Envelope Files

Envelope files are a general purpose container format used on PS4 and PS5 for encrypting and signing a message. This format was likely introduced in System Software version 3.00 (>2.56 <=3.50). It follows the same principle as PS Vita Launch Lists: embed files in OS and allow update through download of encrypted files from official servers.

Messages are encrypted using AES128 in CTS mode, hashed using SHA256 and signed using RSA2048.

Structure

Format

Fields are little-endian.

Name	Offset	Size	Example	Remark
Signature	0x000	4	CC CB 73 51	Four bytes, not an int
Version	0x004	4	00 00 00 00	Only version 0 (zero) exists
ID	0x008	4	01 00 00 00	See Content
Unknown	0x00C	4	00 00 00 00	Always 0
Message Size	0x010	8	83 03 00 00 00 00 00 00	Size of the message in bytes.
Unknown	0x018	8	00 00 00 00 00 00 00 00	Always 0
Message IV	0x020	16		IV for encrypted message
Message Hash	0x030	32		SHA256 hash of unencrypted message bytes
File Signature	0x050	256		RSA248 signature verified using public key
Message Data	0x150	Message Size		Encrypted message bytes. Encryption key and public key varies with content ID.

Content

The underlying unencrypted message format varies between different content.

ID	Name	Description	Process	Files/URLs	Remarks
1	beta_updatelist	Beta Update List	/system/vsh/SceShellCore.elf	https://fus01.ps4.update.playstation.net/update/ps4/beta/list/us/ps4-updatelist_?.xml	Password "?" in URL varies with System Software version
2	timezone	Timezone	/system/vsh/SceShellCore.elf	/system_data/priv/settings_app/timezone.dat.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/timezone/np/v00/timezone.dat.env
3	system_log_config	System Log Config	/system/vsh/SceShellCore.elf	/system/priv/system_log_ro/config/sl-config.xml.env /system/priv/system_log_ro/config/sl-config-dev.xml.env /system/priv/system_log_ro/config/sl-config-dev-beta.xml.env /system/priv/system_log_ro/config/sl-config-kamaji.xml.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/sl-config/np/v07/sl-config.xml.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/sl-config-dev/np/v07/sl-config-dev.xml.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/sl-config-dev/np/v06/sl-config-dev.xml.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/sl-config-kamaji/np/v01/sl-config-kamaji.xml.env	Version in URL varies with System Software version
4	system_log_unknown		/system/vsh/SceShellCore.elf		Unknown name and usage.
5	bgdc_config	Background Daily Checker	/system/vsh/SceShellCore.elf	http://ps4-system.sec.np.dl.playstation.net/ps4-system/bgdc/np/v00/bgdc-config.xml.env
6	wctl_config	Title Workaround Control	/system/vsh/SceShellCore.elf	/mnt/disc/PS4/WCTL/wctl-config.env /system_data/priv/workaround_ctl/title_workaround.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/wctl/np/v00/wctl-config.env
7	morpheus_updatelist	Morpheus (VR) Update List	/system/vsh/SceShellCore.elf	https://f01.vrs.update.playstation.net/update/vrs/list/vrs-updatelist-utDCG9ywva92MlS0rXGRUJCjpDtsw38V.xml
8	netev_config		/system/vsh/SceShellCore.elf	?/system_data/priv/netev/netev-config.env? /system_data/priv/netev/v00-netev-config.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/netev/np/v00/netev-config.env
9	gls_config		/system/vsh/app/NPXS21000/eboot.bin	http://ps4-system.sec.np.dl.playstation.net/ps4-system/gls/np/v00/gls-default-config.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/gls/np/v01/gls-default-config.env
10	hid_config		/system/vsh/SceShellCore.elf	/system/priv/hid_config_service_ro/hid_config.env /system_data/priv/hid_config_service/hid_config.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/hid_config/np/v00/hid_config.env
12	hidusbpower		/system/vsh/SceShellCore.elf	/system/priv/hid_config_service_ro/hidusbpower.env /system_data/priv/hid_config_service/hidusbpower.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/hidusbpower/np/v00/hidusbpower.env	Added in System Software version >3.70 <=4.05
13	patch_hmac_key		/system/vsh/SceShellCore.elf	Embedded data in /system/vsh/SceShellCore.elf
14	bgft	Background File Transfer	/system/vsh/SceShellCore.elf	/system_data/priv/bgft/nobackup/conf/bgft.env Plaintext related file: /system_data/priv/bgft/nobackup/conf/bgft.env.last-modified http://ps4-system.sec.np.dl.playstation.net/ps4-system/bgft/np/v00/bgft.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/bgft/np/v01/bgft.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/bgft/np/v02/bgft.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/bgft/np/v03/bgft.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/bgft/np/v04/bgft.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/bgft/np/v05/bgft.env http://ps4-system.sec.np.dl.playstation.net/ps4-system/bgft/np/v06/bgft.env	Version in URL varies with System Software version
17	system_log_privacy		/system/vsh/SceShellCore.elf	/system/priv/system_log_ro/platform_privacy/sl-privacy-def.json.env /system/priv/system_log_ro/platform_privacy/sl-privacy-def-dev.json.env /system/priv/system_log_ro/platform_privacy/sl-privacy-def-kamaji.json.env	Added in System Software version 5.00
18	webbrowser_xutil		/system_ex/app/NPXS20001/eboot.bin	http://ps4-system.sec.np.dl.playstation.net/ps4-system/webbrowser/np/v00/webbrowser_features.env	Added in System Software version 5.00 Exposed to C# shell via sceXutilGetEnvelopeDataFromFile / sceXutilGetEnvelopeDataFromBuffer.
19	entitlementmgr_config		/system/vsh/SceShellCore.elf	https://ps4-system.sec.np.dl.playstation.net/ps4-system/entitlementmgr/np/v00/entitlementmgr_config.env	Added in System Software version >5.05 <=7.00
21	jsnex_netflixdeckeys		/system_ex/app/NPXS20001/eboot.bin	Embedded data in /system_ex/app/NPXS20001/eboot.bin	Added in System Software version >5.05 <=7.00
22	party_config		/system/vsh/app/NPXS21002/eboot.bin	http://ps4-system.sec.np.dl.playstation.net/ps4-system/party/np/v00/party_config.env	Added in System Software version >5.05 <=7.00

Tools

• ps4_env_decryptor by SocraticBliss (2020)