PUP

PUP files are update archives for the Vita.

PUP Header

A good resource on the PUP header can be found HERE.

Filename IDs

It is a mistake to try to connect a file entry ID to any specific file. A better way of organizing the update contents is through the extracted SCE encrypted file header. Nevertheless, there are certain file entry IDs that have been linked with the same data throughout all observed update packages.

File Entry ID	Description
0x100	Version string
0x101	License XML
0x200	psp2swu.self, main updater
0x204	cui_setupper.self, development updater initializer
0x400	Watermark. Same ID for retail PUPs. Different IDs for dev PUPs for each developer.
0x401	Unknown SCEAS magic file
0x2005	CP firmware in early debug updates only
0x2006	CP firmware in debug updates only

Package Headers

Most of the files in the update PUP are SCE encrypted. Each component of the update is broken up into multiple parts, then optionally compressed, and finally encrypted into the SCE file. Right after the SCE header (usually offset 0x400) is the update package header that provides information for piecing the component back together. The contents of this header is as follows:

Offset	Size	Description
0x0	0x4	Version (0x4)
0x4	0x4	Type ID
0x8	0x4	Flags
0xC	0x4	?
0x10	0x8	Update FW Version
0x18	0x8	Final (decompressed) size
0x20	0x8	Decrypted size
0x28	0x8	?
0x30	0x4	?
0x34	0x4	?
0x38	0xC	?
0x3C	0x4	?
0x40	0x8	?
0x48	0x8	?
0x50	0x8	Offset
0x58	0x8	Size
0x60	0x8	Part Index
0x68	0x8	Total Parts
0x70	0x8	?
0x78	0x8	?

Flags

There are flags that are set in the package header. Some potential ones are listed here.

Flag	Description
0x10	Set when compressed
0x2	Has multiple parts
0x1	Set when compressed

Type ID

The type id determines which decryption routine to use in SceSblSsUpdateMgr. There is a truth table to determine which id can be handled by which decryption function. To see how this table is used, check out the example code for decrypting packages.

Type ID	Func 1?	Func 2?	Func 3?
0x0	No	No	No
0x1	Yes	Yes	No
0x2	No	No	No
0x3	No	No	Yes
0x4	No	No	Yes
0x5	No	No	No
0x6	No	No	No
0x7	No	No	No
0x8	Yes	Yes	No
0x9	Yes	Yes	No
0xA	Yes	Yes	Yes
0xB	Yes	Yes	No
0xC	Yes	Yes	No
0xD	Yes	Yes	No
0xE	No	No	No
0xF	Yes	Yes	No
0x10	Yes	Yes	No
0x11	Yes	Yes	No
0x12	Yes	Yes	No
0x13	Yes	Yes	No
0x14	Yes	Yes	No
0x15	Yes	Yes	Yes
0x16	Yes	Yes	Yes
0x17	Yes	Yes	Yes
0x18	Yes	Yes	No
0x19	Yes	Yes	No
0x1A	No	No	No
0x1B	No	No	Yes

Type ID (Identifier)

The type ID is also used to identify the component of the update.

Type ID	Note
0x0
0x1	os0 partition
0x2
0x3
0x4	Permissions related to TAR archives of type 0x16
0x5
0x6
0x7
0x8	Syscon Update (0x9A54 type)
0x9	SLB2 bootloaders
0xA	vs0 partition
0xB	Development CP firmware (same file as PUP entry 0x2006)
0xC	Motion related
0xD	Bbmc related
0xE
0xF	Motion related
0x10	Touch/Syscon related
0x11	Touch related
0x12	Syscon related
0x13	Syscon related
0x14	Syscon Update (0x3665 type)
0x15
0x16	TAR archive, patch update for vs0
0x17	sa0 partition
0x18	pd0 partition
0x19	Syscon Update (0xC5E7 type)
0x1A
0x1B	PSP Emulator lists

PUP Update Contents

Each PUP contain updates for different partitions of the system. Most packages, once decrypted, decompressed, and pieced together are an raw disk image for the partition to update. Sometimes a TAR archive patch is also used along with the disk images but not as often. Sony usually releases three kinds of update files, each to update different components.

full

This contains the actual system files. The main components are os0, vs0, and the bootloader partition.

systemdata

Systemdata PUPs only update the sa0 partition. It is likely separated from the main update due to it not regularly needing updates and size concerns.

preinst

Preinst PUPs only update the pd0 partition. This is the Welcome Park application and the initial setup movie. It is likely separated from the main update because of the size.

com

Unknown.

modeldiff

Unknown.

Debug

Debug updates for PTEL-XXXX and PDEL-XXXX do not separate into different PUPs. A single PUP will update all components. Additionally updates for PDEL units contains updates for the CP and probably other development unit specific components.

SCEWM

SCEWM Header

This is a watermark for PUPs. For development PUPs, the Issue ID is unique to the company/organization the PUP is issued to.

Offset	Size	Description
0x0	0x6	Magic "SCEWM\0"
0x6	0x2	?Version? (ex: 00 01)
0x8	0x4	Unknown (ex: 01 00 00 00)
0xC	0x4	Content size including RSA area (ex: 0x1000)
0x10	0x4	Issue ID (ex: 0xD9)
0x14	0x4	Unknown (ex: 01 00 00 00)
0x18	0x4	Unknown (ex: 01 00 00 00)
0x1C	0x4	Unknown (ex: 01 00 00 00)

The Issue ID for SCE/retail PUPs seems to be 0x5A.

SCEWM Content

The encrypted SCEWM file is composed of 3 parts:

• SCEWM header: size 0x20 bytes.
• RSA signature of the PUP regardless of the watermark: size 0x100 bytes.
• SCEWM unique data per issue ID: size 0x900 bytes (may vary, check SCEWM header).

SCEWM Security

When comparing same PUP signed for two different issue IDs, we can notice only 2 differences:

• the issue ID in SCEWM header
• the SCEWM unique data