Understanding VRChat Cache Encryption

daswdas

VRChat protects its downloaded content by storing it as encrypted cache files on your local drive. When you load a world or an avatar, the game downloads the data and immediately scrambles it using strong encryption.

The unique keys required to unscramble this data are generated dynamically and held only temporarily within the game's active memory while the item is actively loading. Because of this security measure, simply copying the cached files from your hard drive is completely useless. Unless you extract the specific memory key while the game is running and apply the exact decryption formula, those files remain entirely unreadable garbage.

I have developed a custom solution that captures these live memory keys and perfectly reconstructs the original, unencrypted files.

Originally, I was considering setting up a donation goal for the full release. To be completely honest, though, I am pretty annoyed by the amount of people in this community who are just hungry for free handouts and beg for tools without ever contributing anything of value. Because of that, I am completely changing how I release this

[ Release Goal: 50 Upvotes ]
If this post reaches 50 upvotes, I will publicly release the base version of my decryptor for you guys to play around with. This version successfully extracts keys and decrypts your cache files, but it strictly requires VRChat to be launched with Easy Anti-Cheat disabled (EAC Disabled)

As for the advanced version that can safely extract live keys and decrypt files while the game is running normally with EAC fully enabled... I am going to hold onto it and think about it for a while. I have no intention of spoon-feeding a premium, fully working bypass to people who just want to leech. I will see what the feedback is like on the base version first before I decide if I am ever going to release the full bypass

Drop an upvote if you want to try the base version. Once it hits the goal, I will drop in here

Dubhe

wow pretty cool!

mollymolly

Bump and upvoted. Keep fighting the good fight!
I don't want to sound like that kind of person, but I'd sure love to know how you cracked VRC's asset encryption. Isn't it AES-256 or something complex like that?

tenderwater

wow cool..
two, your PP is blowing my mind LOL

pendatron

This post is deleted!

deem

What's the chances they change the encryption scheme once a noob friendly tool is available. And honestly how much farther can they go to try and secure the files.(I can think of a few ways) If EAC is anything like the other anticheats out there once a hash for a tool is identified it can just refuse to run while that known exe is in the process list. The way we got around that with VAC back in the day was loading another processes suspended, carving it out with RunPE. Then connecting to a randomised port that acted as a serial on another device to hook and read remotely.

daswdas

@pendatron
You're exactly right about the caching behavior when EAC is disabled. That's precisely why this "base version" I'm releasing at 50 upvotes will only work for avatars you own or the public official ones. It strictly requires VRChat to be launched with EAC disabled.

As for your method, hooking CreateCached_Injected to null the key is a classic way to stop the encryption from happening. But my tool takes a different route. Instead of preventing the cache encryption from the start, I hook directly into... well, let's just say I dynamically dump the live keys straight from memory as the game naturally decrypts the blocks.

I'm still holding onto the advanced version that safely extracts keys while the game is running normally with EAC fully loaded. I want to see the feedback on the base version first before deciding if I'll ever release the full bypass.

Let's hit that 50 upvotes goal first and I'll drop the base version

Petite Biscotte

Bump

Petite Biscotte

can you release the version with bypass and make it paid

daswdas

@Petite-Biscotte
I honestly don't really want to deal with setting up a login system or anti-crack protections. My current idea is to either just release it completely for free, or maybe set a donation goal and drop it once that's met.

Plus, everyone here on Ripper shares everything anyway. Rather than waiting for someone else to inevitably leak it, I figure it's probably better to just release it myself directly. But anyway, I'll wait and see the feedback first. Who knows, if I just drop the base version, someone else might pick it up, improve on the rest, and share it anyway

Petite Biscotte

@daswdas

SHIKAMI

can some one rip these avatar's for me? https://vrchat.com/home/avatar/avtr_723045f0-c464-4f06-be83-8b20052a27ef https://vrchat.com/home/avatar/avtr_88236f61-fcd8-42ee-8e14-2462a602dd73 https://vrchat.com/home/avatar/avtr_fd3ed848-0268-40ad-b92f-22470498485b i would love if some one could

Ibark4him2

interesting way of getting something patched, might as well just tell the vrchat developers how you bypass encryption

noemiwasse

@pendatron thank you for the explanation. How does one inject / hook to VRC without setting off EAC? I've been reluctant to do anything related to messing with the process itself.

dobyp

This post is deleted!

daswdas

@Ibark4him2 Well, I consider this a free QA service for VRChat
I don't care about patches. When I finally drop the release, make sure you send them a full report

daswdas

Only a few upvotes left before the public drop. Here's a little teaser for the ones waiting: https://streamable.com/37nx1q I might drop the full Source Code or the EAC Fully-Loaded bypass later. Still deciding how many upvotes those two are worth. Also, is dropping a donation link against the rules here?

ailli

interesting ,cheeer up vote bro

Whataowihg

I mean, I could try to buy the full version. Maybe.

bampee

@daswdas
Won’t this get flagged by the admins and get me banned, like other tools?

Also, do you know of a way to decrypt the encrypted cache data that already exists in the local folder?