Reading the GTA VI manifest from PSN - PPSA01547_00 update feed

from @CRTkafa and friends

one XML file, a bunch of links, zero magic. here's what every line means and where it points.
written by AI, don't get weird about it pls

original post

https://x.com/CRTkafa/status/2119712648925458780

⚠️ read this first

• there is no verified jailbreak for 14.x right now. the update asks for system software 14.22.
• do not download anything. not the pkg, not the manifests. this page is for reading and learning.
• if you don't know what you're doing, don't do it. a wrong file on a console can brick it, and nobody here can fix your console.
• the links below are Sony's own public addresses, listed as reference only. nothing is hosted here.

at a glance

1. what is this thing?

every PS5 game asks Sony's servers one question when it boots: "is there an update for me?"
the answer comes back as a small XML file called a title patch (title_patch).
that's the file we're reading. it lists:

• the base game patch (a small delta, about 130 MiB)
• the add-on content (DLC, ac_tag)
• a few related title IDs

no game data in the XML itself. it's just a signpost: "patch is here, DLC is there, here's the checksum."

2. the quick facts

system_ver as hex: 337772544 = 0x14220000, the minimum PS5 system software the patch wants. read it as 14.22.
335544377 (DLC entries) = 0x14000039, also 14.x, just a lower minimum.

3. the links

3.1 base game patch

• digest of the delta pkg (SHA-256): a947a76bbecfd57722e3d19d06c75400f83a936b94f4549a51c94ef9a611bd0a
• packageDigest of the full package (from the manifest): 41EEF7C3F8E9D0FF96BB62B965F9AA2E7272A73D614E65EB17D9DC093C677F26
• the 13 in .../pkg/13/... is the pfs_revision, the 36 in .../info/36/... is the metadata_ver. the numbers in the URL are not random.
• the delta pkg and the CDN files were published on 2026-11-02.

3.2 add-on content (DLC)

all four: content_ver 01.000.000, mandatory=false, system_ver 335544377.
DLC is optional, the game boots without it.

each one is 1,376,256 bytes (1.31 MiB): a 640 KiB pkg plus a 704 KiB _sc.pkg. that is far too small to hold real content.

SHA-256 digests (from the XML), in the same order:

1
2
3
4

EXTRA...02  36d19545a762b6a29a6b630bac973804db76e3bc15e76266fd64e1a9bedd0dd5
EXTRA...03  7d5b1a97ee518ed3600367e577085cc395be742ab3d044a41443022644b4957c
EXTRA...04  9630fea1dee41ba2cf325890a2da2acd8b507f6f642b16e2b051f9040dc6f3d9
EXTRA...05  8376132951bb9c2a0534488cedd7f2406d2f22a8daa6e0b0155d7820a42a400e

3.3 related titles (pssdc)

1
2

PPSA01721_00   EP1004-PPSA01721_00   (Europe)
PPSA16755_00   UP1004-PPSA16755_00   (US)

the game's own param.json lists the same two under serviceIdForSharing, with EP and UP prefixes. other regions or editions that share this content.

4. how to read the URLs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

http://gst.prod.dl.playstation.net/gst/prod/00/PPSA01547_00/app/pkg/13/f_<sha256>/<content_id>-DP.pkg
 |            |                         |  |        |         |   |   |     |           |
 |            |                         |  |        |         |   |   |     |           +-- DP = delta patch
 |            |                         |  |        |         |   |   |     +-- file-name hash
 |            |                         |  |        |         |   |   +-- f_ = hashed folder
 |            |                         |  |        |         |   +-- pfs_revision
 |            |                         |  |        |         +-- pkg = the package itself
 |            |                         |  |        +-- app = base game (ac = add-on)
 |            |                         |  +-- title id
 |            |                         +-- region/shard 00
 |            +-- gst = game-storage CDN
 +-- plain http, the patch is checked by digest, not by TLS

• gst hosts the big files (.pkg), plain http.
• sgst hosts the small files (.json manifests), https. the https certificate is signed by Sony's own root (SCEI DNAS Root 05), so a normal browser or curl complains about an untrusted chain. that is expected, not an attack.
• app vs ac: base game vs add-on content.
• the f_<hash> folder is part of the path, so you can't guess a link, you have to read it from the XML.

5. what the manifest says

the base manifest (...GRANDTHEFTAUTO00.json) is a list of pieces. real numbers:

what to take from it:

• the manifest describes the whole package (207.77 GiB), while the delta patch is only ~130 MiB. two different things.
• the pieces are plain 4 GiB slices with offsets. there are no file names inside the manifest, so you can't read the game's contents from it. that is only possible after unpacking the package.
• the game declares 320 GiB as its install size (appSizeInGib), more than the 207.77 GiB download.

6. what's inside the metadata container (_sc.pkg)

the 150 MiB _sc.pkg is the only piece that is not encrypted. it starts with the magic 7F 43 4E 54 (\x7fCNT). the big pieces start with a different header (7F 46 49 48, \x7fFIH) and are the encrypted part.

files listed inside:

1
2
3
4
5
6

param.json            origin-param.json      target-param.json
icon0.png / .dds      pic0.png / .dds        pic1.png / .dds      pic2.png / .dds
save_data.png         snd0.at9
trophy2/trophy00.ucp  trophy2/npbind.dat
uds/uds00.ucp         uds/npbind.dat
playgo-chunk.dat      playgo-hash-table.dat  playgo-ficm.dat

so the package ships the trophy set, the UDS (activity/ "universal data system") data, the home-screen art, a sound (snd0.at9), and the PlayGo chunk tables.
the background video you see on the PS5 home screen is built from pic0 + snd0: 3840x2160, H.264, 30 fps, 57.7 seconds, with AAC audio.

param.json, the interesting fields

activities and multiplayer

the game allows these intents (gameIntent.permittedIntents):

• joinSession
• launchActivity
• launchMultiplayerActivity

join-a-friend's-session and launch-straight-into-multiplayer are built into the game's own metadata.

age ratings (ageLevel)

languages (localizedParameters)

12: en-US (default), de-DE, es-ES, es-419, fr-FR, it-IT, ko-KR, pl-PL, pt-BR, ru-RU, zh-Hans, zh-Hant.
the English title is "Grand Theft Auto VI".

the three versions inside

_sc.pkg carries three copies of the parameters, one per version of the game. that gives the version history:

the notable change: the first release and the previous patch ask for 13.60, this patch raises the minimum to 14.22.

7. what happens on a real console

1. PS5 launches the game, asks Sony for title_patch of PPSA01547_00
2. gets this XML
3. compares content_ver with what's installed
4. mandatory=true and installed version is lower, so it downloads the delta pkg (~130 MiB) and applies it
5. DLC entries are only fetched if you own them
6. every download is verified against digest, bad hash means the file is rejected

8. play something in the meantime

before GTA 6, play Vice City online in the browser with friends. it came out in 2003. built off Vice City, with networking and multiplayer written from scratch.

>> https://gta.crt.fyi/

9. notes

• this is Sony's own public update feed. nothing here is cracked, nothing here is leaked game content.
• the XML and manifests list where files are, not what's inside. the big packages are encrypted.
• everything in section 6 comes from the one unencrypted metadata container, not from the encrypted game data.
• the links are shared as reference for study (formats, versioning, CDN layout). no files are hosted here.
• manifests (.json) are the nice part to poke at: piece sizes, hashes, chunk layout.
• again: don't download, don't install, don't try this on a console you care about.

1

greetz: everyone who stays curious