Gonso System
-
Could you tell me more about payhips system, and do sellers normally notify buyers before they purchase?
payhip's anti-leak is currently in closed-beta and requires a vouch directly from another creator that has it enabled to gain access - some creators do explicitly state that a package is protected by payhip's anti-leak, but i've seen that most do not
payhip's anti-leak works by injecting identifying bits into the unitypackage per buyer, generating a completely unique unitypackage for you as you click the download button
as far as i can tell, older versions of the anti-leak would edit files within the package like animations which would cause GonsoLicense to throw errors upon uploading; it seems now that isn't the case
i don't know very well how the anti-leak works right now. from my testing, it seems it no longer edits files within the package, and instead injects identifying hex-data into the unitypackage in specific places (of which seem to be very consistent across many payhip-signed packages); i'm working with Hal to develop a potential bypass for it, but we cannot make any promises
So basically itd be in my best interest to wait for decrypted avatars to be shared? (Im fine with that)
yes, this is unfortunately one of those situations where it's better to leave these processes up to those who know properly how to manage them; but understand that we also don't have infinite funds and the generosity of this community that donates their avatars and license keys cannot be understated
behind shady business practices are some very expensive "products" that likely aren't worth the price, and very commonly should not be "protected" by these things to begin with; the entire idea of giving a user encrypted, unmodifiable files of mostly kit-bashed assets is absurd in both conception and practice
@taikeru So if it injects data into the unity package, does this mean anything within the unity package is also traceable to the purchaser, or are we safe if we individually take everything necessary for an outfit, avatar, etc out of the project and then put it all back together in a new one?
(she/her)
-
@taikeru So if it injects data into the unity package, does this mean anything within the unity package is also traceable to the purchaser, or are we safe if we individually take everything necessary for an outfit, avatar, etc out of the project and then put it all back together in a new one?
@idkjustacat technically, you can mine specific assets; i just wouldn't put them back into the original unitypackage and instead build your own entirely
i admit i've been absent on researching payhip's method for a bit, but it regardless of what methods you use they cannot inject data that will remain injected if you were to take an FBX from unity to blender, modify it, and re-export it; as for the unitypackage itself i wouldn't be so sure that bypasses as the data payhip injects seems to be in an unused, but still persistent block of the byte data
there are ways to make a system that can persist tracking through this, but i highly doubt payhip is putting that much effort into theirs
ultimately, don't really take my word as the bible for anything - i'm still trying to verifiably figure out how payhip's thing works but don't have a lot of testing packages to go off of
// avid reverse engineer, long-time software developer
// "...culture shouldn't exist only for those who can afford it."
// - Hakita -
@idkjustacat technically, you can mine specific assets; i just wouldn't put them back into the original unitypackage and instead build your own entirely
i admit i've been absent on researching payhip's method for a bit, but it regardless of what methods you use they cannot inject data that will remain injected if you were to take an FBX from unity to blender, modify it, and re-export it; as for the unitypackage itself i wouldn't be so sure that bypasses as the data payhip injects seems to be in an unused, but still persistent block of the byte data
there are ways to make a system that can persist tracking through this, but i highly doubt payhip is putting that much effort into theirs
ultimately, don't really take my word as the bible for anything - i'm still trying to verifiably figure out how payhip's thing works but don't have a lot of testing packages to go off of
@taikeru My thought was that I could re-export the FBXs through Blender, and take the animations, controllers, textures etc out of the original unityproject and build my own project using those controllers, animations, FBXs and re-create the materials using the original textures. But it sounds like it's possible they could still track through that? Crazy.
(she/her)
-
@taikeru My thought was that I could re-export the FBXs through Blender, and take the animations, controllers, textures etc out of the original unityproject and build my own project using those controllers, animations, FBXs and re-create the materials using the original textures. But it sounds like it's possible they could still track through that? Crazy.
@idkjustacat as far as i can tell, it's possible but highly unlikely if you were to create a completely new project and rename anything important. your idea would probably work for the most part
not sure though, try it if you're interested; i'm always open to taking a look at unitypackages that are signed by payhip in efforts to discover what specifically they're doing
-
3 33soloe referenced this topic on
-
So I've discovered that in the case of Strawbunny's avatars you need a specific version of VRCFury installed otherwise Gonso is broken and throws an error loop of requiring logging into a validated vrchat account. I'm not sure if that could be used as an exploit but I just thought I'd share that info here.
-
So I've discovered that in the case of Strawbunny's avatars you need a specific version of VRCFury installed otherwise Gonso is broken and throws an error loop of requiring logging into a validated vrchat account. I'm not sure if that could be used as an exploit but I just thought I'd share that info here.
there have been other methods, simpler methods, of bypassing the system
this one uses task manager and is the most straightforward
my post uses Shadowcopy, an alternative that is more hands onboth are pretty future proof, there was one post (i can't find right now) that used VRCFury's "create editor test copy" function to compile a working, exportable version of the avatar
-
there have been other methods, simpler methods, of bypassing the system
this one uses task manager and is the most straightforward
my post uses Shadowcopy, an alternative that is more hands onboth are pretty future proof, there was one post (i can't find right now) that used VRCFury's "create editor test copy" function to compile a working, exportable version of the avatar
-
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol. I feel like its kind of illegal for Gonso to take personal information of users right. Is it true it takes your personal info?
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
-
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
Thank you for the informative reply! As someone who has purchased a Gonso licensed avatar recently (Akai by Strawbunny) I can confirm that some personal information is being logged as she was able to completely remove my ability to purchase avatars from her store no matter what email, discord, etc I entered into the payment box. I'm assuming that via Gonso she can track people's IP information and ban them in that way.
I've also read in other comments that Gonso can ping creators if someone shares their files and/or breaks the TOS.
-
Thank you for the informative reply! As someone who has purchased a Gonso licensed avatar recently (Akai by Strawbunny) I can confirm that some personal information is being logged as she was able to completely remove my ability to purchase avatars from her store no matter what email, discord, etc I entered into the payment box. I'm assuming that via Gonso she can track people's IP information and ban them in that way.
I've also read in other comments that Gonso can ping creators if someone shares their files and/or breaks the TOS.
it's unsurprising to me that the system has become as invasive as it is; a system of this type cannot function without being privacy invasive to an extent;
for the privacy concerned, it's simply more worth it to save your money, and your private data. creators' success is defined by community support, and you need to make an important decision about what you're willing to give up for some virtual pixels in a social game; it's ip logs now, but what will it be later?
-
it's unsurprising to me that the system has become as invasive as it is; a system of this type cannot function without being privacy invasive to an extent;
for the privacy concerned, it's simply more worth it to save your money, and your private data. creators' success is defined by community support, and you need to make an important decision about what you're willing to give up for some virtual pixels in a social game; it's ip logs now, but what will it be later?
Exactly. It's not only privacy invading but also extremely illegal for Gonso to have created this product that is marketed to protect creator's work. The crazy part is that creators swear by this and seem to not care that they are invading the privacy of those who buy their products simply to "protect" their work. I totally understand not wanting to have your work shared, ripped, etc but at the same time I feel that it's also an inevitability of being a creator.
If more avatar creators were open to the fact that people often share files not out of malice, but simply to share the artist's work with those who may not be able to afford it, I think things would be much improved. Also the freedom to be able to edit an avatar and truly make it your own is something that more creators should be open to.
-
Questions how I know if an avi has gonso in it tho? Once imported. ?
-
tl;dr
Well shit. Who would have thought the way to break Gonso was to chuck a brick at Unity in the task manager lol.
yeah, felt that
I feel like its kind of illegal for Gonso to take personal information of users right.
depending on jurisdiction
Is it true it takes your personal info?
probably
not tl;dr
I feel like its kind of illegal for Gonso to take personal information of users right
depending on the jurisdiction, yes; in many countries, you are only permitted to log non-identifying information (HWID hashes, unity version, etc.)
depending on the jurisdiction, again, logging IPs can be illegal, and in many others, logging anything outside of what Unity has access to (real name, MAC address, user folder paths, etc.) is illegal if the system or its creators:- do not ask you for consent (GDPR, mostly Europe) [1]
- do not explicitly give you an option to opt-out (CCPA, California)
- make the data it logs from you, available to you (PIPEDA, Canada)
[1] most creators chuck a warning that the avatar uses GonsoLicense in the description, so by purchasing the avatar, the consumer would have effectively given consent for the system to do what it does. this is a gray area between 'consent upon purchase' and 'consent to the system itself' where consent may be assumed for the system to be used in general, but perhaps not for private data to be collected. this changes per jurisdiction
i must make it clear that this is an overview of what could potentially be wrong with this system, due to GonsoLicense not being a "registered" company or business this might fall into a legal gray area and all of these points may not even apply; but given this system is tied directly to commercial business on actual storefronts, it would not put out of the question that it is breaking some privacy laws (and there is definitely something to be said about it infringing on payhip/gumroad/jinxxy/etc. TOS)
(p.s. i am not a lawyer, i am a cybersec worker. please verify any ""legal advice"" adequately - i just try to do my research where it matters)
to put it generally: if an obfuscated asset DLL collects and logs identifiable or system-level information without clear disclosure or user consent, it could be in violation of privacy laws depending on jurisdiction - so check your state/country's laws and make the proper reports if you feel there's verifiable threat to privacy
Is it true it takes your personal info?
i don't know, i haven't purchased a GonsoLicense avatar for a very long time now; but users on this forum have been mentioning that it does collect logs of IPs and possibly more identifiable information
the best ways to check this would be to deobfuscate and decompile the DLLs, the same as i used to do when i was decrypting these avatars (ConfuserEX at the time, not sure if its changed since then)
you might also check packet data of your network with wireshark or other network tools to see if there's anything fishy with thatto go further
this only covers the privacy infringements - there are other consumer and business laws regarding digital and physical product delivery that may be violated here, but i haven't taken the time to research that much; i mostly do cybersec
-
if his system wasn't so good at being a nuisance and said creators were not profiting so much off of it, perhaps the creator community would be a better one
pipe dreams, eh?
-
i've transitioned into 100% making my own assets and bases, and i'm glad i've done so; "the market will decide," and it consistently decides on the worst
let's be honest, though - this entire statement is an overplayed, broken record
i'll take the moment to thank the good users that helped with the first few decrypts i performed, and to those who do without real malicious intent; we're all fighting over some vertices at the end of the day
-
i've transitioned into 100% making my own assets and bases, and i'm glad i've done so; "the market will decide," and it consistently decides on the worst
let's be honest, though - this entire statement is an overplayed, broken record
i'll take the moment to thank the good users that helped with the first few decrypts i performed, and to those who do without real malicious intent; we're all fighting over some vertices at the end of the day
@taikeru said in Gonso System:
i've transitioned into 100% making my own assets and bases, and i'm glad i've done so; "the market will decide," and it consistently decides on the worst
let's be honest, though - this entire statement is an overplayed, broken record
i'll take the moment to thank the good users that helped with the first few decrypts i performed, and to those who do without real malicious intent; we're all fighting over some vertices at the end of the day
LMAFO, sum vertices has my dying
-
But i heard it logs your ip and basically flags you to creators?
unconfirmed, but given the closed-source nature of the system i wouldn't put it out of the equation - so far though Gonso himself has told me directly (and proven to me) that he does not have interest in logging IPs; as far as i can tell that remains the case now
What happens to a model with gonzo if the creator no longer uses gonzo?
hopefully, like Whituu's Sakura from a while ago, it is simply updated for the purchasers to not have the system in the package; otherwise it's just up to the creator to do that themselves
And, how does one manually remove gonzo?
this one is an involved process. there isn't a singular way to remove this system, and there is definitely not a simple way to do so without a decent handle on programming and cybersec tools
both @halcyon and i have worked on ways to get around this and she still works on them now; i just help with code stuff occasionally as i've mostly lost interest in it
it boils down to a few methods:
- the first, is to decompile the GonsoLicense DLL (most versions are obfuscated with ConfuserEX - it's very easy for a user to see this by loading the DLL into something like Ghidra or DnSpy); and once you've obtained the source code, you can write your own Unity scripts to "fake" requests to the API, basically copy-pasting the
Decryptmethod so it can be decrypted manually with the key from the API- there was a tool developed by a few acquaintances of mine that circulated around this forum a while ago; it was based off of my original methods and code that ended up being heavily edited for public use
- the second is to hijack the Unity process and "stall" it while the Licenser does its tricks. the drawback of GonsoLicense is that it has one major flaw: Unity cannot load or upload encrypted files. at some point during the upload process, these files have to be decrypted to be packaged - giving users a small window in which they can grab the files if they can get around Unity's directory locking. while simpler on paper, Unity's directory lock is pretty robust and isn't easy to bypass
Personally dont believe it but why lie to your buyers?
money. i wish i could say most creators using the GonsoLicense system are doing it without malicious intent, but the bottom line is many of them are looking for quick ways to maximize their profit margins for mediocre avatar work (not the case for all, but many), where some creators like Strawbunny don't even do most of the work and outsource it - there's a reason you don't see larger, more confident creators using the system (to name a few, such as Godfall and Nikkie) - the quality of their work speaks for itself (and is usually worth the price); most importantly their interaction with the community they've built doesn't give many users a reason to maliciously steal their products
it's all business practices, and predatory ones at that
i'm aware specifically for Birdy's case that they did actually stop using Gonso, but released the non-GonsoLicense'd package under a completely separate listing on their Gumroad. whether they forced previous buyers to re-buy it or not is unknown to me
feel free to ping myself or @halcyon for more answers - we're happy to help
- the first, is to decompile the GonsoLicense DLL (most versions are obfuscated with ConfuserEX - it's very easy for a user to see this by loading the DLL into something like Ghidra or DnSpy); and once you've obtained the source code, you can write your own Unity scripts to "fake" requests to the API, basically copy-pasting the
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login