VRChat added VRCA (?maybe VRCW too) protection
-
I was able to get unencrypted vrcw files but only through a very buggy method (no avatar loading(I wish brother)). This confirms at least for me that NO SERVER SIDE ENCRYPTION is happening.
@Daito1234 what buggy method?
-
Still waiting for answers about the buggy method. Also, encrypted files do nothing but cause problems in VRChat.
-
Adding this in a second comment but just an observation. When you start up VRChat.exe and you try to load the Public avatars it still fetches them online. It still creates a __data file in your cache folder, yet the unencrypt vrca's for them are in C:\Program Files (x86)\Steam\steamapps\common\VRChat\VRChat_Data\StreamingAssets\Avatars
This has been there before the encryption update. I thought they were there cause the game devs just wanted people to have models that they can use when theyre testing out stuff in the game running it directly from the exe.
Yet it still makes server requests to download them and encrypt them when theyre unencrypted and just sitting their on your PC? The game also does not use PhotonEncryptorPlugin.dll running from the exe, looking at procmon, but only calls GameAssembly.dll
Just kinda weird idk, why download the files from a server if theyre already on your PC? Why still encrypt them?
-
@Linze i don't think so, just off a glance it doesn't import any crypto libraries. after some further investigation its definitely just for encoding media stuff.
i have a full dma set up and i could get started poking around the game to try to find something useful, but i figured id look around here first. i mean if i can just grab vrca's from memory that would be pretty sick. it seems like most of the stuff from gameassembly is encrypted but i have found a few things like the avatarmanager and the player objects, im just not sure what to make of it all. if anyone has any advice of what to be looking for that would be great.
-
@Linze i don't think so, just off a glance it doesn't import any crypto libraries. after some further investigation its definitely just for encoding media stuff.
i have a full dma set up and i could get started poking around the game to try to find something useful, but i figured id look around here first. i mean if i can just grab vrca's from memory that would be pretty sick. it seems like most of the stuff from gameassembly is encrypted but i have found a few things like the avatarmanager and the player objects, im just not sure what to make of it all. if anyone has any advice of what to be looking for that would be great.
here my research i been doing so far
so every unencrypted file of vrca or vrcw they contain unityFS version like this
UnityFS 5.x.x 2022.3.22f1
while encrypted or game contains
UnityFS 5.x.x 2022.3.22f1-DWR
i do not know what DWR for but it could be a clue, every unencrypted today contain like BuildPlayer-(world name here).sharedAssets and for avatar file they contain CAB-(number letters here), which readable in assetripper
while encrypted has none and has bunch of @@@@@@@@@@ spam at the end of every vrca-vrcw file, i look dll files, inspecting any clue i found they use AES-CBC-GCM-SHA256 kind of encryption in game dll, try to look into game data so far i only been looking into the GameAssembly.dll and PhotonEncryptorPlugin.dll and other dll i may forgot when looking into thempost mentions of game encrypt in unity
https://discussions.unity.com/t/how-would-you-secure-an-encryption-key-in-the-client/640245/36document of encryption
https://docs.unity3d.com/Packages/[email protected]/manual/encrypt-a-model.htmlidea i have are either the assets being streamed in something in our machine or they are stored somewhere as .sharedAssets, i am not sure if this will help someone in the future of getting unencrypted file including private avatar, hope it helps
I'm bad at understanding english word
I fix .vrca/.vrcw stuff for free and for fun! Depending on file, every outcome and vary might be different than the original avatar has due to the toggles and much more, send me a pm if you need an avi that need to fix or cracking a password locked avatar or send me .vrca file or through my pms and i will extract/fix them for you!
request is semi-open, only on unencrypted __data file aka .vrca or .vrcw
-
here my research i been doing so far
so every unencrypted file of vrca or vrcw they contain unityFS version like this
UnityFS 5.x.x 2022.3.22f1
while encrypted or game contains
UnityFS 5.x.x 2022.3.22f1-DWR
i do not know what DWR for but it could be a clue, every unencrypted today contain like BuildPlayer-(world name here).sharedAssets and for avatar file they contain CAB-(number letters here), which readable in assetripper
while encrypted has none and has bunch of @@@@@@@@@@ spam at the end of every vrca-vrcw file, i look dll files, inspecting any clue i found they use AES-CBC-GCM-SHA256 kind of encryption in game dll, try to look into game data so far i only been looking into the GameAssembly.dll and PhotonEncryptorPlugin.dll and other dll i may forgot when looking into thempost mentions of game encrypt in unity
https://discussions.unity.com/t/how-would-you-secure-an-encryption-key-in-the-client/640245/36document of encryption
https://docs.unity3d.com/Packages/[email protected]/manual/encrypt-a-model.htmlidea i have are either the assets being streamed in something in our machine or they are stored somewhere as .sharedAssets, i am not sure if this will help someone in the future of getting unencrypted file including private avatar, hope it helps
-
@Reym is it just encrypted while in game and in your filesystem? if you can just grab the vrca asset url and its unencrypted then profit?
@edenware
it is not that very simple, the system is complicated, some people (me included) who have got the .vrca or .vrcw are obtained through the api OR they have modified their .exe/.dll to get core of game and unity since the unencrypted one i seen contain no DWR word or encryption sign and you cannot get asset url that easily as vrchat uses protections on connection of asset download, i do found what vrchat use on connection protect but i forgot which dll what was that located
some uses discord if you want easy vrca or vrcw file go therethis is just what i thinking either the exe is streaming the world file and stuff or they took the unity of the game and modify it to normal unity without DWR, again this could be wrong, this is just my ideas of how exe it process encrypted file, could be off or could be right, i still look for anything that i can do
1 thing i notice while researching, file called "lib_burst_generated.dll" could be the core something to do with encryption, if anyone do have info or know what it do, let us know, if you rather want to keep it private, private message work
as of now, i will be stopping my research, i hope this notes can be useful if someone ever want to continue it
-
Is there anyway to find a pre-encrypted VRCA of a public avatar? I will do all of the repair work myself. The avatar author refuses to give away the files, or even sell them.
My understanding is right now no third party client exists to intercept vrca's, or easy method to rip avatars from the cache.
I'd take an old version I'm just looking for this Khai's Good Dragon...
-
Oh my I did not realize I got this popular >A< dang. Yes I figured out how to rip models again. No I am not telling you how to do it (devs are lurking).
I might make a thread so people can request avatar vrca files by putting an avatar ID and i put the vrca out, but then that might get me into a lotta trouble sharing around avatars vrchat sells lol. I will think about it. I dont rip to redistribute assets or make a profit, I do it cause I like tinkering with stuff and it helped me learn how to make avatars.
I was motivated to do it again cause theres so many broken models on vrchat that I fix up/improve and upload to my account. I spent years learning unity, the VRChatSDK, and other computer junk to do what I do lol.
AND IM NOT GIVING PEOPLE MY DISCORD I DONT KNOW YOU PEOPLE
@StinkerGuy115 Hey, ik this may be outdated, but is there any way I can contact you? I have been tryna figure this out for awhile since the uodate.if not it's fine, just hoping someone can show me a new method.
-
found the culprit who wanted this stupid feature in beginning
https://feedback.vrchat.com/feature-requests/p/encrypted-avatar-id-or-disallow-downloads-from-apivrchatcloud-to-prevent-avatar -
Another request for https://vrchat.com/home/avatar/avtr_207260b6-0828-42ea-8218-94b7a32bb5aa if anyone could help
-
here my research i been doing so far
so every unencrypted file of vrca or vrcw they contain unityFS version like this
UnityFS 5.x.x 2022.3.22f1
while encrypted or game contains
UnityFS 5.x.x 2022.3.22f1-DWR
i do not know what DWR for but it could be a clue, every unencrypted today contain like BuildPlayer-(world name here).sharedAssets and for avatar file they contain CAB-(number letters here), which readable in assetripper
while encrypted has none and has bunch of @@@@@@@@@@ spam at the end of every vrca-vrcw file, i look dll files, inspecting any clue i found they use AES-CBC-GCM-SHA256 kind of encryption in game dll, try to look into game data so far i only been looking into the GameAssembly.dll and PhotonEncryptorPlugin.dll and other dll i may forgot when looking into thempost mentions of game encrypt in unity
https://discussions.unity.com/t/how-would-you-secure-an-encryption-key-in-the-client/640245/36document of encryption
https://docs.unity3d.com/Packages/[email protected]/manual/encrypt-a-model.htmlidea i have are either the assets being streamed in something in our machine or they are stored somewhere as .sharedAssets, i am not sure if this will help someone in the future of getting unencrypted file including private avatar, hope it helps
-
Abyss has been dead for a while. At this point, HEX is the only one that still works and bypasses EAC properly.
Currently, I can still extract models using the Abyss client.
-
@Linze for method 1, you need the SSL thing, which only can be decrypt on wireshark, but vrchat has detection and debug off for those, the only way to get it by MITM or something, based of my old research, the log i have in the archive contain the said SSL and handshakes, but we need the decrypt key that can be obtain through SSLKEYLOG, again the key does not generate on games, only browser with debug on by default, as for MITM i have not tested it when i decide to stop my research, due to lack of device and tech
Note, vrchat on the wireshark will constantly spam something around 0.5 millisecond at the same time, so getting it would be thoroughly hard or impossible
-
K Kleiner referenced this topic on
-
Sooo, last time I ripped an Avatar was in August 2024.
Currently we're almost in 2026, still no actual feasible way to decrypt? I have some interesting things on cache with that _data format that I would like to extract. Please!
🥺
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login