Nothing is more frustrating than the sewer rats who join worlds just to steal or rip other people’s avatars. A lot of us put ridiculous amounts of time, money, and effort into our avatars, so seeing that work taken by some parasite running a modified client is incredibly infuriating.

I’ve come across reports that there may be a modified VRChat client capable of partially or fully reconstructing or ripping DexProtect-protected avatars simply by being in the same instance as the protected avatar.

Just to be completely clear: I am NOT looking for this client so I can rip avatars or use it against anyone.

The entire purpose is defensive research. I’m trying to identify the specific client, module, or technique being used so it can be analyzed in a controlled environment. If we can understand exactly what the client is reading, capturing, or reconstructing from a protected avatar, we can figure out what weakness it is exploiting and hopefully improve DexProtect against both this attack and similar methods in the future.

If anyone has information, I’d really appreciate anything you can provide, including:

• The name/version of the modified client or module
• A copy of the client/plugin/module if you have access to it
• Filenames or SHA-256 hashes
• Screenshots or videos showing the ripping/reconstruction feature
• Logs or error messages it produces
• Whether it requires an EAC bypass
• Whether the protected avatar has to be unlocked before it can be recovered
• Whether the recovered avatar works normally outside of the modified client
• Whether it recovers everything or only certain parts, such as meshes, textures, animations, menus, parameters, PhysBones, Contacts, etc.
• Where the client/module is being distributed or discussed

Even something as simple as the name of the client, a screenshot, a filename, or where you heard about it could be extremely helpful.

Anything provided would be used strictly for defensive reverse engineering, vulnerability research, and improving avatar protection. The goal is to make life harder for the leeches who rip our avatars.

If you know anything but don’t want to post it publicly, feel free to message me privately in my DMs.

Any help is genuinely appreciated. Hopefully, with enough information, we can figure out exactly how this is being done and make protections stronger for everyone.