VRChat added VRCA (?maybe VRCW too) protection
-
So few things I discovered from my analysis.
-
For now encryption is client side and assets are encrypted only after they are downloaded
-
Seems they are using AES which is very strong BUT the game has to have a key to decrypt it so just like with Unreal Engine PAK files it should be possible to eventually find where the key is and get it, there are three possibilities, one is that key is hardcoded into the game and is same for all users, second is that key is derived from some sort of unique ID like HWID so that every user has different key (I have yet to test it by transfering cache to another PC) third option is that the decrpytion key isnt even in the game at all and that its sent by the server upon loading into the world.
-
Using Fiddler doesnt work as game seems to use SSL Pinning so when running network sniffing asset related connections are rejected, Fiddler used to work few years ago for getting VRCA and VRCW files from CDN but looks like thats now fixed and VRCX JSON asset URL field is empty and even if you get the URL to asset on CDN connection is rejected because its expecting VRC user agent and auth key, it should be possible to spoof VRC user agent and somehow get users auth key but I havent tried that
I think SARS already does that but I havent tested it for now. -
Even tho encryption is currently done client side its possible that in the future any new uploads of bundles might be encrypted upon upload either in SDK or on server after upload.
Whats already unencrypted on CDN will probably stay that way because it would be very hard on servers CPUs to go and encrypt all the old content but future content is uncertian.
I still gotta check if there is some sort of temp file during encryption process but Im gonna have to do that on old laptop since my main desktop is done with encryption in less than a second while old laptop I dug up freezes for a few seconds during encryption after download is done so I might try killing the game during that process
@stetamatea On what are you basing your assumption that it's fully client-side?
Avatars are being processed server-side already.. When you switch to an avatar that hasn't been used for a while it says "Server Processing" for quite a bit before sending it to the players, I see 0 reason for them not to encrypt them at that moment.
As someone who's dealt with AES, it's not that bad (performance wise) to encrypt avatars/worlds server-side. -
-
@stetamatea On what are you basing your assumption that it's fully client-side?
Avatars are being processed server-side already.. When you switch to an avatar that hasn't been used for a while it says "Server Processing" for quite a bit before sending it to the players, I see 0 reason for them not to encrypt them at that moment.
As someone who's dealt with AES, it's not that bad (performance wise) to encrypt avatars/worlds server-side.@devonda745 said in VRChat added VRCA (?maybe VRCW too) protection:
@stetamatea On what are you basing your assumption that it's fully client-side?
Avatars are being processed server-side already.. When you switch to an avatar that hasn't been used for a while it says "Server Processing" for quite a bit before sending it to the players, I see 0 reason for them not to encrypt them at that moment.
As someone who's dealt with AES, it's not that bad (performance wise) to encrypt avatars/worlds server-side.On the fact that you can use modified client and it will simply download avatar as usual without any encryption which can then be extracted like usual with assetripper.
Another option that works is by bypassing EAC (there are some non public methods) on vanilla client you can inject cert to avoid SSL pinning and use MITM proxy to get direct URL to assetbundle game downloads and manually download it which again results in unencrypted assetbundle, its only when client processes it that its encrypted.
Same was confirmed in SARS discord server, downloading directly from CDN using VRCHAT client headers and user auth key results in unencrypted assetbundle and same with using modded client, the assets are unencrypted.
Some were able to run older client version before they patched that (now that its patched it checks and forces update) and old client resulted in unencrypted patch.
They are literally serving raw assetbundles from server and client applies encryption when it gets put into cache folder.
I wouldnt be suprised if they start serving encrypted content from server in the future but for now its fully client side.
-
Can someone please help me download only a single avatar from the servers before this situation gets any worse?
-
You don’t really need to go through all that trouble—
wouldn’t it be easier to just use Windows’ built-in features to make the files read-only and then grab them?
Even then, the files were already encrypted, so doesn’t that mean they’re encrypted at the time of download? -
@devonda745 said in VRChat added VRCA (?maybe VRCW too) protection:
@stetamatea On what are you basing your assumption that it's fully client-side?
Avatars are being processed server-side already.. When you switch to an avatar that hasn't been used for a while it says "Server Processing" for quite a bit before sending it to the players, I see 0 reason for them not to encrypt them at that moment.
As someone who's dealt with AES, it's not that bad (performance wise) to encrypt avatars/worlds server-side.On the fact that you can use modified client and it will simply download avatar as usual without any encryption which can then be extracted like usual with assetripper.
Another option that works is by bypassing EAC (there are some non public methods) on vanilla client you can inject cert to avoid SSL pinning and use MITM proxy to get direct URL to assetbundle game downloads and manually download it which again results in unencrypted assetbundle, its only when client processes it that its encrypted.
Same was confirmed in SARS discord server, downloading directly from CDN using VRCHAT client headers and user auth key results in unencrypted assetbundle and same with using modded client, the assets are unencrypted.
Some were able to run older client version before they patched that (now that its patched it checks and forces update) and old client resulted in unencrypted patch.
They are literally serving raw assetbundles from server and client applies encryption when it gets put into cache folder.
I wouldnt be suprised if they start serving encrypted content from server in the future but for now its fully client side.
@stetamatea said in VRChat added VRCA (?maybe VRCW too) protection:
you can use modified client and it will simply download avatar as usual without any encryption which can then be extracted like usual with assetripper.
Another option that works is by bypassing EAC (there are some non public methods) on vanilla client you can inject cert to avoid SSL pinning and use MITM proxy to get direct URL to assetbundle game downloads and manually download it which again results in unencrypted assetbundle, its only when client processes it that its encrypted.
Same was confirmed in SARS discord server, downloading directly from CDN using VRCHAT client headers and user auth key results in unencrypted assetbundle and same with using modded client, the assets are unencrypted.
Do those workaround methods function for worlds too? Is there anyone who uses any of them, willing to provide me a specific world AssetBundle unencrypted?
-
Okay, so some more testing.
I set my cache location to secondary drive and proceeded to download quite large in file size worlds and watched SSDs activity.
I found that D drive that cache was set to was idle during download and only shows large activity spike after download is complete so files arent being put into the cache folder until they are done downloading meanwhile C the system drive was showing write speed that match my download speed during download and was showing less and less disk space during large world downloads only for that space to come back seconds after download was done.So what I did was change my router settings to severly limit my download speed and then join the largest possible world I found to allow me some time to check where the game is writing temporary file during the download.
The game stores temporary _data file in C:\Users\username\AppData\LocalLow\Unity\Temp during the download before moving it to cache folder after download is done.
I tried to copy the file to another location just as ingame download hits 100% in hopes to get it before its encrypted but it ended up still being encrypted no matter how many times I tried so either its already encrypted on server or my Core i9 is too fast and gets encryption done before file gets copied or its simply being encrypted in realtime as its written even sa temp file.
I just hope decryption key is somewhere in the game and not sent by the server to the client as getting key from the game itself is gonna be easier because game has SSL pinning which make traffic sniffing harder.
@stetamatea this gave me an idea, i am gonna try it, with the slowest device ever imaginable, with celeron cpu
, i doubt it will work -
Okay, so some more testing.
I set my cache location to secondary drive and proceeded to download quite large in file size worlds and watched SSDs activity.
I found that D drive that cache was set to was idle during download and only shows large activity spike after download is complete so files arent being put into the cache folder until they are done downloading meanwhile C the system drive was showing write speed that match my download speed during download and was showing less and less disk space during large world downloads only for that space to come back seconds after download was done.So what I did was change my router settings to severly limit my download speed and then join the largest possible world I found to allow me some time to check where the game is writing temporary file during the download.
The game stores temporary _data file in C:\Users\username\AppData\LocalLow\Unity\Temp during the download before moving it to cache folder after download is done.
I tried to copy the file to another location just as ingame download hits 100% in hopes to get it before its encrypted but it ended up still being encrypted no matter how many times I tried so either its already encrypted on server or my Core i9 is too fast and gets encryption done before file gets copied or its simply being encrypted in realtime as its written even sa temp file.
I just hope decryption key is somewhere in the game and not sent by the server to the client as getting key from the game itself is gonna be easier because game has SSL pinning which make traffic sniffing harder.
-
Okay, so some more testing.
I set my cache location to secondary drive and proceeded to download quite large in file size worlds and watched SSDs activity.
I found that D drive that cache was set to was idle during download and only shows large activity spike after download is complete so files arent being put into the cache folder until they are done downloading meanwhile C the system drive was showing write speed that match my download speed during download and was showing less and less disk space during large world downloads only for that space to come back seconds after download was done.So what I did was change my router settings to severly limit my download speed and then join the largest possible world I found to allow me some time to check where the game is writing temporary file during the download.
The game stores temporary _data file in C:\Users\username\AppData\LocalLow\Unity\Temp during the download before moving it to cache folder after download is done.
I tried to copy the file to another location just as ingame download hits 100% in hopes to get it before its encrypted but it ended up still being encrypted no matter how many times I tried so either its already encrypted on server or my Core i9 is too fast and gets encryption done before file gets copied or its simply being encrypted in realtime as its written even sa temp file.
I just hope decryption key is somewhere in the game and not sent by the server to the client as getting key from the game itself is gonna be easier because game has SSL pinning which make traffic sniffing harder.
@stetamatea After a avatar finishes downloading a randomized folder name is created along with a 1KB __data file and a __lock file. The actual data size only shows up after the avatar finishes loading in-game, which is signified by the green loading bar, not immediately after the download.
Once the avatar is marked as loaded, VRChat attempts to move the folder to the cache folder. However, I’ve prevented VRChat from doing this by denying my user permission to delete folders, subfolders, and files in the Unity temp folder—just in case it tries to do anything during the process.
In the end the data file in the temp folder is encrypted, which suggests VRChat is encrypting the data while the avatar is loading. It doesn’t seem to create an unencrypted file in that folder, unless it's stored elsewhere or the encryption is handled server-side as of now.
Cache ripping seems to be impossible now without a modified client. But even if encryption is only done on the client side and can be tampered with to prevent it, it’s only a matter of time before VRChat starts encrypting old avatars on the server when they’re requested—then storing the newly encrypted version to avoid re-encrypting it again. They might also start encrypting avatars at the time of upload going forward on the new sdk.
Eventually, it seems to me that we’ll need a decryption method no matter what. But other then that I wish you luck finding something out.
-
@Visaeres ur on a ripping website lol what did ya expect?
-
T Thisistest2 referenced this topic
-
If there was a way to directly get the package from the API, what would someone need to format their request as to get another persons avatar? or what would you need to modify in the client?
-
T Thisistest2 referenced this topic
-
T Thisistest2 referenced this topic
-
T Thisistest2 referenced this topic
-
T Thisistest2 referenced this topic
-
T Thisistest2 referenced this topic
-
Do y'all reckon it'll still make sense to keep the cache of anything we want and hold on to them until a method is found to decrypt, or would we just have to forget about it and have to download new ones when it does get figured out
@Alisan "Maybe" is all I can really say, since we have no idea what the decryption method is going to look like. It could be as simple as having a master key that works for everything, or it might be session-based, meaning you'd need to get a new one each time. The new method might not even involve decryption at all—it could just mean downloading unencrypted assets directly from VRChat (though the publicly available info on that is pretty hard to understand right now if you're just a regular person browsing). Honestly, it just depends on how much storage you have and whether you think it's worth it.
-
Do y'all reckon it'll still make sense to keep the cache of anything we want and hold on to them until a method is found to decrypt, or would we just have to forget about it and have to download new ones when it does get figured out
@Alisan I’ve been doing some more reading on the S.A.R.S (Avatar Recovery) Discord server, which is another place where people are discussing this topic in the general channel. From everything I’ve seen, there’s still no public or convenient method to bypass this—unless you use a modified client that disables encryption (which will most likely be paid for), or directly download from VRChat’s API, which isn't easy to learn without knowing someone and bannable.
People so far are not focusing on breaking or reverse engineering the decryption since VRChat is storing unencrypted files and serving them as is. As long as the avatars on VRChats end remain unencrypted then I doubt anyone will put in the effort for bypassing the decryption with such a "easy" method already found. I don't believe we’ll ever get a method as convenient as cache ripping used to be.
-
So... Yea, they added an encryption or custom method to load avatar bundles.
So usual methods of using AR or SARS doesn't work anymore.
What do you all think about it? (also share any news if you have any)@Real-Visitor
do not feel tired get up and start working on it soon you will success in that -
As far as I can tell from a few days worth of data I have collected, vrchat is using a client side AND server-side, session based encryption key. (Possibly based on the cookie used to authenticate the client with vrchat, and vrchat's servers providing a decryption key based on the files hash.)
The reasons I came to the conclusion:- The same world/avatar file having wildly different data but the same folder ID structure between downloads.
- vrchat will reuse the same cache files, but not after clearing the cache.
- vrchat will actively authenticate the files and verify the hash on the server before sending a decryption key. (Will not function in offline testing mode, but avatars uploaded yourself on your own account apparently function and can be used offline.)
-
As far as I can tell, you cannot decrypt any of the assets that are already encrypted because of the fact that the assets may be tied to a session id. (They have different encrypted data for the same exact file, but different session. I may be wrong, the __info file may be tied to it.)
The only way forward is to have some sort of mod that prevents vrchat from encrypting the cache, BUT you have to bypass any security features to keep from being detected.I suspect that vrchat is utilizing session based encryption and using something in the __info file to encrypt it as there is a large numerical number that changes each download.
