Gonso System
-
So I've discovered that in the case of Strawbunny's avatars you need a specific version of VRCFury installed otherwise Gonso is broken and throws an error loop of requiring logging into a validated vrchat account. I'm not sure if that could be used as an exploit but I just thought I'd share that info here.
-
So I've discovered that in the case of Strawbunny's avatars you need a specific version of VRCFury installed otherwise Gonso is broken and throws an error loop of requiring logging into a validated vrchat account. I'm not sure if that could be used as an exploit but I just thought I'd share that info here.
there have been other methods, simpler methods, of bypassing the system
this one uses task manager and is the most straightforward
my post uses Shadowcopy, an alternative that is more hands onboth are pretty future proof, there was one post (i can't find right now) that used VRCFury's "create editor test copy" function to compile a working, exportable version of the avatar
-
there have been other methods, simpler methods, of bypassing the system
this one uses task manager and is the most straightforward
my post uses Shadowcopy, an alternative that is more hands onboth are pretty future proof, there was one post (i can't find right now) that used VRCFury's "create editor test copy" function to compile a working, exportable version of the avatar
-
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol. I feel like its kind of illegal for Gonso to take personal information of users right. Is it true it takes your personal info?
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
-
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
Thank you for the informative reply! As someone who has purchased a Gonso licensed avatar recently (Akai by Strawbunny) I can confirm that some personal information is being logged as she was able to completely remove my ability to purchase avatars from her store no matter what email, discord, etc I entered into the payment box. I'm assuming that via Gonso she can track people's IP information and ban them in that way.
I've also read in other comments that Gonso can ping creators if someone shares their files and/or breaks the TOS.
-
Thank you for the informative reply! As someone who has purchased a Gonso licensed avatar recently (Akai by Strawbunny) I can confirm that some personal information is being logged as she was able to completely remove my ability to purchase avatars from her store no matter what email, discord, etc I entered into the payment box. I'm assuming that via Gonso she can track people's IP information and ban them in that way.
I've also read in other comments that Gonso can ping creators if someone shares their files and/or breaks the TOS.
it's unsurprising to me that the system has become as invasive as it is; a system of this type cannot function without being privacy invasive to an extent;
for the privacy concerned, it's simply more worth it to save your money, and your private data. creators' success is defined by community support, and you need to make an important decision about what you're willing to give up for some virtual pixels in a social game; it's ip logs now, but what will it be later?
-
it's unsurprising to me that the system has become as invasive as it is; a system of this type cannot function without being privacy invasive to an extent;
for the privacy concerned, it's simply more worth it to save your money, and your private data. creators' success is defined by community support, and you need to make an important decision about what you're willing to give up for some virtual pixels in a social game; it's ip logs now, but what will it be later?
Exactly. It's not only privacy invading but also extremely illegal for Gonso to have created this product that is marketed to protect creator's work. The crazy part is that creators swear by this and seem to not care that they are invading the privacy of those who buy their products simply to "protect" their work. I totally understand not wanting to have your work shared, ripped, etc but at the same time I feel that it's also an inevitability of being a creator.
If more avatar creators were open to the fact that people often share files not out of malice, but simply to share the artist's work with those who may not be able to afford it, I think things would be much improved. Also the freedom to be able to edit an avatar and truly make it your own is something that more creators should be open to.
-
Questions how I know if an avi has gonso in it tho? Once imported. ?
-
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
-
if his system wasn't so good at being a nuisance and said creators were not profiting so much off of it, perhaps the creator community would be a better one
pipe dreams, eh?
-
i've transitioned into 100% making my own assets and bases, and i'm glad i've done so; "the market will decide," and it consistently decides on the worst
let's be honest, though - this entire statement is an overplayed, broken record
i'll take the moment to thank the good users that helped with the first few decrypts i performed, and to those who do without real malicious intent; we're all fighting over some vertices at the end of the day
-
i've transitioned into 100% making my own assets and bases, and i'm glad i've done so; "the market will decide," and it consistently decides on the worst
let's be honest, though - this entire statement is an overplayed, broken record
i'll take the moment to thank the good users that helped with the first few decrypts i performed, and to those who do without real malicious intent; we're all fighting over some vertices at the end of the day
@taikeru said in Gonso System:
i've transitioned into 100% making my own assets and bases, and i'm glad i've done so; "the market will decide," and it consistently decides on the worst
let's be honest, though - this entire statement is an overplayed, broken record
i'll take the moment to thank the good users that helped with the first few decrypts i performed, and to those who do without real malicious intent; we're all fighting over some vertices at the end of the day
LMAFO, sum vertices has my dying
-
But i heard it logs your ip and basically flags you to creators?
unconfirmed, but given the closed-source nature of the system i wouldn't put it out of the equation - so far though Gonso himself has told me directly (and proven to me) that he does not have interest in logging IPs; as far as i can tell that remains the case now
What happens to a model with gonzo if the creator no longer uses gonzo?
hopefully, like Whituu's Sakura from a while ago, it is simply updated for the purchasers to not have the system in the package; otherwise it's just up to the creator to do that themselves
And, how does one manually remove gonzo?
this one is an involved process. there isn't a singular way to remove this system, and there is definitely not a simple way to do so without a decent handle on programming and cybersec tools
both @halcyon and i have worked on ways to get around this and she still works on them now; i just help with code stuff occasionally as i've mostly lost interest in it
it boils down to a few methods:
- the first, is to decompile the GonsoLicense DLL (most versions are obfuscated with ConfuserEX - it's very easy for a user to see this by loading the DLL into something like Ghidra or DnSpy); and once you've obtained the source code, you can write your own Unity scripts to "fake" requests to the API, basically copy-pasting the
Decryptmethod so it can be decrypted manually with the key from the API- there was a tool developed by a few acquaintances of mine that circulated around this forum a while ago; it was based off of my original methods and code that ended up being heavily edited for public use
- the second is to hijack the Unity process and "stall" it while the Licenser does its tricks. the drawback of GonsoLicense is that it has one major flaw: Unity cannot load or upload encrypted files. at some point during the upload process, these files have to be decrypted to be packaged - giving users a small window in which they can grab the files if they can get around Unity's directory locking. while simpler on paper, Unity's directory lock is pretty robust and isn't easy to bypass
Personally dont believe it but why lie to your buyers?
money. i wish i could say most creators using the GonsoLicense system are doing it without malicious intent, but the bottom line is many of them are looking for quick ways to maximize their profit margins for mediocre avatar work (not the case for all, but many), where some creators like Strawbunny don't even do most of the work and outsource it - there's a reason you don't see larger, more confident creators using the system (to name a few, such as Godfall and Nikkie) - the quality of their work speaks for itself (and is usually worth the price); most importantly their interaction with the community they've built doesn't give many users a reason to maliciously steal their products
it's all business practices, and predatory ones at that
i'm aware specifically for Birdy's case that they did actually stop using Gonso, but released the non-GonsoLicense'd package under a completely separate listing on their Gumroad. whether they forced previous buyers to re-buy it or not is unknown to me
feel free to ping myself or @halcyon for more answers - we're happy to help
- the first, is to decompile the GonsoLicense DLL (most versions are obfuscated with ConfuserEX - it's very easy for a user to see this by loading the DLL into something like Ghidra or DnSpy); and once you've obtained the source code, you can write your own Unity scripts to "fake" requests to the API, basically copy-pasting the
-
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
@taikeru Sorry for bumping this sorta dead thread, but from what I've seen from newer gonso dlls (albeit a few months old), they may be using a modified version of confuserex/confuserex2. Haven't had much time to actually do a deep dive but at the surface level, it definitely looks like it.
-
P Purrblondde referenced this topic on
-
@taikeru Sorry for bumping this sorta dead thread, but from what I've seen from newer gonso dlls (albeit a few months old), they may be using a modified version of confuserex/confuserex2. Haven't had much time to actually do a deep dive but at the surface level, it definitely looks like it.
necropost whoops, i've been away for a while
yes - a newer, private version of CEX is used, of which there aren't many bypasses for. best bet is to hijack the Unity thread via task manager, shadowcopy, or by injecting into the thread and pausing it forcefully when GL runs its decrypt method; as of now i imagine the system is rudementary compared to the tools we have on hand -
ip logging....isnt that illegal cause there can find an approximate area of your location.. ? coreect me if im wrong.
also it would be great if someone made an application or importable package tool you can just slap in unity to remove gonso/block it from logging your information -
ip logging....isnt that illegal cause there can find an approximate area of your location.. ? coreect me if im wrong.
also it would be great if someone made an application or importable package tool you can just slap in unity to remove gonso/block it from logging your information@Anonymous92765 ip grabbing technically is not illegal but even if it was i doubt gonso users would care because they're delusional and crazy
-
But i heard it logs your ip and basically flags you to creators?
unconfirmed, but given the closed-source nature of the system i wouldn't put it out of the equation - so far though Gonso himself has told me directly (and proven to me) that he does not have interest in logging IPs; as far as i can tell that remains the case now
What happens to a model with gonzo if the creator no longer uses gonzo?
hopefully, like Whituu's Sakura from a while ago, it is simply updated for the purchasers to not have the system in the package; otherwise it's just up to the creator to do that themselves
And, how does one manually remove gonzo?
this one is an involved process. there isn't a singular way to remove this system, and there is definitely not a simple way to do so without a decent handle on programming and cybersec tools
both @halcyon and i have worked on ways to get around this and she still works on them now; i just help with code stuff occasionally as i've mostly lost interest in it
it boils down to a few methods:
- the first, is to decompile the GonsoLicense DLL (most versions are obfuscated with ConfuserEX - it's very easy for a user to see this by loading the DLL into something like Ghidra or DnSpy); and once you've obtained the source code, you can write your own Unity scripts to "fake" requests to the API, basically copy-pasting the
Decryptmethod so it can be decrypted manually with the key from the API- there was a tool developed by a few acquaintances of mine that circulated around this forum a while ago; it was based off of my original methods and code that ended up being heavily edited for public use
- the second is to hijack the Unity process and "stall" it while the Licenser does its tricks. the drawback of GonsoLicense is that it has one major flaw: Unity cannot load or upload encrypted files. at some point during the upload process, these files have to be decrypted to be packaged - giving users a small window in which they can grab the files if they can get around Unity's directory locking. while simpler on paper, Unity's directory lock is pretty robust and isn't easy to bypass
Personally dont believe it but why lie to your buyers?
money. i wish i could say most creators using the GonsoLicense system are doing it without malicious intent, but the bottom line is many of them are looking for quick ways to maximize their profit margins for mediocre avatar work (not the case for all, but many), where some creators like Strawbunny don't even do most of the work and outsource it - there's a reason you don't see larger, more confident creators using the system (to name a few, such as Godfall and Nikkie) - the quality of their work speaks for itself (and is usually worth the price); most importantly their interaction with the community they've built doesn't give many users a reason to maliciously steal their products
it's all business practices, and predatory ones at that
i'm aware specifically for Birdy's case that they did actually stop using Gonso, but released the non-GonsoLicense'd package under a completely separate listing on their Gumroad. whether they forced previous buyers to re-buy it or not is unknown to me
feel free to ping myself or @halcyon for more answers - we're happy to help
@taikeru said in Gonso System:
there was a tool developed by a few acquaintances of mine that circulated around this forum a while ago; it was based off of my original methods and code that ended up being heavily edited for public use
where can i find the tool?
- the first, is to decompile the GonsoLicense DLL (most versions are obfuscated with ConfuserEX - it's very easy for a user to see this by loading the DLL into something like Ghidra or DnSpy); and once you've obtained the source code, you can write your own Unity scripts to "fake" requests to the API, basically copy-pasting the
-
@taikeru said in Gonso System:
there was a tool developed by a few acquaintances of mine that circulated around this forum a while ago; it was based off of my original methods and code that ended up being heavily edited for public use
where can i find the tool?
-
V viper454 referenced this topic on
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login