File Format Dissection .edat

[Slynk]

I'd really like to learn more about the license data file (iso.bin.edat) within psx pkgs. And I know there is 0 research on the subject, at least that I've been able to tell.

So, what I need are some well know methods for dissecting file formats. Learning what each byte is for. Where the header ends and the data begins. Determining what encryption was used (in this case... I'll probably sound like an idiot saying it cause I don't know much about it but, the self format used both aes-cbc and aes-ctr to encrypt the file).

What methods were used to dissect the self format? I'm in the process of gathering some .edats offline as I assume part of it is a process of comparison.

[Slynk]

Found a couple tutorials...

OpenRCE
Basics of Reverse Engineering File Formats

Apparently searching "reversing file formats" helps.

Anyway. I need more .edats. Specifically, does anyone have a newer ps1 game? Something that would be signed with something other than the oldest npdrm key?

List of PSOne Classics A-K - Wikipedia, the free encyclopedia

A 2011 release or late 2010 would be optimal.

[cookie42]

This is from math a while ago, he was talking about edata. It's not much, but might help.

[10:37] <@Mathieulh> it's AES + ecdsa + cmac signed
[10:37] <@Mathieulh> like npdrm
[10:37] <@Mathieulh> AES + ecdsa part is done by appldr
[10:37] <@Mathieulh> cmac is done by some vsh module
[10:37] <rms> hi
[10:37] <@Mathieulh> hi :)
[10:37] <rms> my god
[10:38] <rms> hyprvisor and NNNnc1 are spamming me with welcome notices xD
[10:38] <rms> !op
[10:38] <@Mathieulh> lol
[10:38] <@Mathieulh> prove me you're the real rms and I'll op you xD 
03[10:38] * Mathieulh sets mode: +o rms
[10:38] <@rms> i did :P
[10:39] <@Mathieulh> yah, I saw you joining the private chan xD 
[10:40] <kkk> Mathieulh how to obtain cmac?
[10:40] <@Mathieulh> err... you reverse the algo, fetch the keys, calculate the cmac with the algo you just reversed and the keys you just fetched
[10:41] <@Mathieulh> cmac is a hashing algorithm based on AES though
[10:41] <@Mathieulh> kinda like hmac is
[10:41] <@Mathieulh> it's documented 
[10:41] <kkk> what is it hashing though
[10:41] <@Mathieulh> you're talking about edata here ? 
[10:41] <kkk> or is it hardcoded
[10:42] <kkk> yeah
[10:42] <kkk> I want to finalize my own edata here
03[10:42] * NNNnc1 sets mode: +l 395
[10:42] <dospiedra> ok Mathieulh , thanks for info..
[10:42] <@Mathieulh> hashes the actual signature
[10:42] <@Mathieulh> ecdsa one
[10:42] <@Mathieulh> and the signature hashes the AES keys
[10:42] <@Mathieulh> as usual
[10:43] <@Mathieulh> well not hashes on its own
[10:43] <@Mathieulh> it decrypts the hmac 
[10:43] <@Mathieulh> for the data sections
[10:43] <@Mathieulh> which are encrypted with the AES keys
[10:43] <@Mathieulh> but that's all documented shit anyway 
[10:43] <kkk> can you link me
[10:43] <@Mathieulh> EDATA crypto is very similar to the self crypto
[10:43] <kkk> yeah I figured that much ;)
[10:44] <@Mathieulh> check the ps3devwiki or what's left of it
[10:44] <@Mathieulh> the cmac part isn't documented though
[10:44] <dospiedra> Mathieulh on 3.55 is possible activate retail debug options with vsh patch? only vsh not kernel... not fully fuctional..
[10:44] <@Mathieulh> err... then I don't call it activate
[10:45] <@Mathieulh> you just can't activate all the debug features on a retail firmware, simply because it lacks things
[10:45] <@Mathieulh> such as the debugger for instance

[Slynk]

Hmm that'll help later on thanks. I've got an app set up to decrypt the file after I plug in an algorithm but I'll have to learn about the methods he's depicting first <.>

Doubt I can just use C#'s built in crypto classes for this one XD

[Slynk]

Hmm so I just thought of something : / This license file is downloaded correct? Which means the ps3 will have the keys to decrypt it... but most likely not the keys to encrypt it. So would decrypting an edat file be pointless?