SDAT Creator by oakhead69

Published on 11-16-2012 05:50 AM

27 Comments

Oakhead69 one of the latest Developers to join PSX-Scene Developers Team has released a handy PC application called the "SDAT Creator". This tool will create a V3 SDAT file from decrypted data. Instructions are also include on how to decrypt V4 SDATs on a 4.xx CFW PS3. This program is also useful for modifying the contents of SDAT file for language conversions. The source code is provided in the download below.

Instructions:

You first need to decrypt the original V4 SDAT file.
You can use extttdpk coded by asmodean asmodean's reverse engineering page - news and updates to decrypt it.
This needs to be done on a PS3 with >3.56. e.g 4.21.
There are compiled versions of this on the web for example link
You need to modify the file decrsdat.lst with a list of SDATs to be decrypted e.g.

Code:

# input_file output_file
/dev_hdd0/model_shader_pack.SDAT /dev_hdd0/model_shader_pack.dat

There is code available that can decode V3 SDATs on the PC, but we can not decode the V4 SDATs as we do not have the EDATKEY1 that has a SHA-1 of 6ECDFEC0A11890C1F2A689062D3EFE562317B2FB. Once we have this key V4 SDATscan be decrypted on a PC.

This program is also useful for modifying the contents of SDAT file for language conversions etc. I know that this has been requested by people in the past. Now we can do it.

To use the SDAT Creator:

1) Provide the decrypted data as input to the SDAT creator.
2) Specify the output SDAT file.
3) Optionally provide the original V4 SDAT file and it will then use the hashes etc from this file otherwise it just uses some default values..
4) Press the 'Create SDAT' button and that's it.

The code I have provided is based on KDSBest's C# port of the Java code written by JuanNadie. Any keys used in the code are already publicly available on the internet.

Most of the information I used to create this program was gained from this post NPDRM Self algorithm.
Big thanks to JuanNadie, KDSBest and others that posted on this thread.

I have used it to create successful patches for
Test Drive: Ferrari Racing Legends (BLUS30842)
Ice Age 4: Continental Drift (BLES01686).

For Sports Champions 2.BCES01598 there are other issues with the EBOOT.BIN that I can not fix.
For Air Conflicts Pacific Carriers.BLES01604 the V3 SDAT files to not work even on 4.21. I think this is because they contain elf files and V3 SDATs do not support executable content.
Men.In.Black.Alien.Crisis.BLES01549. This should work but it has a 4gig+ sdat file, but I have tested my creator can handle files of this size.
Disney.Epic.Mickey.2.The.Power.of.Two I have noticed that this has sdat files but I have not had any time to look at them.

Download: Download SDAT Creator.rar

LIKE/VOTE for this Entry in this month's Contest!

Share
- Share this post on
- Digg
- Del.icio.us
- Technorati
- Twitter

Nightbird, Jay-Jay, niccoooodu61 and 10 others like this.

Categories:

_{Tags :

contest,

decrypt v4 sdat,

language conversion,

oakhead69,

sdat creator}

27 Comments

Jay-Jay - 11-16-2012, 06:20 AM
- Reply
Nice job!

barham - 11-16-2012, 06:46 AM
- Reply
I hope this can be useful!

JonahUK - 11-16-2012, 08:43 AM
- Reply
If anybody wants to have a play with this app, here are the 479 sdats from Hitman (decrypted and unsorted):
DecSDATS

jalaneme - 11-16-2012, 08:45 AM
- Reply
o we can use this to decrypt the sdat file on recent games then?

oakhead69 - 11-16-2012, 09:27 AM
- Reply
Originally Posted by jalaneme

o we can use this to decrypt the sdat file on recent games then?

Not as such, the application takes decrypted data and creates a V3 encrypted SDAT file that can potentially be used on 3.55CFW. 3.55FW does not have the keys and code to support V4 SDATs.

We have been able to decryption the V4 SDAT file ever since we have had 4.XX CFW. The decryption is done on PS3 running 4.XX CFW. You just write a program to use cellFsSdataOpen available in SONY's SDK. It is Sony's call to open an SDAT for reading. The code I linked to in the article extttdpk uses it.

The bit we have been missing until now is how to create a V3 SDAT, which I have now provided.

Mikuuh - 11-16-2012, 09:56 AM
- Reply
Originally Posted by JonahUK

If anybody wants to have a play with this app, here are the 479 sdats from Hitman (decrypted and unsorted):

Looking at propJoe fixed hitman .sdats, it shows version 4.0.0 for SDAT, shouldn't it be 3.4.0 or something to work on 3.55? Any idea what he did with decrypted files to make them work on 3.55?

oakhead69 - 11-16-2012, 10:32 AM
- Reply
Originally Posted by Mikuuh

I'm wondering why are these only 12.8MB while propJoe's .sdat's are 60mb something? I also checked propJoe's sdats and version shows 4.0.0 at end, any idea what he did with original .sdats to make them work on 3.55?

The SDATA 4.0.0.W string at the end is not checked as far as I am aware. The 8th byte of the SDAT header is the version and this is 3 for propJoe's SDATs. I can also decrypt them on the PC so they are V3 SDATs.

Mikuuh - 11-16-2012, 10:43 AM
- Reply
Originally Posted by oakhead69

The SDATA 4.0.0.W string at the end is not checked as far as I am aware. The 8th byte of the SDAT header is the version and this is 3 for propJoe's SDATs. I can also decrypt them on the PC so they are V3 SDATs.

Oh, now i understand. So can i encrypt original V4 decrypted hitman SDATS with this tool to work on 3.55? Just to be sure.

oakhead69 - 11-16-2012, 10:47 AM
- Reply
Originally Posted by Mikuuh

Oh, now i understand. So can i encrypt original V4 decrypted hitman SDATS with this tool to work on 3.55? Just to be sure.

Correct.

Mikuuh - 11-16-2012, 10:49 AM
- Reply
Originally Posted by oakhead69

Correct.

Can you also please upload one propJoe's decrypted .SDAT, i don't know how to decrypt them on PC myself and don't have ps3 on CFW 4.xx but i want to compare them with original decrypted SDATS to understand better what is changed. I don't really understand what you mean by 8th byte in header, but will maybe if i can compare and see differences.
I'm just really interested in how this stuff works and want to learn.
Thanks alot if you do!

danixleet - 11-16-2012, 11:22 AM
- Reply
@oakhead69 - Can you link me to the V3 pc tool and source if available.

oakhead69 - 11-16-2012, 11:23 AM
- Reply
Originally Posted by Mikuuh

Can you also please upload one propJoe's decrypted .SDAT, i don't know how to decrypt them on PC myself and don't have ps3 on CFW 4.xx but i want to compare them with original decrypted SDATS to understand better what is changed. I don't really understand what you mean by 8th byte in header, but will maybe if i can compare and see differences.
I'm just really interested in how this stuff works and want to learn.
Thanks alot if you do!

Here is the smallest one of his SDATs and the content that I have just decrypted it on my PC.
Attachment 39363

This is a quick break down of the SDAT header block at the start of the SDAT. As you can see the eight byte i.e offset 0x00000007 in this example is 4.
To be honest because the SDAT is encrypted with a different key very little will match. The lines 000000080 and 00000088 should match the rest will be different.
Code:

00000000 4E 50 44 00 00 00 00 04 : 4 Magic : 4 Version 00000008 00 00 00 00 00 00 00 00 : 4 license : 4 type 00000010 00 00 00 00 00 00 00 00 : Content ID 00000018 00 00 00 00 00 00 00 00 : Content ID 00000020 00 00 00 00 00 00 00 00 : Content ID 00000028 00 00 00 00 00 00 00 00 : Content ID 00000030 00 00 00 00 00 00 00 00 : Content ID 00000038 00 00 00 00 00 00 00 00 : Content ID 00000040 00 00 00 00 00 00 00 00 : Digest 00000048 00 00 00 00 00 00 00 00 : Digest 00000050 D3 13 D4 EA 5E 64 16 C7 : Title + File Name Hash : BLES-00000 + Filename 00000058 AC EF B0 CD F5 0F 92 80 : Title + File Name Hash : BLES-00000 + Filename 00000060 XX XX XX XX XX XX XX XX : Header Hash 00000068 XX XX XX XX XX XX XX XX : Header Hash 00000070 00 00 00 00 00 00 00 00 : Unknown 3 00000078 00 00 00 00 00 00 00 00 : Unknown 3 00000080 01 00 00 3C 00 00 40 00 : 1 Finalise : 3 Data Type : 4 Block Size 00000088 SS SS SS SS SS SS SS SS : Decoded Data Size 00000090
If you really want to learn more about this visit the PS3 wiki, this page discusses EDAT format.
Talk:EDAT files - PS3 Development Wiki

oakhead69 - 11-16-2012, 11:30 AM
- Reply
Originally Posted by danixleet

@oakhead69 - Can you link me to the V3 pc tool and source if available.

You guys are after all my secrets, do you realise how long it took me find and understand all this information . Only joking I am very happy to help and share.
I use the netbeans project in the download from this link. I used it to understand the decryption of the sdat, which then allowed me to write the encryption code based on the C# code also in the same download. Big advantage of the C# code is that longs are 64bit and not 32bit like in Java, so the code can easily handle >4gig SDAT files. I have tested this.

PS3 EDAT NPDRM Decryption / Re-Encryption Tools Are Released - Page 1 - PS3 NEWS - PlayStation 3 News - PS3 Hacks - PS3 CFW

Mikuuh - 11-16-2012, 12:18 PM

Originally Posted by oakhead69
Here is the smallest one of his SDATs and the content that I have just decrypted it on my PC.
Attachment 39363

This is a quick break down of the SDAT header block at the start of the SDAT. As you can see the eight byte i.e offset 0x00000007 in this example is 4.
To be honest because the SDAT is encrypted with a different key very little will match. The lines 000000080 and 00000088 should match the rest will be different.
Code:
00000000 4E 50 44 00 00 00 00 04 : 4 Magic : 4 Version
00000008 00 00 00 00 00 00 00 00 : 4 license : 4 type
00000010 00 00 00 00 00 00 00 00 : Content ID
00000018 00 00 00 00 00 00 00 00 : Content ID
00000020 00 00 00 00 00 00 00 00 : Content ID
00000028 00 00 00 00 00 00 00 00 : Content ID
00000030 00 00 00 00 00 00 00 00 : Content ID
00000038 00 00 00 00 00 00 00 00 : Content ID
00000040 00 00 00 00 00 00 00 00 : Digest
00000048 00 00 00 00 00 00 00 00 : Digest
00000050 D3 13 D4 EA 5E 64 16 C7 : Title + File Name Hash : BLES-00000 + Filename
00000058 AC EF B0 CD F5 0F 92 80 : Title + File Name Hash : BLES-00000 + Filename
00000060 XX XX XX XX XX XX XX XX : Header Hash
00000068 XX XX XX XX XX XX XX XX : Header Hash
00000070 00 00 00 00 00 00 00 00 : Unknown 3
00000078 00 00 00 00 00 00 00 00 : Unknown 3
00000080 01 00 00 3C 00 00 40 00 : 1 Finalise : 3 Data Type : 4 Block Size
00000088 SS SS SS SS SS SS SS SS : Decoded Data Size
00000090
If you really want to learn more about this visit the PS3 wiki, this page discusses EDAT format.
Talk:EDAT files - PS3 Development Wiki
Nice to see a friendly sharing dev, thank you so much for info.
Anyway, i compared your .sdat with Joe's, everything matches. But when encrypting it with your tool, it shows 3.3.0.W at end, guess that doesn't matter?
THANKS again!

propJOE - 11-16-2012, 04:32 PM
- Reply
Sure, oakhead.
What people dont understand how much commitement and work it takes to learn and master everything about file decrypting on ps3.
Selfs are one thing, sprx another, edats and sdats yet another thing.
Im learning for more then a year and still have plenty more to learn.
Currently Im working with IDA Pro disassembler to fix all function calls to be compatible with 3.55 and fix eboots.

About byte 08 in edats or sdats. Oakhead was refering to status of file you editing.
01 - local
02 - encrypted
03 - decrypted

Dont matter we leave footer of edats or sdats intact and still say SDATA4.00 or EDATA4.00.
Always look at the byte 08 and look for 03. This means the file is decryped.

oakhead69 - 11-16-2012, 05:49 PM
- Reply
Originally Posted by propJOE

Sure, oakhead.
What people dont understand how much commitement and work it takes to learn and master everything about file decrypting on ps3.
Selfs are one thing, sprx another, edats and sdats yet another thing.
Im learning for more then a year and still have plenty more to learn.
Currently Im working with IDA Pro disassembler to fix all function calls to be compatible with 3.55 and fix eboots.

About byte 08 in edats or sdats. Oakhead was refering to status of file you editing.
01 - local
02 - encrypted
03 - decrypted

Dont matter we leave footer of edats or sdats intact and still say SDATA4.00 or EDATA4.00.
Always look at the byte 08 and look for 03. This means the file is decryped.

Thanks you for your kind words.

I think using the word eighth with hind sight was a mistake by me. I should have stuck to traditional offsets i.e. 0x00000007.

The eighth byte I am talking about (offset 0x00000007) is the last byte of the second dword (unknown2) which we now know to be the version number.

The license that you are talking about would be in last byte of the 3rd dword (license) at offset 0x0000000c (or the twelfth byte). This is actually always 0 for SDATs, it is used for EDATs.

Sorry to correct you, I think my post was misleading.

struct {
uint32_t magic;
uint32_t unknown2;
uint32_t license; /* 1 network, 2 local, 3 free */
uint32_t type; /* 1 exec, 0x21 update */
uint8_t content_id[48];
uint8_t digest[16];
uint8_t titlefilenameHash[16];
uint8_t headerHash[16];
uint64_t unknown3;
uint64_t unknown4;
} npdrm;

oakhead69 - 11-16-2012, 07:13 PM
- Reply
Hi Guys,

Some of you have been asking for a CLI (Command Line Interface) version of the SDAT Creator.
So here it is.
Download SDAT Creator CLI.rar from Sendspace.com - send big files the easy way
I have also made the file name validation a little more rugged.

Options are:

1) No parameters launches the GUI as normal. If run from a command window it will minimise the window and restore it after it closes.

2) 2 or 3 parameters and it assumes a single command i.e. "SDAT Creator CLI" InputFile OutputFile (Optional SDAT reference file)
e.g.
"SDAT Creator CLI" Input.dat Output.sdat original.sdat
or
"SDAT Creator CLI" Input.dat Output.sdat

3) 1 parameter and it assumes that it is a file containing a list of command lines for multi file handling.
e.g.
"SDAT Creator CLI" filelist.txt

Contents of filelist.txt
Code:

input.dat "output file.sdat" ref.sdat "input file.dat" "output file.sdat" "ref file.sdat" "input file.dat" "output file.sdat"
Hope this is clear.

danixleet - 11-16-2012, 07:24 PM
- Reply
Originally Posted by oakhead69

You guys are after all my secrets, do you realise how long it took me find and understand all this information . Only joking I am very happy to help and share.
I use the netbeans project in the download from this link. I used it to understand the decryption of the sdat, which then allowed me to write the encryption code based on the C# code also in the same download. Big advantage of the C# code is that longs are 64bit and not 32bit like in Java, so the code can easily handle >4gig SDAT files. I have tested this.

PS3 EDAT NPDRM Decryption / Re-Encryption Tools Are Released - Page 1 - PS3 NEWS - PlayStation 3 News - PS3 Hacks - PS3 CFW

Haha, im the same, i should have started looking / dedicating into ps3 dev, when the "scene" started over a year ago, if i was serious back then, id prob be higher than the inner circle LOL, im a quick learner, reading over code and understanding how it works, and i already have that project file just never looked into it, ill have a look into it now, and see what it offers then hopefully rebuild a v3 decryption app, yes im a programmer since 2005

oakhead69 - 11-16-2012, 07:32 PM
- Reply
Good luck, that code is very interesting and it can be used for removing the protection from themes and other NPDRM content.

I started coding professionally myself back in 1987, but this was my first venture into C# apart from a little messing about with the iPhone SDK.

danixleet - 11-16-2012, 07:54 PM
- Reply
Originally Posted by oakhead69

Good luck, that code is very interesting and it can be used for removing the protection from themes and other NPDRM content.

I started coding professionally myself back in 1987, but this was my first venture into C# apart from a little messing about with the iPhone SDK.

The problem with looking over this code, i don't have much simple form documentation to understand how edat/sdat etc work... Which is why i asked if you already complied a input sdat/edat... output dat application could you pm it or just source, then i can browse over that and learn, cause that application does exactly what im looking at, instead of myself, working out what a complete project does and trying to replicate what is already created lol...

Im rough of C# but its not that hard, originally a vb6 then .net dev, tafe, uni expanded my c++ skills, and web dev is a mash of all anyways lol..