0x601 (which because of that are named ''Unknown entry id'').
===File Structure===
HMAC Key
<!-- <pre>
static const uint8_t hmac_pup_key[] = {
  0xf4, 0x91, 0xad, 0x94, 0xc6, 0x81, 0x10, 0x96,
  0x91, 0x5f, 0xd5, 0xd2, 0x44, 0x81, 0xae, 0xdc,
  0xed, 0xed, 0xbe, 0x6b, 0xe5, 0x13, 0x72, 0x4d,
  0xd8, 0xf7, 0xb6, 0x91, 0xe8, 0x8a, 0x38, 0xf4,
  0xb5, 0x16, 0x2b, 0xfb, 0xec, 0xbe, 0x3a, 0x62,
  0x18, 0x5d, 0xd7, 0xc9, 0x4d, 0xa2, 0x22, 0x5a,
  0xda, 0x3f, 0xbf, 0xce, 0x55, 0x5b, 0x9e, 0xa9,
  0x64, 0x98, 0x29, 0xeb, 0x30, 0xce, 0x83, 0x66
};
</pre> -->
<pre>REDACTED</pre>
Header
<pre>
typedef struct {
  uint64_t magic;
  uint64_t package_version;
  uint64_t image_version;
  uint64_t file_count;
  uint64_t header_length;
  uint64_t data_length;
} PUPHeader;
</pre>
</pre>


== PS Vita ==
File Entry
<pre>
typedef struct {
  uint64_t entry_id;
  uint64_t data_offset;
  uint64_t data_length;
  uint8_t padding[8];
} PUPFileEntry;
</pre>


=== preinst - 01.000.000 ===
Hash Entry
{| class="wikitable sortable"
<pre>
|-
typedef struct {
! Type !! Header !! Information !! Size
  uint64_t entry_id;
|-
  uint8_t hash[20];
| ASCII:MM.mmmm (01.500) || [none] || version.txt || 1
  uint8_t padding[4];
|-
} PUPHashEntry;
| cui_setupper.self || SCE (SELF) || binary0.self || 4536
</pre>
|-
 
| unknown_lib.sprx || SCE (SELF) || binary1.self || 42
Footer
|-
<pre>
|  || XML || license.xml || 451
typedef struct
|-
{
|  || SCE || package_file_0.pkg || 7904
  uint8_t hash[20];
|-
  uint8_t padding[12];
|  || SCE || package_file_1.pkg || 8130
} PUPFooter;
|-
</pre>
|  || SCE || package_file_2.pkg || 8196
 
|-
Entry Id
|  || SCE || package_file_3.pkg || 8196
<pre>
|-
typedef struct {
|  || SCE || package_file_4.pkg || 8196
  uint64_t id;
|-
  const char *filename;
|  || SCE || package_file_5.pkg || 7883
} PUPEntryID;
|-
</pre>
|  || SCE || package_file_6.pkg || 8052
 
|-
PUPEntryID entries
|  || SCE || package_file_7.pkg || 6943
<pre>static const PUPEntryID entries[] = {
|-
  {0x100, "version.txt"},
|  || SCE || package_file_8.pkg || 7758
  {0x101, "license.xml"},
|-
  {0x102, "promo_flags.txt"},
|  || SCE || package_file_9.pkg || 7805
  {0x103, "update_flags.txt"},
|-
  {0x104, "patch_build.txt"},
|  || SCE || package_file_10.pkg || 7804
  {0x200, "ps3swu.self"},
|-
  {0x201, "vsh.tar"},
|  || SCE || package_file_11.pkg || 8005
  {0x202, "dots.txt"},
|-
  {0x203, "patch_data.pkg"},
|  || SCE || package_file_12.pkg || 8103
  {0x300, "update_files.tar"},
|-
  {0x501, "spkg_hdr.tar"},
|  || SCE || package_file_13.pkg || 8084
  {0x601, "ps3swu2.self"},
|-
  {0, NULL}
|  || SCE || package_file_14.pkg || 8066
};</pre>
|-
|  || SCE || package_file_15.pkg || 1661
|-
|  || SCEWM || package_file_16.pkg || 14
|-
|  || SCEAS || package_file_17.pkg || 1
|}


=== systemdata - 01.000.010 ===
===Contents===
{| class="wikitable sortable"
|-
! Type !! Header !! Information !! Size
|-
| ASCII:MM.mmmm (01.500) || [none] || version.txt || 1
|-
| cui_setupper.self || SCE (SELF) || binary0.self || 4536
|-
| unknown_lib.sprx || SCE (SELF) || binary1.self || 42
|-
|  || XML || license.xml || 451
|-
|  || SCE || package_file_0.pkg || 2625
|-
|  || SCE || package_file_1.pkg || 4048
|-
|  || SCE || package_file_2.pkg || 2746
|-
|  || SCE || package_file_3.pkg || 3874
|-
|  || SCE || package_file_4.pkg || 4742
|-
|  || SCE || package_file_5.pkg || 4660
|-
|  || SCE || package_file_6.pkg || 3946
|-
|  || SCE || package_file_7.pkg || 4145
|-
|  || SCE || package_file_8.pkg || 4630
|-
|  || SCE || package_file_9.pkg || 5476
|-
|  || SCE || package_file_10.pkg || 4860
|-
|  || SCE || package_file_11.pkg || 4722
|-
|  || SCEWM || package_scewm.wm || 4
|-
|  || SCEAS || package_sceas.as || 1
|}


=== full - 01.500.000 ===
{| class="wikitable"
{| class="wikitable sortable"
|-
! Type !! Header !! Information !! Size
|-
| ASCII:MM.mmmm (01.500) || [none] || version.txt || 1
|-
|-
| cui_setupper.self || SCE (SELF) || binary0.self || 4536
!Entry Id
!Filename
|-
|-
| unknown_lib.sprx|| SCE (SELF) || binary1.self || 42
|0x100
|[[version.txt]]
|-
|-
| || XML || license.xml || 451
|0x101
|[[license.xml]]
|-
|-
| || SCE || package_file_0.pkg || 634
|0x102
|[[promo_flags.txt]]
|-
|-
| || SCE || package_file_1.pkg || 6718
|0x103
|[[update_flags.txt]]
|-
|-
| || SCE || package_file_2.pkg || 8194
|0x104
|[[patch_build.txt]]
|-
|-
| || SCE || package_file_3.pkg || 8194
|0x200
|[[ps3swu.self]]
|-
|-
| || SCE || package_file_4.pkg || 8194
|0x201
|[[vsh.tar]]
|-
|-
| || SCE || package_file_5.pkg || 8194
|0x202
|[[dots.txt]]
|-
|-
| || SCE || package_file_6.pkg || 8194
|0x203
|[[patch_data.pkg]]
|-
|-
| || SCE || package_file_7.pkg || 8194
|0x300
|[[update_files.tar]]
|-
|-
| || SCE || package_file_8.pkg || 8194
|0x501
|[[spkg_hdr.tar]]
|-
|-
| || SCE || package_file_9.pkg || 8194
|0x601
|[[ps3swu2.self]]
|-
|-
|  || SCE || package_file_10.pkg || 8194
|-
|  || SCE || package_file_11.pkg || 6154
|-
|  || SCEWM || package_scewm.wm || 4
|-
|  || SCEAS || package_sceas.as || 1
|}
|}


= Tools =
[https://github.com/omgneeq/ps3utils KaKaRoTo's pup.c tool]


{{Custom Firmware}}<noinclude>[[Category:Main]]</noinclude>
{{Custom Firmware}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/Playstation_Update_Package_(PUP)"