EDAT files

Info on the talk page

Info on the talk page: please digest the info and move it here

Location

EDAT files are stored under .edat extension. They are often packed in NPDRM PKG files, downloaded from PS Store then extracted to the PS3 HDD. There are also PSP EDAT files which have a different format (to document).

Structure (Encrypted Format)

Header

	Offset	Name	Size	Type	Notes
Header
	0x00	Magic	4	char[4]	"NPD\0" (4E 50 44 00)
	0x04	Version	4	uint32_t	ex: 1, 2, 3, 4. See #Footer for the precise packager version.
	0x08	DRM Type	4	uint32_t	For PS2 EDAT, PS3 FW requires it to be with activation (also a.k.a. Paid content paired with your individual data) for PS1 PKG, PS3 FW 4.00 introduced some changes for installing them with regard to the EDAT DRM type.
	0x0C	Application Type	4	uint32_t
	0x10	CONTENT ID	0x30	uint8_t[0x30]	Content ID (with padding to fit 48 bytes)
	0x40	Digest	0x10	uint8[0x10]	QA digest (seems like to be a SHA-1 hash of the non-finalized file): hash of the original data which is unknown until the whole file is read, so it cannot be used as a check, however it can be used as watermark or zeroed on forged file.
	0x50	NPD CID-FN Hash	0x10	uint8_t[0x10]	CID-FN hash. AES-CMAC hash of concatenation of Content ID (48 bytes) and EDAT file name (eg MINIS.EDAT) using the third NPDRM OMAC key as AES-CMAC key. Example: aes_cmac(55 50 30 35 37 36 2D 4E 50 55 5A 30 30 31 34 39 5F 30 30 2D 56 41 4E 47 55 41 52 44 32 30 30 30 30 30 30 31 00 00 00 00 00 00 00 00 00 00 00 00 4D 49 4E 49 53 2E 45 44 41 54, npd_cid_fn_hash_omac_key).
	0x60	NPD Header hash	0x10	uint8_t[0x10]	Header hash. AES CMAC hash of the 0x60 bytes from the beginning of the file using (klicensee XOR second NPDRM OMAC key as AES-CMAC key.
	0x70	Activation time	8	?64-bit time or 32-bit padding?	Start of the validity period, filled with 00 if not used.
	0x78	Expiration time	8	?64-bit time or 32-bit padding?	End of the validity period, filled with 00 if not used.
	0x80	NPD type	1	?uint8_t?	(separated from Metadata type for wiki format) 00: Finalized EDAT 01: Finalized SDAT 80: Non Finalized EDAT 81: Non Finalized SDAT
	0x81	Metadata type	3	?uint8_t[3]?	(Outdated Flags description from talk page) 00 01: Compressed? 02: Plain text? 03: Compressed plain text? 05: Compressed? 06: Plain text? 07: Compressed plain text? 0C: ? 0D: Compressed data? 3C: Data/misc?
	0x84	Segment size	4	uint32_t	Default block is 16 KB (16384 bytes) = 0x4000, max is 0x8000.
	0x88	Data size	8	uint64_t	Decoded data size.
	0x90	Meta data sections hash	0x10	uint8_t[0x10]
	0xA0	Extended header hash	0x10	uint8_t[0x10]	AES-CMAC hash of 160 bytes from the beginning of file. It uses the hash key as AES-CMAC key and it depends on the file flags and keys. ?What does this mean?
	0xB0	ECDSA Metadata signature	0x28	uint8_t[0x28]	Can be zeroed on forged file. curve_type is vsh type 0x02, pub is vsh public key,
	0xD8	ECDSA Header signature	0x28)	uint8_t[0x28]	Enabled (only?) for PS2 classic: all PS3 CFWs are patched to skip the ECDSA check. Can be zeroed on forged file. curve_type is vsh type 2, pub is vsh public key.
Body
	0x100	Encrypted file	Variable	uint8_t[variable]	The file is encrypted using an AES algorithm in CBC mode.
	0x**	Padding	Variable	uint8_t[variable]	Aligned on ?? bytes.

Footer

Description	Size	Notes
Name	5	"EDATA" or "SDATA"
Space character	1	' ' = 0x20
Packager Version	8	Version 1: "packager" Version 2: "2.4.0.L " Version 2: "2.4.0.W " Version 2: "2.7.0.L " Version 3: "3.1.0.W " Version 3: "3.3.0.L " Version 3: "3.3.0.W " Version 4: "4.0.0.L " Version 4: "4.0.0.W "
Padding	2	00 00

EDAT Versions

There are 4 PS3 EDAT format major versions:

• 1: compatible with SDK 2.1x or older
• 2: compatible with SDK 3.0x or older
• 3: compatible with SDK 3.7x or older
• 4: compatible with SDK ?.?? or older. Certainly supported since some 4.0x FW.

EDAT Decryption

EDAT decryption requires a key, the licensee key or klicensee. Depending on the DRM type, klicensee is got in different ways:

• DRM type Network: klicensee is generated using rif + ?to detail?
• DRM type Local: klicensee is generated using act.dat + associated rif + console's IDPS
• DRM type Free: klicensee is the constant PS3 Free klicensee (see NPDRM Keys and appldr keys)

Tools

Official tools

make_edata_npdrm version 1.0.0

Found in SCE PS3 SDK 1.92.

make_edata_npdrm version 4.0.0.W

make_edata_npdrm version 4.0.0.W (2009-02-15)

Found in SCE PS3 SDK ?4.00?

make_edata_npdrm -h
make_edata_npdrm: version 4.0.0.W
usage:
  make_edata_npdrm [-options] <input file> <output file>

options:
  -h, --help     : print this usage and exit
  -v, --version  : print program version and exit
  -p, --progress : print progress [%]

  [create option]
  -b <size(KB)>  : block size (default 16, max 32)
  -z, --compress : data compress

  --format1      : old format (compatible with SDK 2.1x or older)
  --format2      : old format (compatible with SDK 3.0x or older)
  --format3      : old format (compatible with SDK 3.7x or older)

  [extract/check option]
  -x, --extract  : extract raw image from developing EDATA
  -i, --info     : print file information

Unofficial tools

make_npdata by Hykem

True Ancestor EDAT...