Gonso System
-
If i bought https://payhip.com/b/4M8Bv could someone decrypt it for me? i think my vrchat account possibly has been flagged in the gonso system, so if i buy it and upload it i think it will quit on me. i previously bought a avatar with gonso and it let me upload the pc version, but denied me from uploading the quest version. i think ill just waste my money if i upload it, and plus its nice to share with the community.
@devywevy honestly came here bc was having issues with gonso from her avis but she doesnt have gonso, none of hers do it looks like shes lying
-
@devywevy honestly came here bc was having issues with gonso from her avis but she doesnt have gonso, none of hers do it looks like shes lying
@JadenCross lying about having gonso on her avs is insane (if this is true)
-
@devywevy honestly came here bc was having issues with gonso from her avis but she doesnt have gonso, none of hers do it looks like shes lying
-
@JadenCross lying about having gonso on her avs is insane (if this is true)
@cybergothh turns out her new couple set says she has gonso on it but she doesnt, some of the newer ones she has doesnt have gonso but some of the old ones do, its kinda mixed up with this creator, and people in my server were talking about only some have it some dont even if they say it does.
-
@JadenCross hmm, do you have proof? not saying I think you're lying, but I don't wanna make a purchase I'm going to regret cuz I'm 100% flagged in the system
-
@cybergothh turns out her new couple set says she has gonso on it but she doesnt, some of the newer ones she has doesnt have gonso but some of the old ones do, its kinda mixed up with this creator, and people in my server were talking about only some have it some dont even if they say it does.
@JadenCross ohhh alright, maybe she just puts it there to scare off leakers? im not sure
-
@devywevy read what i said above^
@JadenCross so weird : / ty for the info!!
-
Could you tell me more about payhips system, and do sellers normally notify buyers before they purchase?
payhip's anti-leak is currently in closed-beta and requires a vouch directly from another creator that has it enabled to gain access - some creators do explicitly state that a package is protected by payhip's anti-leak, but i've seen that most do not
payhip's anti-leak works by injecting identifying bits into the unitypackage per buyer, generating a completely unique unitypackage for you as you click the download button
as far as i can tell, older versions of the anti-leak would edit files within the package like animations which would cause GonsoLicense to throw errors upon uploading; it seems now that isn't the case
i don't know very well how the anti-leak works right now. from my testing, it seems it no longer edits files within the package, and instead injects identifying hex-data into the unitypackage in specific places (of which seem to be very consistent across many payhip-signed packages); i'm working with Hal to develop a potential bypass for it, but we cannot make any promises
So basically itd be in my best interest to wait for decrypted avatars to be shared? (Im fine with that)
yes, this is unfortunately one of those situations where it's better to leave these processes up to those who know properly how to manage them; but understand that we also don't have infinite funds and the generosity of this community that donates their avatars and license keys cannot be understated
behind shady business practices are some very expensive "products" that likely aren't worth the price, and very commonly should not be "protected" by these things to begin with; the entire idea of giving a user encrypted, unmodifiable files of mostly kit-bashed assets is absurd in both conception and practice
@taikeru So if it injects data into the unity package, does this mean anything within the unity package is also traceable to the purchaser, or are we safe if we individually take everything necessary for an outfit, avatar, etc out of the project and then put it all back together in a new one?
(she/her)
-
@taikeru So if it injects data into the unity package, does this mean anything within the unity package is also traceable to the purchaser, or are we safe if we individually take everything necessary for an outfit, avatar, etc out of the project and then put it all back together in a new one?
@idkjustacat technically, you can mine specific assets; i just wouldn't put them back into the original unitypackage and instead build your own entirely
i admit i've been absent on researching payhip's method for a bit, but it regardless of what methods you use they cannot inject data that will remain injected if you were to take an FBX from unity to blender, modify it, and re-export it; as for the unitypackage itself i wouldn't be so sure that bypasses as the data payhip injects seems to be in an unused, but still persistent block of the byte data
there are ways to make a system that can persist tracking through this, but i highly doubt payhip is putting that much effort into theirs
ultimately, don't really take my word as the bible for anything - i'm still trying to verifiably figure out how payhip's thing works but don't have a lot of testing packages to go off of
// avid reverse engineer, long-time software developer
// "...culture shouldn't exist only for those who can afford it."
// - Hakita -
@idkjustacat technically, you can mine specific assets; i just wouldn't put them back into the original unitypackage and instead build your own entirely
i admit i've been absent on researching payhip's method for a bit, but it regardless of what methods you use they cannot inject data that will remain injected if you were to take an FBX from unity to blender, modify it, and re-export it; as for the unitypackage itself i wouldn't be so sure that bypasses as the data payhip injects seems to be in an unused, but still persistent block of the byte data
there are ways to make a system that can persist tracking through this, but i highly doubt payhip is putting that much effort into theirs
ultimately, don't really take my word as the bible for anything - i'm still trying to verifiably figure out how payhip's thing works but don't have a lot of testing packages to go off of
@taikeru My thought was that I could re-export the FBXs through Blender, and take the animations, controllers, textures etc out of the original unityproject and build my own project using those controllers, animations, FBXs and re-create the materials using the original textures. But it sounds like it's possible they could still track through that? Crazy.
(she/her)
-
@taikeru My thought was that I could re-export the FBXs through Blender, and take the animations, controllers, textures etc out of the original unityproject and build my own project using those controllers, animations, FBXs and re-create the materials using the original textures. But it sounds like it's possible they could still track through that? Crazy.
@idkjustacat as far as i can tell, it's possible but highly unlikely if you were to create a completely new project and rename anything important. your idea would probably work for the most part
not sure though, try it if you're interested; i'm always open to taking a look at unitypackages that are signed by payhip in efforts to discover what specifically they're doing
-
3 33soloe referenced this topic on
-
So I've discovered that in the case of Strawbunny's avatars you need a specific version of VRCFury installed otherwise Gonso is broken and throws an error loop of requiring logging into a validated vrchat account. I'm not sure if that could be used as an exploit but I just thought I'd share that info here.
-
So I've discovered that in the case of Strawbunny's avatars you need a specific version of VRCFury installed otherwise Gonso is broken and throws an error loop of requiring logging into a validated vrchat account. I'm not sure if that could be used as an exploit but I just thought I'd share that info here.
there have been other methods, simpler methods, of bypassing the system
this one uses task manager and is the most straightforward
my post uses Shadowcopy, an alternative that is more hands onboth are pretty future proof, there was one post (i can't find right now) that used VRCFury's "create editor test copy" function to compile a working, exportable version of the avatar
-
there have been other methods, simpler methods, of bypassing the system
this one uses task manager and is the most straightforward
my post uses Shadowcopy, an alternative that is more hands onboth are pretty future proof, there was one post (i can't find right now) that used VRCFury's "create editor test copy" function to compile a working, exportable version of the avatar
-
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol. I feel like its kind of illegal for Gonso to take personal information of users right. Is it true it takes your personal info?
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
-
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
Thank you for the informative reply! As someone who has purchased a Gonso licensed avatar recently (Akai by Strawbunny) I can confirm that some personal information is being logged as she was able to completely remove my ability to purchase avatars from her store no matter what email, discord, etc I entered into the payment box. I'm assuming that via Gonso she can track people's IP information and ban them in that way.
I've also read in other comments that Gonso can ping creators if someone shares their files and/or breaks the TOS.
-
Thank you for the informative reply! As someone who has purchased a Gonso licensed avatar recently (Akai by Strawbunny) I can confirm that some personal information is being logged as she was able to completely remove my ability to purchase avatars from her store no matter what email, discord, etc I entered into the payment box. I'm assuming that via Gonso she can track people's IP information and ban them in that way.
I've also read in other comments that Gonso can ping creators if someone shares their files and/or breaks the TOS.
it's unsurprising to me that the system has become as invasive as it is; a system of this type cannot function without being privacy invasive to an extent;
for the privacy concerned, it's simply more worth it to save your money, and your private data. creators' success is defined by community support, and you need to make an important decision about what you're willing to give up for some virtual pixels in a social game; it's ip logs now, but what will it be later?
-
it's unsurprising to me that the system has become as invasive as it is; a system of this type cannot function without being privacy invasive to an extent;
for the privacy concerned, it's simply more worth it to save your money, and your private data. creators' success is defined by community support, and you need to make an important decision about what you're willing to give up for some virtual pixels in a social game; it's ip logs now, but what will it be later?
Exactly. It's not only privacy invading but also extremely illegal for Gonso to have created this product that is marketed to protect creator's work. The crazy part is that creators swear by this and seem to not care that they are invading the privacy of those who buy their products simply to "protect" their work. I totally understand not wanting to have your work shared, ripped, etc but at the same time I feel that it's also an inevitability of being a creator.
If more avatar creators were open to the fact that people often share files not out of malice, but simply to share the artist's work with those who may not be able to afford it, I think things would be much improved. Also the freedom to be able to edit an avatar and truly make it your own is something that more creators should be open to.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better π
Register Login