PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

October 29, 2013 // 6:27 pm - Following up on the initial PS4 Firmware 1.50 Update details, today Sony PlayStation 4 hacker SKFU has made available the PS4UPDATE.PUP and Recovery file link and analysis, which comes shortly after some ps4-updatelist.xml files were made public by B7U3 C50SS as well.

Download: PS4 Firmware 1.50 Update (US) / PS4UPDATE.PUP (Mirror) / PS4UPDATE.PUP (Mirror #2) / PS4 Firmware 1.50 Recovery (US) / PS4UPDATE.PUP (Recovery - Mirror) / Extract Embedded .PUPs from Container Python Script by flat_z / PS4PUP.exe (Compiled) by PSGamer24 / PS4 PUP Extractor v1 / PS4 PUP Extractor v2 / PS4 PUP Extractor v3 / v3 Linux 64-bit Executable by xerpi / PS4PUP.exe v3 (Compiled) by PSGamer24 / PS4 PUP Unpacker / (Win32) by Hykem / PS4PUP.exe v4 (Compiled) by PSGamer24 / (Compiled EXE) by $n!pR / hykem GIT (based on flatz) / Jakes625 GIT

To quote: PlayStation 4 - Update File Analysis

Hey guys,

Here comes a short analysis of the PlayStation 4 update files. Available at:

Best regards,


Update: The update files were removed from the SONY update server. Since it is unclear if this was firmware version 1.00 or 1.50, let's hope there was some mistake made by SONY here which helps us in future

  • Firmware .PUP - c64d11f839ac8628176941b99fd3670e
  • Recovery .PUP - 6f4d6afe98dd7297c70aa4d6e7e5482b

Update #2: It appears Frumix (via also discovered the same thing, who states the following additional details:

PS4 1.5 Update File is apparently up on update servers #1

  • Update file (308 MB)
  • Recovery file (859 MB)

Just like on PS3, it seems it's the same file across all regions (data in the american xml seems to be erroneous somehow). Not sure what you might need it for this early, but here you go. Update if old.

IMPORTANT: If you're unsure what to do with any of this, wait until official Sony page goes online.

According to Sony's Shuei Yoshida confirmed that the PS4 1.50 System Update won't be included on PlayStation 4 game discs.

When asked if the servers fail on launch day, Yoshida answered with "No" outright. He also stated that games will not insert the update, so users will have to download it from the Internet.

From Sony PlayStation 4 hacker flat_z (via comes a Python script to extract embedded .PUPs from the PS4 container, as follows:

[Register or Login to view code]

An updated and commented UnPKG Python Script revision by flat_z (via as well:

[Register or Login to view code]

Table Entry Hashes (SHA-256)

The first entry in the index table points to a block of hashes (Using Amazon Instant Video: UP2064-CUSA00130_00-AIV00000000000US.pkg for this example).

[Register or Login to view code]

Offset: 0x00002CA0 Length: 0x00000220

[Register or Login to view code]

First hash is blank, can't hash the table of hashes. The remaining hashes are for each of the remaining Index Table Entries.

i.e the second entry in the Index Table should have a SHA-256 matching the following:

[Register or Login to view code]

For those curious:

  • Normal firmwares have 3 PUPs inside.
  • Recovery firmwares have 4 PUPs inside.
  • Debug firmwares have 5 PUPs inside.

Everything is encrypted after that, even the selfs, so might take a while until we see runable x86/64 code appearing from the PUPs.

Finally, from xerpi comes a few revisions of his own PlayStation 4 PUP Extractor (linked above) with details below as follows:

[xerpi] here's my version of a PS4 PUP extractor:
[flatz] xerpi, i think SKFU is wrong with the fixed size of header
[flatz] seems like data is aligned to the block size
[flatz] so if you have 20 files for example, then data offset should be 0x400
[xerpi] I've thought this, but I've read that there are a maximum of 10 files
[flatz] i think it is just his assumption
[xerpi] so If there's no file limit, the data would be: 32 + 48*filecount
[xerpi] data offset*
[xerpi] but there's still a reserved space so I don't know if this space will continue existing
[flatz] actually you don't need to calculate data offset
[flatz] just get it from entry table
[flatz] data_offset = block_index * block_size
[flatz] header always start with block_index = 0
[xerpi] right, but as I see block_size is 512
[xerpi] so the first PUP offset (data_offset) will be 512 bytes after the begin of the file
[xerpi] I don't see any dynamic number telling the size of the blocks
[flatz] it is fixed to 512
[flatz] data_offset = align_up(header_size + entry_size * num_entries, 512) where header_size = 0x20, entry_size = 0x30
[xerpi] yes, so I set the general offset to PS4_PUP_HEADER_SIZE + header-]pups[i].offset
[xerpi] ok, so the only static size here is the size of the header of the header (the top part of the header)
[flatz] yep
[flatz] and block size
[xerpi] yeah
[xerpi] It makes sense now, thanks
[flatz] np
[flatz] seems like they use some sort of mapping/paging.. that's why they use fixed-size blocks and padding to make data size multiple of block size
[xerpi] I see
[xerpi] done:
[flatz] great
[xerpi] treat it as an "experiment"
[xerpi] I was bored when I saw this info so I decided to try to do a simple pup extractor
[flatz] i'm too
[xerpi] btw I got to go now, it's a bit late here hahaha
[xerpi] cya

ps4pupextractor v2 by xerpi

[Register or Login to view code]

ps4pupextractor v2 by xerpi

[Register or Login to view code]

ps4pupextractor v3 by xerpi (via xerpi)

[Register or Login to view code]

From Hykem also comes a PS4 PUP Unpacker, as follows:

[Register or Login to view code]

Update #3: As the official PS4 Firmware v1.50 PUP (1.501) is now released, this leak apparently was the PlayStation 4 v1.50 PUP not the v1.501 Update for those wondering.

Update #4: From Habib via harryoke come the PS4 - SLB2 Structure - .PUP KEYS, as follows:

[Register or Login to view code]


These files are contained inside of SLB2 containers. They contain data pertaining to system firmware.

You are able to decrypt inner pup files using the follow keys:

[Register or Login to view code]

0x40 bytes after the magic are encrypted with aes. (256 bits CBC Mode). The new encrypted buffer contains the new erk and riv to be used for the next decryption. The next 0x240 bytes are decrypted with aes. (128 bits CTR Mode). That 0x240 bytes contain a table of information relating to the system files. Each entry in there contains the offset for encrypted sections, sha1 hmac keys, and the erk and riv to decrypt each encrypted section. Each section is decrypted using aes. (128 bits CTR mode).

PlayStation 4 FW Update 1.5 (PS4UPDATE.PUP) & PS4 Updatelist XML Out

PlayStation 4 FW Update 1.5 (PS4UPDATE.PUP) & PS4 Updatelist XML Out

PlayStation 4 FW Update 1.5 (PS4UPDATE.PUP) & PS4 Updatelist XML Out

PlayStation Follow us on Twitter, Facebook and join us at our new site WWW.PSXHAX.COM!

#29 - xerpi - October 30, 2013 // 10:10 pm
xerpi's Avatar
Wow thanks I wasn't expecting my extractor to be published

Btw, this moring I've improved it a bit. Now it follows some recommendations made by flatz on the IRC.

v3 Source:

[Register or Login to view code]

v3 Linux 64 bit executable:

#28 - B7U3 C50SS - October 30, 2013 // 5:29 pm
B7U3 C50SS's Avatar
SONY = FAIL!!! Haha!

#27 - rodq - October 30, 2013 // 1:39 pm
rodq's Avatar
The unpacker is not good.

The "crypted content size" of PS4UPDATE4.PUP should be 0x7A3BFE81.

#26 - misiozol - October 30, 2013 // 12:17 pm
misiozol's Avatar
I wonder if there was a fault/vulnerability if was pulled so quickly , $ony made quite few stupid mistakes in past that led to fully open system

#25 - elser1 - October 30, 2013 // 7:45 am
elser1's Avatar
I just noticed the background music player. great so now we will have even more 10 yr olds playing too loud hip hop (because they are kool) while ya trying to play lol

#24 - PS4 News - October 30, 2013 // 6:43 am
PS4 News's Avatar
Interesting Zarod, if so that could explain why Sony was so quick to pull it perhaps...

#23 - Zarod - October 30, 2013 // 6:18 am
Zarod's Avatar
Sweet update! Though not sure if anyone else really noticed this: looking at the screenshots, it appears to be firmware 1.00, not 1.50, as the XML data specifically states 1.00 throughout and the PUP version states 100 in the HEX code. Also considering it was only up for a very short time before being removed almost immediately. Unless it was just a placeholder. Just a thought.

#22 - B7U3 C50SS - October 30, 2013 // 4:24 am
B7U3 C50SS's Avatar
it would seem the links from mega are up and stable i just finished downloading the normal version of the .pup (not the recovery version) from!WE8zUAyb!ZuZy5Vxrd4eCc4bTvFW_ZC7lu7Ub0tcdyE08xbJtrok and i'm still getting the recovery version from!GEdQkRRR!KSCLLQEGlWfQwsA3yBo3pkZqqqE6w-Jwk-5CvLd4GR0

if the md5's don't match what it says in the post you have a problem because it was posted to this topic as a link and i think they are correct.

#21 - JeoWay - October 30, 2013 // 4:23 am
JeoWay's Avatar
Quote Originally Posted by PSGamer24 View Post
Compiled the pup extractor

As I was about to go and do so, you saved me a bit of time

#20 - PS4 News - October 30, 2013 // 3:31 am
PS4 News's Avatar
Very cool and +Rep PSGamer24 I will add it to the main article. I also added a few revisions from xerpi of his own PS4 PUP Extractor there too.