You have like 2 options:
either you know ALOT about networking to the point you can intercept the VRCA from the VRChat servers before they get encrypted.
or you search the interwebs for old archives of avatars, your cache can also work if the specific character has been used prior to the implementation of the encryption.
[image: Capture.PNG]
Figured it out, for anyone wondering in the future, its literally just the auto footsteps for 3 and 4 point tracking that wasn't checked.