7.0 KiB
Phase 0.9E-R official Y2JB release correlation
Date: 2026-07-18
Result: OFFICIAL_RELEASE_NO_MATCH
Overall classification: LOCAL_BACKUP_NOT_CORRELATED
This was a bounded host-side investigation. Public network access was limited
to official Gezine/Y2JB GitHub repository, API, tag, release, asset metadata,
and source-archive URLs. No PS5 address, request, connection, transfer,
payload, target build, restore, or execution was used.
Local evidence captured before network access
| Field | Value |
|---|---|
| path | <local-download>/Y2JB-Autoloader-403-1240.zip |
| size | 504159435 |
| SHA-256 | 805e3f87f0c371223619ffc7d3a7b3c0d41a1fae8a8b1171d9e2f162659e8291 |
| creation UTC | 2026-06-23T14:10:39.0466596Z |
| modification UTC | 2026-06-23T14:11:10.6992328Z |
| ZIP comment | empty |
| first 64 bytes | 504b030414000000000041abca5c000000000000000000000000040000005053352f504b030414000000000041abca5c0000000000000000000000000b000000 |
| last 64 bytes | 76652e6461740a0020000000000001001800c065678d17f9dc0100000000000000000000000000000000504b050600000000050005000a020000abda0c1e0000 |
| Zone.Identifier | 327 bytes; SHA-256 70928a3d66cbb9f584596414c4fe535b498dd5ed7c5f55bbeae4efeb146ea841 |
| local download indication | ReferrerUrl and HostUrl are MediaFire; exact volatile signed URL is retained only in the original ADS |
| browser records | exact filename absent from five bounded Chrome/Edge/Brave/Firefox history candidates |
The MediaFire marker is local provenance evidence, not evidence about the bytes hosted there and not an official-source match.
ZIP entries
The four directory entries use method 0, CRC 00000000, flag bits 0, and
zero sizes. Central-directory metadata was captured without normalization:
| Name | Method | Compressed | Uncompressed | CRC32 | DOS timestamp | Header offset | External attr |
|---|---|---|---|---|---|---|---|
PS5/ |
0 | 0 | 0 | 00000000 |
2026-06-10 21:26:02 |
0 | 16 |
PS5/EXPORT/ |
0 | 0 | 0 | 00000000 |
2026-06-10 21:26:02 |
34 | 16 |
PS5/EXPORT/BACKUP/ |
0 | 0 | 0 | 00000000 |
2026-06-10 21:26:54 |
75 | 16 |
PS5/EXPORT/BACKUP/202606102126_00/ |
0 | 0 | 0 | 00000000 |
2026-06-10 21:27:24 |
123 | 16 |
PS5/EXPORT/BACKUP/202606102126_00/archive.dat |
8 | 504158629 | 504365056 | 522808c8 |
2026-06-10 21:27:28 |
187 | 32 |
All five entries use general-purpose flag bits 0. The archive entry reports create system 0, create version 63, and extraction version 20.
The inner first 64 bytes are
5349454341460000010000000000000001000000000000000300000000000000c6ff138694ca1d2701779aae67de1525e5158700e6158700e715870000000000.
Only the SIECAF magic and bounded header were inspected. No new parsing,
decryption, or reverse engineering was attempted. Its previously established
SHA-256 remains
6439834e8856d45b6d6fe699b74c35ca6985a199ea8ecf3e398c018d37be2d55.
Official inventory
Metadata came from:
https://api.github.com/repos/Gezine/Y2JB;https://api.github.com/repos/Gezine/Y2JB/releases?per_page=100;https://api.github.com/repos/Gezine/Y2JB/tags?per_page=100.
The official API returned three releases and five tags.
| Version | Official state | Tag commit | Release publication | Source tree |
|---|---|---|---|---|
| 1.2 | changelog text only; no current tag or release | unknown; not guessed | none | no exact release tree |
| 1.2.1 | tag Y2JB-1.2.1; no current release |
6210f98c23552e6eb3c4c8981f72a200bb6121b2 |
none | 928ceb979881a063457270dde4961ea4a06bc1fa |
| 1.3 | release Y2JB 1.3 (deprecated), tag 1.3 |
82e6bbf1935d5f41c3bd5bd9e6598cf90bb2e022 |
2026-05-25T14:29:41Z |
df29ffe4d8131b5f8b0da1874e34b95a41f0660d |
| 1.4 | tag 1.4; no current release |
02eda2e772df629ecfe5a46459769bd8c994ef3e |
none | ec06403b45f7b68e01eb5053f81277dee4910dd2 |
| 1.5 | release Y2JB 1.5 (deprecated), tag 1.5 |
5fa556e6281229057dace3254b099f95261df386 |
2026-05-22T15:06:30Z |
db364529c347f34b8ddb186f57bb61dab91113db |
| 1.6 | release Y2JB 1.6, tag 1.6 |
0dbbf4e7e0203af7e5d101a3256c634edf4e3ba2 |
2026-06-09T14:54:35Z |
c4344f43af7c268337437e6419548dba6f6bc211 |
The 1.6 release body contains the historical 1.2 through 1.5 changelogs. That does not create missing release objects or identify an exact 1.2 commit.
Metadata-first asset comparison
GitHub supplied SHA-256 digests for every current official asset. Each digest and size excludes the local outer ZIP, so no large release asset was downloaded.
| Tag | Asset ID | Official asset | Official size | Size delta vs local | Official SHA-256 | Result |
|---|---|---|---|---|---|---|
| 1.6 | 442805805 | Y2JB_backup_1.6.12.20.zip |
498991521 | -5167914 | 9c097ed9000792507bcf307eff0802f40ee64dc047ab6de3d38acccc62d39dcc |
NO_MATCH |
| 1.6 | 442358421 | Y2JB_backup_1.6.4.03.zip |
504395044 | +235609 | b01b4f442327f9eca90ffc4506dfa58249e4ac70cb9d7488c856c9e8dfaf37b4 |
NO_MATCH |
| 1.6 | 442358388 | Y2JB_download0_1.6.zip |
315229037 | -188930398 | d032954033c17acda47c41179a22fa09016ddd40a274f4e9afbb051e5d08d3bd |
NO_MATCH |
| 1.5 | 429350761 | Y2JB_backup_1.5.zip |
503863926 | -295509 | 91bc9fb38e62d2b34d0009dbfd6a46dffb379277eef3915dd0a1956f65462a45 |
NO_MATCH |
| 1.5 | 429351154 | Y2JB_download0_1.5.zip |
336514975 | -167644460 | f7e5debb2e4c6b3fe7224e549c4aaf9b273a178543cd0bfe84e37bc0521d590a |
NO_MATCH |
| 1.3 | 429415428 | Y2JB_backup_1.3.7z |
488117068 | -16042367 | e63a6b8fe134ad93b8a6a3b332b98810598aff7dfb6703a226523143c3844dfb |
NO_MATCH |
| 1.3 | 429415862 | Y2JB_download0_1.3.zip |
336789664 | -167369771 | c64ef5bc508e4d81395928a8a54b2832f2b37c9cd1603ec9e7e3bd6f5ad6b526 |
NO_MATCH |
Asset creation/update times recorded by GitHub were:
- 1.6
12.20:2026-06-09T14:52:35Z/14:53:10Z; - 1.6
4.03:2026-06-09T03:33:57Z/03:34:40Z; - 1.6
download0:2026-06-09T03:33:55Z/03:34:30Z; - 1.5 backup:
2026-05-25T12:46:49Z/12:47:34Z; - 1.5
download0:2026-05-25T12:47:34Z/12:47:56Z; - 1.3 backup:
2026-05-25T14:27:41Z/14:28:29Z; - 1.3
download0:2026-05-25T14:28:29Z/14:29:18Z.
The 1.6 release labels its 4.03 backup for firmware 4.03 through 12.40 and
its 12.20-named backup for 12.60 and later. Releases 1.3 and 1.5 are marked
deprecated. Their release bodies, and the 1.6 historical changelog, were
retained as descriptive metadata only; they do not establish local identity.
No asset has the local name, size, or SHA-256. An exact byte match is therefore mathematically impossible for the inventoried assets without downloading them. Downloading a digest-excluded 315–504 MB object would add no evidence and would violate the metadata-first rule.
Decision
- correlation:
OFFICIAL_RELEASE_NO_MATCH; - identified local release: none;
- local outer-to-release association: none;
- large backup assets downloaded: zero;
- local backup classification:
LOCAL_BACKUP_NOT_CORRELATED; - Phase 0.9F offline design allowed:
false.
This does not prove that the local package contains no official-derived
content. It proves that its outer bytes are not any current official
Gezine/Y2JB release asset.