VRChat added VRCA (?maybe VRCW too) protection

[Aloof]

This post is deleted!

[Aloof]

This post is deleted!

[admin]

Please stick to the original topic, thanks

[cheatdev]

Just saw this site on the same guy, can anyone confirm if it works? I don't know where to get the key
https://uabd.eeacks.cc/

[StinkerGuy115]

@cheatdev No idea. Cool find but unfortunately kinda useless though as it is asking for a key which is what this entire thread has been discussing how to find.

[cheatdev]

@StinkerGuy115 That's sad, I have a set of avis that I want to decrypt. wish there is easy way to get keys.

[CrystalDust]

@cheatdev only works for your won avatars or aka the __data keys VRCX IS THe only thing u can use to get your own keys mainly

[CrystalDust]

assetUrl https://api.vrchat.cloud/api/1/file//2/variant/security example of what i mean vrcx is reading from

or its making an api call to find this data just and idea maybe someone with some idea can code to do this idk
{
"id": "...",
"name": "...",
"assetUrl": "...",
"unityVersion": "...",
"version": 3,
"assetVersion": {
"platform": "standalonewindows",
"assetUrl": "...",
"unityVersion": "...",
"unityPackages": [ ... ],
"plugin": {
"pluginVersion": "2020.4.XXf1",
"platform": "standalonewindows",
"encrypted": true,
"encryptionKey": "=" <--
}
}
}
so idk this just idea info

[StinkerGuy115]

@crystaldustie Yea unfortunately the specific TCP stream that handles the avatar download and exchange is encrypted with TLS 1.2 Meaning we would need THOSE keys too lol. I am pretty sure it uses the PhotonEncryptorPlugin.dll for the TLS encryption because it makes a bunch of calls to bcrypt.dll for key generations, HTTPS encryption and such.

But what exactly encrypts the model is likely in the GameAssembly.dll this one has stuff for AesManaged encryption/decryption and such.

[StinkerGuy115]

Adding this in a second comment but just an observation. When you start up VRChat.exe and you try to load the Public avatars it still fetches them online. It still creates a __data file in your cache folder, yet the unencrypt vrca's for them are in C:\Program Files (x86)\Steam\steamapps\common\VRChat\VRChat_Data\StreamingAssets\Avatars

This has been there before the encryption update. I thought they were there cause the game devs just wanted people to have models that they can use when theyre testing out stuff in the game running it directly from the exe.

Yet it still makes server requests to download them and encrypt them when theyre unencrypted and just sitting their on your PC? The game also does not use PhotonEncryptorPlugin.dll running from the exe, looking at procmon, but only calls GameAssembly.dll

Just kinda weird idk, why download the files from a server if theyre already on your PC? Why still encrypt them?

[StinkerGuy115]

Okay third and final comment, this is my proposal of whats going on based on what ive observed:

GameAssembly.dll is used for model encryption locally on your machine. PhotonEncryptoPlugin.dll in conjuction with bcrypt.dll is used for TLS stream encryption and generating "public use" keys for people getting an avatar thats not theirs (wearing an avatar is what i mean).

This lines up with their new market announcement which sells the ability to use the model. It generates a key that is determined likely by the usr_id and some padding.

Basically: Are you avatar uploader? You get a more special key. Are you not? You get a public use key.

You get approval for it to load on PC, game decrypts and encrypts with functions in the GameAssembly.dll

Just my hunch from my observations, keys are likely associated with user_id. Thanks for coming to my TedTalk

[bruhe121]

It's so over...

[DeepDishBussy]

Love how VRChat only started to give a shit about ripping when them getting money was involved

[Visaeres]

@DeepDishBussy They cared about it before that...lol

[SeraphicRoses]

@DeepDishBussy only for most creators to hate the marketplace because vrchat takes 50%

[DeepDishBussy]

@Visaeres Not really, they only added cache encryption shortly before they added the marketplace.

[Metafalica]

isnt it possible to rip mesh and texture data directly from gpu?

[StinkerGuy115]

@Metafalica Technically, if youre thinking of a ripper tool like NinjaRipper for example, youd have to still inject it to the game, so bypass anti cheat (linux method does work). Then even if you do rip like that you are just left with like raw mesh and textures.

You would have to assemble the meshes and rig them. stuff like toggles, animations, bones, rigs, and more would not be ripped.

Asset Ripper would essentially extract the data from the __data file (or .vrca/.vrcw files) and output all the contents in a UnityProject format with toggles, animation, prefabs, shaders, etc.

[Visaeres]

@DeepDishBussy Yeah no. And you can be mad all you want, They cared before they did the encryption bs. Kinda the reason all of you guys are running around like headless chickens lol

[DeepDishBussy]

@Visaeres I never said I was mad?? I see where you are coming from abt them caring but many people feel they did not care enough since this was added shortly before the marketplace was introduced. it feels like they only care for the paycheck with the timing.