# Phase 0.9E-R official Y2JB release correlation Date: 2026-07-18 Result: `OFFICIAL_RELEASE_NO_MATCH` Overall classification: `LOCAL_BACKUP_NOT_CORRELATED` This was a bounded host-side investigation. Public network access was limited to official `Gezine/Y2JB` GitHub repository, API, tag, release, asset metadata, and source-archive URLs. No PS5 address, request, connection, transfer, payload, target build, restore, or execution was used. ## Local evidence captured before network access | Field | Value | |---|---| | path | `/Y2JB-Autoloader-403-1240.zip` | | size | `504159435` | | SHA-256 | `805e3f87f0c371223619ffc7d3a7b3c0d41a1fae8a8b1171d9e2f162659e8291` | | creation UTC | `2026-06-23T14:10:39.0466596Z` | | modification UTC | `2026-06-23T14:11:10.6992328Z` | | ZIP comment | empty | | first 64 bytes | `504b030414000000000041abca5c000000000000000000000000040000005053352f504b030414000000000041abca5c0000000000000000000000000b000000` | | last 64 bytes | `76652e6461740a0020000000000001001800c065678d17f9dc0100000000000000000000000000000000504b050600000000050005000a020000abda0c1e0000` | | Zone.Identifier | 327 bytes; SHA-256 `70928a3d66cbb9f584596414c4fe535b498dd5ed7c5f55bbeae4efeb146ea841` | | local download indication | `ReferrerUrl` and `HostUrl` are MediaFire; exact volatile signed URL is retained only in the original ADS | | browser records | exact filename absent from five bounded Chrome/Edge/Brave/Firefox history candidates | The MediaFire marker is local provenance evidence, not evidence about the bytes hosted there and not an official-source match. ### ZIP entries The four directory entries use method 0, CRC `00000000`, flag bits 0, and zero sizes. Central-directory metadata was captured without normalization: | Name | Method | Compressed | Uncompressed | CRC32 | DOS timestamp | Header offset | External attr | |---|---:|---:|---:|---|---|---:|---:| | `PS5/` | 0 | 0 | 0 | `00000000` | `2026-06-10 21:26:02` | 0 | 16 | | `PS5/EXPORT/` | 0 | 0 | 0 | `00000000` | `2026-06-10 21:26:02` | 34 | 16 | | `PS5/EXPORT/BACKUP/` | 0 | 0 | 0 | `00000000` | `2026-06-10 21:26:54` | 75 | 16 | | `PS5/EXPORT/BACKUP/202606102126_00/` | 0 | 0 | 0 | `00000000` | `2026-06-10 21:27:24` | 123 | 16 | | `PS5/EXPORT/BACKUP/202606102126_00/archive.dat` | 8 | 504158629 | 504365056 | `522808c8` | `2026-06-10 21:27:28` | 187 | 32 | All five entries use general-purpose flag bits 0. The archive entry reports create system 0, create version 63, and extraction version 20. The inner first 64 bytes are `5349454341460000010000000000000001000000000000000300000000000000c6ff138694ca1d2701779aae67de1525e5158700e6158700e715870000000000`. Only the `SIECAF` magic and bounded header were inspected. No new parsing, decryption, or reverse engineering was attempted. Its previously established SHA-256 remains `6439834e8856d45b6d6fe699b74c35ca6985a199ea8ecf3e398c018d37be2d55`. ## Official inventory Metadata came from: - `https://api.github.com/repos/Gezine/Y2JB`; - `https://api.github.com/repos/Gezine/Y2JB/releases?per_page=100`; - `https://api.github.com/repos/Gezine/Y2JB/tags?per_page=100`. The official API returned three releases and five tags. | Version | Official state | Tag commit | Release publication | Source tree | |---|---|---|---|---| | 1.2 | changelog text only; no current tag or release | unknown; not guessed | none | no exact release tree | | 1.2.1 | tag `Y2JB-1.2.1`; no current release | `6210f98c23552e6eb3c4c8981f72a200bb6121b2` | none | `928ceb979881a063457270dde4961ea4a06bc1fa` | | 1.3 | release `Y2JB 1.3 (deprecated)`, tag `1.3` | `82e6bbf1935d5f41c3bd5bd9e6598cf90bb2e022` | `2026-05-25T14:29:41Z` | `df29ffe4d8131b5f8b0da1874e34b95a41f0660d` | | 1.4 | tag `1.4`; no current release | `02eda2e772df629ecfe5a46459769bd8c994ef3e` | none | `ec06403b45f7b68e01eb5053f81277dee4910dd2` | | 1.5 | release `Y2JB 1.5 (deprecated)`, tag `1.5` | `5fa556e6281229057dace3254b099f95261df386` | `2026-05-22T15:06:30Z` | `db364529c347f34b8ddb186f57bb61dab91113db` | | 1.6 | release `Y2JB 1.6`, tag `1.6` | `0dbbf4e7e0203af7e5d101a3256c634edf4e3ba2` | `2026-06-09T14:54:35Z` | `c4344f43af7c268337437e6419548dba6f6bc211` | The 1.6 release body contains the historical 1.2 through 1.5 changelogs. That does not create missing release objects or identify an exact 1.2 commit. ## Metadata-first asset comparison GitHub supplied SHA-256 digests for every current official asset. Each digest and size excludes the local outer ZIP, so no large release asset was downloaded. | Tag | Asset ID | Official asset | Official size | Size delta vs local | Official SHA-256 | Result | |---|---:|---|---:|---:|---|---| | 1.6 | 442805805 | `Y2JB_backup_1.6.12.20.zip` | 498991521 | -5167914 | `9c097ed9000792507bcf307eff0802f40ee64dc047ab6de3d38acccc62d39dcc` | `NO_MATCH` | | 1.6 | 442358421 | `Y2JB_backup_1.6.4.03.zip` | 504395044 | +235609 | `b01b4f442327f9eca90ffc4506dfa58249e4ac70cb9d7488c856c9e8dfaf37b4` | `NO_MATCH` | | 1.6 | 442358388 | `Y2JB_download0_1.6.zip` | 315229037 | -188930398 | `d032954033c17acda47c41179a22fa09016ddd40a274f4e9afbb051e5d08d3bd` | `NO_MATCH` | | 1.5 | 429350761 | `Y2JB_backup_1.5.zip` | 503863926 | -295509 | `91bc9fb38e62d2b34d0009dbfd6a46dffb379277eef3915dd0a1956f65462a45` | `NO_MATCH` | | 1.5 | 429351154 | `Y2JB_download0_1.5.zip` | 336514975 | -167644460 | `f7e5debb2e4c6b3fe7224e549c4aaf9b273a178543cd0bfe84e37bc0521d590a` | `NO_MATCH` | | 1.3 | 429415428 | `Y2JB_backup_1.3.7z` | 488117068 | -16042367 | `e63a6b8fe134ad93b8a6a3b332b98810598aff7dfb6703a226523143c3844dfb` | `NO_MATCH` | | 1.3 | 429415862 | `Y2JB_download0_1.3.zip` | 336789664 | -167369771 | `c64ef5bc508e4d81395928a8a54b2832f2b37c9cd1603ec9e7e3bd6f5ad6b526` | `NO_MATCH` | Asset creation/update times recorded by GitHub were: - 1.6 `12.20`: `2026-06-09T14:52:35Z` / `14:53:10Z`; - 1.6 `4.03`: `2026-06-09T03:33:57Z` / `03:34:40Z`; - 1.6 `download0`: `2026-06-09T03:33:55Z` / `03:34:30Z`; - 1.5 backup: `2026-05-25T12:46:49Z` / `12:47:34Z`; - 1.5 `download0`: `2026-05-25T12:47:34Z` / `12:47:56Z`; - 1.3 backup: `2026-05-25T14:27:41Z` / `14:28:29Z`; - 1.3 `download0`: `2026-05-25T14:28:29Z` / `14:29:18Z`. The 1.6 release labels its `4.03` backup for firmware 4.03 through 12.40 and its `12.20`-named backup for 12.60 and later. Releases 1.3 and 1.5 are marked deprecated. Their release bodies, and the 1.6 historical changelog, were retained as descriptive metadata only; they do not establish local identity. No asset has the local name, size, or SHA-256. An exact byte match is therefore mathematically impossible for the inventoried assets without downloading them. Downloading a digest-excluded 315–504 MB object would add no evidence and would violate the metadata-first rule. ## Decision - correlation: `OFFICIAL_RELEASE_NO_MATCH`; - identified local release: none; - local outer-to-release association: none; - large backup assets downloaded: zero; - local backup classification: `LOCAL_BACKUP_NOT_CORRELATED`; - Phase 0.9F offline design allowed: `false`. This does not prove that the local package contains no official-derived content. It proves that its outer bytes are not any current official `Gezine/Y2JB` release asset.