vroid web view vrm decrypt

aes.cs

using System;
using System.Security.Cryptography;
using System.IO;
using System.IO.Compression;
namespace Vroid
{
    class Vroiddec
    {
        static void Main(string[] args)
        {
        	using (FileStream fs = new FileStream(args[0],FileMode.Open)) {
        		using (BinaryReader bs = new BinaryReader(fs)) {
        			int buff_size=(int)(fs.Length)-48;
        			RijndaelManaged rDel=new RijndaelManaged();
        			rDel.IV=bs.ReadBytes(16);
        			rDel.Key=bs.ReadBytes(32);
        			rDel.Mode=CipherMode.CBC;
        			byte[] resultarray=rDel.CreateDecryptor().TransformFinalBlock(bs.ReadBytes(buff_size),0,buff_size);
        			using(MemoryStream ms =new MemoryStream(resultarray)){
	        			using(GZipStream gzs=new GZipStream(ms,CompressionMode.Decompress)){
	        				using(FileStream df=new FileStream(args[0]+".dec",FileMode.OpenOrCreate,FileAccess.Write))
	        				{
			        			int data;
			        			while((data=gzs.ReadByte())!=-1)
			        			{
			        				df.WriteByte((byte)data);
			        			}
	        				}
	        			}
        			}
				}
			}
            log_msg("Done!");
        }
		static void log_msg(string msg)
		{
			Console.WriteLine(msg);
		}
    }
}

any updates?

VRoid is now using ZSTD in place of GZIP. I wrote a Python script which handles the new decompression along with the decryption https://github.com/CetaceanNation/misc-scripts/blob/main/vroid-hub-downloader/vroid-hub-downloader.py#L52. If @Pldare completes their extraction code it would be nice to incorporate or at least add to my workflow.

i was able to get the model to at least import by modifying the import_gltf2_with_indices method of the blender vrm importer with

        json_dict['extensionsRequired'].pop(0)
        for i in range(len(json_dict['textures'])):
            if 'extensions' in json_dict['textures'][i]:
                json_dict['textures'][i].pop('extensions')

(it's just a dumb hack to remove the extension requirement)

However, the meshes seem to not be quite right

I will keep looking into this and update if I find more

Sorry for what might be an obvious question, but how can I implement this as well? Using Cetacean's new script, I was able to get a model, but I can't import it due to this extension requirement.

How to crack this extension?
Even skip this extension, the geometry is wrong as before. Any ideas?

Tried opening this on this model but the resulting VRM seems to have blanked out textures, is there something I'm missing or I'm using the incorrect endpoint?

I modernized the script a bit and documented a lot of things so everyone can understand how it works now (I used .NET 6.0 here).

using System.Security.Cryptography;
using System.IO.Compression;

namespace Vroid
{
    class VroidDecode
     {
         public static void Main(string[] args) 
         {

            // read the file from arguments, then get the binary representation
            var fs = new FileStream(args[0], FileMode.Open);
            var bs = new BinaryReader(fs);

            // VRoid Hub Encrypted VRMs usually have a the following data structure:
            // * The first 16 bytes is the Initialization Vector
            // * 32 bytes is the actual AES key
            // * The cipher is AES-CBC
            // * Then the rest of the VRM is Gzipped compressed for web transfer.
            // 
            // with this in mind, we now try to access those specific bits first.
            int bufferSize = ((int)fs.Length)-48;
            using Aes aes = Aes.Create();
            aes.IV = bs.ReadBytes(16);
            aes.Key = bs.ReadBytes(32);
            aes.Mode = CipherMode.CBC;

            // now everything is set, we now try to decrypt it!
            var decrypted = aes.CreateDecryptor().TransformFinalBlock(bs.ReadBytes(bufferSize), 0, bufferSize);

            // of course now we got the decrypted part, we still have to deal with the Gzip compression.
            var decryptedStream = new MemoryStream(decrypted);
            var decompressedStream = new GZipStream(decryptedStream, CompressionMode.Decompress);
            var finalStream = new FileStream(args[0] + ".dec", FileMode.OpenOrCreate, FileAccess.Write);

            int data;
            while ((data = decompressedStream.ReadByte()) != -1)
            {
                finalStream.WriteByte((byte)data);
            }

            Console.WriteLine($"Done! Saved as {args[0]}.dec");

        }
     }
}

I have downloaded a model from vroidhub in Feb 2021. all i got is a xs3 file. the model itself may be vrm or pmx format since it could display vmd motion online. and when i process the xs2 file with the cs code, things always go wrong. I wonder how to decypt this xs3 file correctly, could you give some suggestions? the files are here:https://github.com/TenjoinWai/symphony-miku/tree/main

Just think this will be helpful?
https://inside.pixiv.blog/2024/02/05/120000

Just think this will be helpful? https://inside.pixiv.blog/2024/02/05/120000

now i get a decrypted .bin file. it seems that this .bin file contains a pmx model and its textures and meshes. but i cannnot read this file. hope somebody could give me some suggestions. https://github.com/TenjoinWai/symphony-miku