VRChat added VRCA (?maybe VRCW too) protection

["'Real' Visitor"]

So... Yea, they added an encryption or custom method to load avatar bundles.
So usual methods of using AR or SARS doesn't work anymore.
What do you all think about it? (also share any news if you have any)

[Reym]

look like they patched the local cache too, you cannot take the file out anymore with assetsripper, i found it today when i try to do avatar rip, if you try to load file on the assetripper UI and check export button it will say 0.0.0a0

the update seem to already take effect around 5 PM because when i check for stuff on avatar world after drone dolly camera update thingy, it was working just fine.

any of you people have any opinion on this? or it just my stuff not working

[Reym]

update, no is not just me apparently, i tested with today cache 30/03/2025 with cache i got 3 day ago 27/03/2025 the cache from 3 day ago work just fine and i can extract it with assets ripper, as for latest cache they are no longer working, you cannot rip people avatar locally cache now, they have added some sort of encryption or protections to it

Tested vrca and vrcw, with old and latest cache, the latest not working

[Reym]

can anyone confirm this? thank you

[Boubou___]

You'r right Reym. Pre-patch cache can be rip. You cannot rip avatar locally from the cache anymore...

[avatarofcorn]

It's added for VRCW as well. I heard about it and went on the mad scramble to back up memorable worlds from the early days and they're all scrambled. I have a feeling they only did this so people can't "port" user-made worlds to other social VR platforms since VRChat has gone down the shitter. They don't care one bit about their users and their concerns with "avatar ripping".

[SeraphicRoses]

If there is a will there is always a way please don't lose hope

[trejectt]

Vrchat now uses AES-GCM encryption. The only way to get any type of unencrypted vrca or vrcw is with a modded client. Otherwise dump the game and get the decryption method. And boom. But the method is lazy and there are ways around this. Cannot say more right now.

[Reym]

@trejectt dumping the game and get the encryption?, that actually could work, problem is gonna take very long to locate where the encryption are, and if it an encryption we need a key

[sas909]

@trejectt Why are you so sure it's AES encryption?

[chocolate]

I usually used loadbundle, and I was hoping that at least this would become usable. But if encryption measures have been implemented, there’s almost no chance it will work in the future.

["'Real' Visitor"]

@trejectt Yep, saw one video where client user was able to extract avtr file w/o encryption. And from other source I found out that it is indeed client-sided. Files on VRC servers are still un-encrypted, and encrypted locally. So if anyone have a backup of previous VRC client version, they can still load and rip. Or wait for someone to decompile VRC and make another tool...

[Hardware98]

@avatarofcorn I heard personally they did it because they've started a partnership with Booth, but unsure how true that really is. At least the community had time, but I fear vrchat is certainly gonna turn into Pokechat for vrca's.

[trejectt]

@Real-Visitor I havent found a version that lets you play. i have all the way back to last year. all force to update

[chocolate]

I downgraded VRChat, but I can’t launch it because a warning message says, "Please update."

[NonckUnck]

@chocolate yeah it only worked for a few hrs into the next day.(28th) i helped someone figured it out

[Reym]

@Real-Visitor what if the connection download is intercepted? what would happen?

[DrKWolf]

Can someone help me on DM for getting an avatar? i still have the ID of it.
extracting vrca from cache doesn't work anymore, and assetripper can't load assets folder and shows unity version as 0.0.0a0

[avatarofcorn]

@Hardware98 It was clear as day what the outcome would have been when EAC was rammed down everyone's throats to the protest of nearly forty thousand downvotes on the Canny. Didn't take long for them to charge for what mods and other social VR platforms do for free. Notice how development time now is spent on monetization, instead of fixing bugs and improving the existing system. I suppose the massive layoffs last year were to remove staff members who gave half a damn about the community. The rest aren't talking but you can figure it out from how angry Merlin got. (For those who don't recognize this name, he's the guy who brought us UdonSharp and was hired to overhaul the broken Udon system when he was suddenly fired.)

@Reym Try setting up a transparent MITM proxy with a self-signed TLS cert. Your mileage might vary, given the ring-0 rootkit on the machine.

[Reym]

@avatarofcorn ring-0?