Gonso System
-
basically flags you to creators?
i'll add a bit more to this:
- the licenser itself logs your vrchat account's
usernameanddisplay_name- this is used to identify you to the key and that's how you are flagged - many creators are using Payhip, and Payhip's anti-leak signs files with a nearly invisible identifier that allows the creator to upload a leaked
unitypackageand immediately find the info of the buyer who leaked it - which also gives them the GonsoLicense key, and can be used to identify/blacklist the user- while Payhip's antileak is robust, i've personally found an interest in how it works and have been testing possible workarounds
at the end of the day, there isn't a reason for logging IPs; Gonso and the creators have simpler, more robust methods of identifying users
@taikeru I had figured that was a rumor, but i figured asking was better than assuming.
So basically itd be in my best interest to wait for decrypted avatars to be shared? (Im fine with that)
I figured theres a lotta shady practices going on but thankfully i dont buy avatars very often so it limits what creators i buy from.
Could you tell me more about payhips system, and do sellers normally notify buyers before they purchase? Usually sellers disclose that sorta thing with Gonzo but i wouldnt be surprised if it was sneakily hidden. Kinda sounds like it is.
Thank you so much for properly explaining it to me c : - the licenser itself logs your vrchat account's
-
@taikeru I had figured that was a rumor, but i figured asking was better than assuming.
So basically itd be in my best interest to wait for decrypted avatars to be shared? (Im fine with that)
I figured theres a lotta shady practices going on but thankfully i dont buy avatars very often so it limits what creators i buy from.
Could you tell me more about payhips system, and do sellers normally notify buyers before they purchase? Usually sellers disclose that sorta thing with Gonzo but i wouldnt be surprised if it was sneakily hidden. Kinda sounds like it is.
Thank you so much for properly explaining it to me c :Could you tell me more about payhips system, and do sellers normally notify buyers before they purchase?
payhip's anti-leak is currently in closed-beta and requires a vouch directly from another creator that has it enabled to gain access - some creators do explicitly state that a package is protected by payhip's anti-leak, but i've seen that most do not
payhip's anti-leak works by injecting identifying bits into the unitypackage per buyer, generating a completely unique unitypackage for you as you click the download button
as far as i can tell, older versions of the anti-leak would edit files within the package like animations which would cause GonsoLicense to throw errors upon uploading; it seems now that isn't the case
i don't know very well how the anti-leak works right now. from my testing, it seems it no longer edits files within the package, and instead injects identifying hex-data into the unitypackage in specific places (of which seem to be very consistent across many payhip-signed packages); i'm working with Hal to develop a potential bypass for it, but we cannot make any promises
So basically itd be in my best interest to wait for decrypted avatars to be shared? (Im fine with that)
yes, this is unfortunately one of those situations where it's better to leave these processes up to those who know properly how to manage them; but understand that we also don't have infinite funds and the generosity of this community that donates their avatars and license keys cannot be understated
behind shady business practices are some very expensive "products" that likely aren't worth the price, and very commonly should not be "protected" by these things to begin with; the entire idea of giving a user encrypted, unmodifiable files of mostly kit-bashed assets is absurd in both conception and practice
-
M Miss Cannibal referenced this topic on
-
I can assure you it does not
-
suppose that gives me an excuse to properly develop a bypass tool to abuse unity with, lol
@taikeru lol yesssss
-
If i bought https://payhip.com/b/4M8Bv could someone decrypt it for me? i think my vrchat account possibly has been flagged in the gonso system, so if i buy it and upload it i think it will quit on me. i previously bought a avatar with gonso and it let me upload the pc version, but denied me from uploading the quest version. i think ill just waste my money if i upload it, and plus its nice to share with the community.
πΈdevy devy πΈ
-
If i bought https://payhip.com/b/4M8Bv could someone decrypt it for me? i think my vrchat account possibly has been flagged in the gonso system, so if i buy it and upload it i think it will quit on me. i previously bought a avatar with gonso and it let me upload the pc version, but denied me from uploading the quest version. i think ill just waste my money if i upload it, and plus its nice to share with the community.
@devywevy honestly came here bc was having issues with gonso from her avis but she doesnt have gonso, none of hers do it looks like shes lying
-
@devywevy honestly came here bc was having issues with gonso from her avis but she doesnt have gonso, none of hers do it looks like shes lying
@JadenCross lying about having gonso on her avs is insane (if this is true)
-
@devywevy honestly came here bc was having issues with gonso from her avis but she doesnt have gonso, none of hers do it looks like shes lying
-
@JadenCross lying about having gonso on her avs is insane (if this is true)
@cybergothh turns out her new couple set says she has gonso on it but she doesnt, some of the newer ones she has doesnt have gonso but some of the old ones do, its kinda mixed up with this creator, and people in my server were talking about only some have it some dont even if they say it does.
-
@JadenCross hmm, do you have proof? not saying I think you're lying, but I don't wanna make a purchase I'm going to regret cuz I'm 100% flagged in the system
-
@cybergothh turns out her new couple set says she has gonso on it but she doesnt, some of the newer ones she has doesnt have gonso but some of the old ones do, its kinda mixed up with this creator, and people in my server were talking about only some have it some dont even if they say it does.
@JadenCross ohhh alright, maybe she just puts it there to scare off leakers? im not sure
-
@devywevy read what i said above^
@JadenCross so weird : / ty for the info!!
-
Could you tell me more about payhips system, and do sellers normally notify buyers before they purchase?
payhip's anti-leak is currently in closed-beta and requires a vouch directly from another creator that has it enabled to gain access - some creators do explicitly state that a package is protected by payhip's anti-leak, but i've seen that most do not
payhip's anti-leak works by injecting identifying bits into the unitypackage per buyer, generating a completely unique unitypackage for you as you click the download button
as far as i can tell, older versions of the anti-leak would edit files within the package like animations which would cause GonsoLicense to throw errors upon uploading; it seems now that isn't the case
i don't know very well how the anti-leak works right now. from my testing, it seems it no longer edits files within the package, and instead injects identifying hex-data into the unitypackage in specific places (of which seem to be very consistent across many payhip-signed packages); i'm working with Hal to develop a potential bypass for it, but we cannot make any promises
So basically itd be in my best interest to wait for decrypted avatars to be shared? (Im fine with that)
yes, this is unfortunately one of those situations where it's better to leave these processes up to those who know properly how to manage them; but understand that we also don't have infinite funds and the generosity of this community that donates their avatars and license keys cannot be understated
behind shady business practices are some very expensive "products" that likely aren't worth the price, and very commonly should not be "protected" by these things to begin with; the entire idea of giving a user encrypted, unmodifiable files of mostly kit-bashed assets is absurd in both conception and practice
@taikeru So if it injects data into the unity package, does this mean anything within the unity package is also traceable to the purchaser, or are we safe if we individually take everything necessary for an outfit, avatar, etc out of the project and then put it all back together in a new one?
-
@taikeru So if it injects data into the unity package, does this mean anything within the unity package is also traceable to the purchaser, or are we safe if we individually take everything necessary for an outfit, avatar, etc out of the project and then put it all back together in a new one?
@idkjustacat technically, you can mine specific assets; i just wouldn't put them back into the original unitypackage and instead build your own entirely
i admit i've been absent on researching payhip's method for a bit, but it regardless of what methods you use they cannot inject data that will remain injected if you were to take an FBX from unity to blender, modify it, and re-export it; as for the unitypackage itself i wouldn't be so sure that bypasses as the data payhip injects seems to be in an unused, but still persistent block of the byte data
there are ways to make a system that can persist tracking through this, but i highly doubt payhip is putting that much effort into theirs
ultimately, don't really take my word as the bible for anything - i'm still trying to verifiably figure out how payhip's thing works but don't have a lot of testing packages to go off of
// avid reverse engineer, long-time software developer
// "...culture shouldn't exist only for those who can afford it."
// - Hakita -
@idkjustacat technically, you can mine specific assets; i just wouldn't put them back into the original unitypackage and instead build your own entirely
i admit i've been absent on researching payhip's method for a bit, but it regardless of what methods you use they cannot inject data that will remain injected if you were to take an FBX from unity to blender, modify it, and re-export it; as for the unitypackage itself i wouldn't be so sure that bypasses as the data payhip injects seems to be in an unused, but still persistent block of the byte data
there are ways to make a system that can persist tracking through this, but i highly doubt payhip is putting that much effort into theirs
ultimately, don't really take my word as the bible for anything - i'm still trying to verifiably figure out how payhip's thing works but don't have a lot of testing packages to go off of
@taikeru My thought was that I could re-export the FBXs through Blender, and take the animations, controllers, textures etc out of the original unityproject and build my own project using those controllers, animations, FBXs and re-create the materials using the original textures. But it sounds like it's possible they could still track through that? Crazy.
-
@taikeru My thought was that I could re-export the FBXs through Blender, and take the animations, controllers, textures etc out of the original unityproject and build my own project using those controllers, animations, FBXs and re-create the materials using the original textures. But it sounds like it's possible they could still track through that? Crazy.
@idkjustacat as far as i can tell, it's possible but highly unlikely if you were to create a completely new project and rename anything important. your idea would probably work for the most part
not sure though, try it if you're interested; i'm always open to taking a look at unitypackages that are signed by payhip in efforts to discover what specifically they're doing
