I'm developing a VRChat ripping tool for public use, supporting both worlds and avatars. I've successfully extracted my own private avatar in offline mode.

loader.exe uses CreateRemoteThread to invoke LoadLibraryW and inject a DLL into the target process. The tool copies decrypted AssetBundle data for avatars displayed in-game directly from in-memory output buffers, rather than retrieving the cache protection key for \VRChat\Cache-WindowsPlayer.

The remaining task is EAC bypass. I plan to implement a BYOVD (Bring Your Own Vulnerable Driver)-based bypass, followed by online testing.