vroid web view vrm decrypt

aes.cs

using System;
using System.Security.Cryptography;
using System.IO;
using System.IO.Compression;
namespace Vroid
{
    class Vroiddec
    {
        static void Main(string[] args)
        {
        	using (FileStream fs = new FileStream(args[0],FileMode.Open)) {
        		using (BinaryReader bs = new BinaryReader(fs)) {
        			int buff_size=(int)(fs.Length)-48;
        			RijndaelManaged rDel=new RijndaelManaged();
        			rDel.IV=bs.ReadBytes(16);
        			rDel.Key=bs.ReadBytes(32);
        			rDel.Mode=CipherMode.CBC;
        			byte[] resultarray=rDel.CreateDecryptor().TransformFinalBlock(bs.ReadBytes(buff_size),0,buff_size);
        			using(MemoryStream ms =new MemoryStream(resultarray)){
	        			using(GZipStream gzs=new GZipStream(ms,CompressionMode.Decompress)){
	        				using(FileStream df=new FileStream(args[0]+".dec",FileMode.OpenOrCreate,FileAccess.Write))
	        				{
			        			int data;
			        			while((data=gzs.ReadByte())!=-1)
			        			{
			        				df.WriteByte((byte)data);
			        			}
	        				}
	        			}
        			}
				}
			}
            log_msg("Done!");
        }
		static void log_msg(string msg)
		{
			Console.WriteLine(msg);
		}
    }
}

checkusersmodel.py

import requests
import os
import json
import argparse

USER_AGENT = "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/114.0"
HOST = "https://hub.vroid.com"
API_VERSION = "11"
def download_model_from_vroid(model_id, subdir=None):
    #model_path_base = os.path.join(
    #    subdir if subdir else args.directory, model_id)
    model_api_url = f"{HOST}/api/character_models/{model_id}"
    #print(model_api_url)
    return model_api_url
def get_user_model_ids(user_id):
    model_ids = []
    api_url = f"{HOST}/api/users/{user_id}/character_models?antisocial_or_hate_usage=&characterization_allowed_user=&corporate_commercial_use=&credit=&modification=&personal_commercial_use=&political_or_religious_usage=&redistribution=&sexual_expression=&violent_expression="
    page_num = 1
    while api_url:
        user_r = requests.get(
            api_url, headers={"User-Agent": USER_AGENT, "X-Api-Version": API_VERSION})
        if not user_r.ok:
            print(
                f"[user:{user_id}:page:{page_num}] got bad response from vroid hub, {user_r.status_code}")
            break
        user_j = user_r.json()
        if "next" in user_j["_links"]:
            api_url = HOST + user_j["_links"]["next"]["href"]
        else:
            api_url = None
        for model in user_j["data"]:
            model_ids.append(model["id"])
    print(f"[user:{user_id}] found {len(model_ids)} models")
    return model_ids
def download_user_from_vroid(user_id):
    user_api_url = f"{HOST}/api/users/{user_id}"
    user_api_r = requests.get(user_api_url, headers={
                              "User-Agent": USER_AGENT, "X-Api-Version": API_VERSION})
    if not user_api_r.ok:
        print(
            f"[user:{user_id}:api] got bad response from vroid hub, user might not exist, {user_api_r.status_code}")
        return
    user_api_j = user_api_r.json()
    username = user_api_j["data"]["user"]["name"]
    #user_base_path = os.path.join(args.directory, f"{username} ({user_id})")
    #if not os.path.isdir(user_base_path):
    #    os.makedirs(user_base_path)
    #json_path = f"{user_base_path}.info.json"
    #if args.write_info_json:
    #    with open(json_path, "w") as json_file:
    #        json_file.write(json.dumps(user_api_j["data"]))
    #    print(f"[user:{user_id}:api] wrote '{os.path.basename(json_path)}'")
    model_ids = get_user_model_ids(user_id)
    all_url=[]
    for model_id in model_ids:
        url=download_model_from_vroid(model_id)#, user_base_path)
        all_url.append(url)
    return all_url

if __name__ == "__main__":
    #parser = argparse.ArgumentParser(formatter_class=argparse.RawTextHelpFormatter)
    #parser.add_argument("-d", "--directory", type=str,
    #                    help="save directory (defaults to current)", default=os.getcwd())
    #args = parser.parse_args()
    #print(args.directory)
    #https://hub.vroid.com/en/users/36667771
    download_user_from_vroid(36667771)

dlhelp.py

#use project https://github.com/Pldare/vrh-deobfuscator/tree/MatchAndBatch
#use example
#python dlhelp.py users_id or vroid_model_view_url
import os,sys
import re
import checkusersmodel
import time

def dl_glb(url,sdir):
    print(url)
    os.system("node src/index2.js {}".format(url))
url=sys.argv[1]
if "http" in url:
    dl_glb(url,"model")
else:
    all_url=checkusersmodel.download_user_from_vroid(url)
    cou=len(all_url)
    idd=1
    for gurl in all_url:
        print("{}/{}".format(idd,cou))
        dl_glb(gurl,str(url))
        #time.sleep(0)
        idd+=1

VRoid Hub obfuscates the mesh of the preview models. You can read more on this here: https://toon.link/blog/1740863435/borrowing-intellectual-property.

Nice post!

I checked the differences between the downloaded VRM and the VRM in the browser, and found that the vertex coordinate data had undergone some transformations

true dude, I hope this will shows how it works:
https://toon.link/blog/1740863435/borrowing-intellectual-property

Hello everyone, you can finally use this project https://github.com/Pldare/vrh-deobfuscator/tree/MatchAndBatch to download all or a single model from your user's collection (this was mostly made for research purposes). If you like vroid model, please support model author.