VRChat added VRCA (?maybe VRCW too) protection
-
T Thisistest2 referenced this topic
-
If there was a way to directly get the package from the API, what would someone need to format their request as to get another persons avatar? or what would you need to modify in the client?
-
T Thisistest2 referenced this topic
-
T Thisistest2 referenced this topic
-
T Thisistest2 referenced this topic
-
T Thisistest2 referenced this topic
-
T Thisistest2 referenced this topic
-
Do y'all reckon it'll still make sense to keep the cache of anything we want and hold on to them until a method is found to decrypt, or would we just have to forget about it and have to download new ones when it does get figured out
@Alisan "Maybe" is all I can really say, since we have no idea what the decryption method is going to look like. It could be as simple as having a master key that works for everything, or it might be session-based, meaning you'd need to get a new one each time. The new method might not even involve decryption at all—it could just mean downloading unencrypted assets directly from VRChat (though the publicly available info on that is pretty hard to understand right now if you're just a regular person browsing). Honestly, it just depends on how much storage you have and whether you think it's worth it.
-
Do y'all reckon it'll still make sense to keep the cache of anything we want and hold on to them until a method is found to decrypt, or would we just have to forget about it and have to download new ones when it does get figured out
@Alisan I’ve been doing some more reading on the S.A.R.S (Avatar Recovery) Discord server, which is another place where people are discussing this topic in the general channel. From everything I’ve seen, there’s still no public or convenient method to bypass this—unless you use a modified client that disables encryption (which will most likely be paid for), or directly download from VRChat’s API, which isn't easy to learn without knowing someone and bannable.
People so far are not focusing on breaking or reverse engineering the decryption since VRChat is storing unencrypted files and serving them as is. As long as the avatars on VRChats end remain unencrypted then I doubt anyone will put in the effort for bypassing the decryption with such a "easy" method already found. I don't believe we’ll ever get a method as convenient as cache ripping used to be.
-
So... Yea, they added an encryption or custom method to load avatar bundles.
So usual methods of using AR or SARS doesn't work anymore.
What do you all think about it? (also share any news if you have any)@Real-Visitor
do not feel tired get up and start working on it soon you will success in that -
As far as I can tell from a few days worth of data I have collected, vrchat is using a client side AND server-side, session based encryption key. (Possibly based on the cookie used to authenticate the client with vrchat, and vrchat's servers providing a decryption key based on the files hash.)
The reasons I came to the conclusion:- The same world/avatar file having wildly different data but the same folder ID structure between downloads.
- vrchat will reuse the same cache files, but not after clearing the cache.
- vrchat will actively authenticate the files and verify the hash on the server before sending a decryption key. (Will not function in offline testing mode, but avatars uploaded yourself on your own account apparently function and can be used offline.)
-
As far as I can tell, you cannot decrypt any of the assets that are already encrypted because of the fact that the assets may be tied to a session id. (They have different encrypted data for the same exact file, but different session. I may be wrong, the __info file may be tied to it.)
The only way forward is to have some sort of mod that prevents vrchat from encrypting the cache, BUT you have to bypass any security features to keep from being detected.I suspect that vrchat is utilizing session based encryption and using something in the __info file to encrypt it as there is a large numerical number that changes each download.
-
Again, or just get avatars the normal way instead of putting so much effort into stealing avatars from a user in game lol
@Visaeres so real, stealing people's personal edits is weird anyway. and yeah yeah, ripping site, im aware. i obtain assets for free on here, or avatars that were sold to the public, but not people's personal work, just stop being lazy, learn how to use blender, and make your own edits with the assets you obtain lol
p u p p y ꒰ᐢ. .ᐢ꒱₊˚⊹
-
@Visaeres so real, stealing people's personal edits is weird anyway. and yeah yeah, ripping site, im aware. i obtain assets for free on here, or avatars that were sold to the public, but not people's personal work, just stop being lazy, learn how to use blender, and make your own edits with the assets you obtain lol
-
@Visaeres so real, stealing people's personal edits is weird anyway. and yeah yeah, ripping site, im aware. i obtain assets for free on here, or avatars that were sold to the public, but not people's personal work, just stop being lazy, learn how to use blender, and make your own edits with the assets you obtain lol
@c0tt0nc4ndy Can i have your personal works? I'm too lazy to make anything.
-
@Visaeres so real, stealing people's personal edits is weird anyway. and yeah yeah, ripping site, im aware. i obtain assets for free on here, or avatars that were sold to the public, but not people's personal work, just stop being lazy, learn how to use blender, and make your own edits with the assets you obtain lol
@c0tt0nc4ndy i agree with you guys re: personals but man do i already miss ripping public versions of bases i want to use lol. and i was just procrastinating grabbing old avatars off my own account so i could reuse the textures and remake them but without my ex's name on them... waited like a day too long. shit sucks.
-
Right? It’s one thing to rip models that are overpriced or sold by people that steal assets but it’s another thing to rip customs/edits from the game itself. If anything, I’m actually glad VRChat finally put an halt to it. The only bad thing is they probably did this because they intent on having an avatars market in-game or something, outside of the pre-existing currency thing they released a while back.
sleepy
-
@c0tt0nc4ndy i agree with you guys re: personals but man do i already miss ripping public versions of bases i want to use lol. and i was just procrastinating grabbing old avatars off my own account so i could reuse the textures and remake them but without my ex's name on them... waited like a day too long. shit sucks.
@zeta.zaza I am extremely lucky I predicted this would happen so I ripped every single personal model I've ever used for an extensive period of time, so I'm happy because now if I make personals they can't be ripped lol. Not like it was a problem before but its semi goated. Hate that the public can't really use public models to learn from though but honestly coming from an AVID TDA user please anyone reading this just do yourself a favor and switch to Booth. Learning, getting assets, and putting them together is so much more simpler and less stress than trying to repair someones mistake or a broken base for an avatar you really aren't gonna main that much lol.
-
@zeta.zaza I am extremely lucky I predicted this would happen so I ripped every single personal model I've ever used for an extensive period of time, so I'm happy because now if I make personals they can't be ripped lol. Not like it was a problem before but its semi goated. Hate that the public can't really use public models to learn from though but honestly coming from an AVID TDA user please anyone reading this just do yourself a favor and switch to Booth. Learning, getting assets, and putting them together is so much more simpler and less stress than trying to repair someones mistake or a broken base for an avatar you really aren't gonna main that much lol.
