Editing EDAT files

EDATA is a file format used on PSP and PS3 to store encrypted data. There is also on PS3 only the SDATA file format which is very similar to EDATA (to detail). This page is for now about PS3 EDATA/SDATA only.

= Info on the talk page =

'''Info on the talk page''': please digest the info and move it here'''

= Location =

EDAT files are stored under .edat extension. They are often packed in NPDRM [[PKG files]], downloaded from PS Store then extracted to the PS3 HDD. There are also PSP EDAT files which have a different format (to document).

= Structure (Encrypted Format) =

== Header ==

{| class="wikitable" style="text-align: center;"
|-
! style="background-color:#ffffff; border-left:1px solid #ffffff; border-top:1px solid #ffffff;" |
! Offset !! Name !! Size !! Type !! Notes
|-
! rowspan="10" | Header
|-
| 0x0 || NPD || 0x80 || PS3_NPD || See [[NPD]].
|-
| 0x80 || Type || 1 || ?uint8_t? || (separated from Metadata type for wiki format)
*00: Finalized EDAT
*01: Finalized SDAT
*80: Non Finalized EDAT
*81: Non Finalized SDAT
|-
| 0x81 || Metadata type || 3 || ?uint8_t[3]? || (Outdated Flags description from talk page)
*00
*01: Compressed?
*02: Plain text?
*03: Compressed plain text?
*05: Compressed?
*06: Plain text?
*07: Compressed plain text?
*0C: ?
*0D: Compressed data?
*3C: Data/misc?
|-
| 0x84 || Block size || 4 || uint32_t || Default block size is 16 KB (0x4000 bytes). Max block size is 32 KB (0x8000 bytes). Working block sizes are: 1, 2, 4, 8, 16, 32 KB.
|-
| 0x88 || Data size || 8 || uint64_t || Decoded data size.
|-
| 0x90 || Metadata sections hash || 0x10 || uint8_t[0x10] || 
|-
| 0xA0 || Extended header hash || 0x10 || uint8_t[0x10] || AES-CMAC hash of 160 bytes from the beginning of EDAT file. It uses the hash key as AES-CMAC key and it depends on the file flags and keys. ?What does this mean, see make_npdata by Hykem?
|-
| 0xB0 || ECDSA Metadata signature || 0x28 || uint8_t[0x28] || ECDSA curve type is vsh type 2. ECDSA public key is vsh public key (to check). It can be zeroed on forged file.
|-
| 0xD8 || ECDSA Header signature || 0x28) || uint8_t[0x28] || ECDSA curve type is vsh type 2. ECDSA public key is vsh public key (to check). Enabled (only?) for PS2 classic contents: all PS3 CFWs are patched to skip the ECDSA signature check. It can be zeroed on forged file.
|-
! colspan=6 |      
|-
! rowspan="3" | Body
|-
| 0x100 || Encrypted file || Variable || uint8_t[variable] || The file is encrypted using AES128CBC.
|-
| 0x** || Padding || Variable || uint8_t[variable] || Aligned on ?? bytes.
|}

== Footer ==

{| class="wikitable" style="text-align: center;"
|-
! Description || Size || Notes
|-
| Name || 5 || "EDATA" or "SDATA"
|-
| Space character || 1 || ' ' = 0x20
|-
| Packager Version || 8 ||
*Version 1: "packager"
*Version 2: "2.4.0.L "
*Version 2: "2.4.0.W "
*Version 2: "2.7.0.L "
*Version 3: "3.1.0.W "
*Version 3: "3.3.0.L "
*Version 3: "3.3.0.W "
*Version 4: "4.0.0.L "
*Version 4: "4.0.0.W "
|-
| Padding || 2 || 00 00
|}

The footer is plaintext. It seems that the footer is not present in some EDAT files version 1 (e.g. in some Ridge Racer 7 additional contents) although it should theoretically be present with version = "packager".

= EDAT Versions =

There are 4 PS3 EDAT (and NPD) format major versions:
* 1: compatible with SDK 2.1x or older. Supported since at least PS3 System Software version 1.01.
* 2: compatible with SDK 3.0x or older
* 3: compatible with SDK 3.7x or older
* 4: compatible with SDK ?.?? or older. Supported since certainly some 4.0x System Software version.

= EDAT Extraction =

EDAT decryption, and complete verification, requires Klicensee. See [[NPDRM]].

= EDAT Generation =

To document.

= Tools =

== Official tools ==

=== make_edata_npdrm version 1.0.0 ===

Found in SCE PS3 SDK 1.92.

=== make_edata_npdrm version 4.0.0.W ===

make_edata_npdrm version 4.0.0.W (2009-02-15)

Found in SCE PS3 SDK ?4.00?

<pre>
make_edata_npdrm -h
make_edata_npdrm: version 4.0.0.W
usage:
  make_edata_npdrm [-options] <input file> <output file>

options:
  -h, --help     : print this usage and exit
  -v, --version  : print program version and exit
  -p, --progress : print progress [%]

  [create option]
  -b <size(KB)>  : block size (default 16, max 32)
  -z, --compress : data compress

  --format1      : old format (compatible with SDK 2.1x or older)
  --format2      : old format (compatible with SDK 3.0x or older)
  --format3      : old format (compatible with SDK 3.7x or older)

  [extract/check option]
  -x, --extract  : extract raw image from developing EDATA
  -i, --info     : print file information
</pre>

== Unofficial tools ==

make_npdata by Hykem

True Ancestor EDAT...


{{File Formats}}<noinclude>[[Category:Main]]</noinclude>