The CryoLife Papers – Exporting and Pirating Avatars
by Alphaville Herald on 01/08/09 at 8:36 pm
Second Life piracy made simple
by Junius
CryoLife is a copybot client that can be used to steal copies of in-world Second Life content. CryoLife does not steal scripts, animations or gestures – the piracy potential is limited to prims, textures and clothing. These papers are a description of Cryolife use and detection, countermeasures that work, and anti-CryoLife approaches that amount to little more than wishful thinking.
Junius demonstrates CryoLife – and avoids theft – by ripping free hair and free skin template
Before you jump into the comments to call me names, know that I am writing these papers to strengthen the economy, not to hurt it. Every time a copybot program is mentioned in public I see posts asking those of us who understand the reality of piracy in virtual worlds to censor ourselves. While I understand that reaction, it is time to move past irrational fear and superstition. Silence is hurting the content creators and shop owners who keep Second Life going.
I am writing these papers because I can no longer willfully ignore the con artists who take advantage of hard working content creators by selling anti-copybot products that do not protect anything. A small industry has sprung up that is fueled on hysterical fear and ignorance of copybot and this has to stop. The veil of secrecy surrounding these programs must be lifted immediately. Business owners and content creators have been lied to for too long.
I'm sorry, but your content can not be safe from being copied and distributed. It is nonsense to blame Linden Labs for this. Blaming them is like blaming Comcast for letting you get Viagra spam.
The nature of online virtual mediums, for now, is that data is sent to your computer and your computer must render that data as 3D images. Anything that exists on your computer belongs to you, if you wish to take it. Someday this might change. Someday virtual worlds might become like TV where only the flat 2D image is piped to your computer, but that is years away from where we are now.
The Second Life community needs to stop panicking and come to gripswith reality. This is not going to cause the economy to crash. Content creators are not going to leave en masse over this. Goodcontent creators are stubborn folk. They put up with bad policies fromLinden Labs, greifers, insane customers and bugs all the time. Alittle piracy isn’t going to scare them. This is not the virtualapocalypse. It is the same reality you have been living your secondlives in all along. Nothing here is new.
Now, I’m not the kind of guy you would normally think of when you imagine somebody going around stealing things with CryoLife. I don’t sell CryoLife, in fact, I don’t sell anything, I don’t even work on commission.
I make things and I give them out full perms all the time. I’ve made weapons, vehicles, HUDs, particle spewers, RSS readers, you name it. I’ve dabbled in everything LSL. I don’t make the laggy crap you see in most of the LSL wiki libraries, either. I work hard to make clean, smooth running code. Some people take what I give them and sell it, but I don’t mind. Freebie sellers only alienate customers, and businesses like that never last long. I don’t give away anything that I personally did not make or that doesn’t have transfer perms.
I’m no open source activist – I just personally don’t feel that the business end of Second Life is worth my time. I love to make things and see people enjoy them. That is what drives me to create in Second Life. I have nothing against the business owners. They generate the revenue that pays the electric bill for all of this. I still buy things in SecondLife, even when stealing them is easy. I am writing this to help the business people, not to hurt them.
Obtaining CryoLife
I found out about CryoLife from the Herald’s interview with Nimrod Yaffle. The knowledge that it’s out there has been around for a while, but the Second Life Herald is where I heard about it first. It’s no state secret.
After about 30 minutes of searching I came up with a source who had the program. I convinced him to send it to me via Yahoo messenger for free. I did a similar thing last year to get copybot via MSN messenger. These things aren’t difficult to get. You just have to know how to use a search engine and be cool when you talk to the person who has what you want. If you complain that it’s hard to use or that it won’t copy scripts then you won’t get anything. It’s like buying pot: - just network your way in and stay cool or the dealer won’t give you what you want.
The CryoLife Experience
The file sent to me via Yahoo messenger was just a zip file of the contents of my suppliers SecondLife folder with the files already in place. I ran it after a couple of quick virus scans. It ran smooth and connected right away. I tried looking, but there doesn’t seem to be a mac version of Cryo. I’m running Windows Vista.
The first thing I noticed when I logged in was that it broadcasts to the world that I’m using it. On third party clients like Emerald my name tag turns blue and right after my name it says (CryoLife).
Cryolife has a radar, just like Emerald and Meerkat, and that radar detects other Cryo clients, just like Emerald and Meerkat. It even shows up on the Emerald radar that I’m using CryoLife. CryoLife has some fun features other than just the radar and the ability to copy things. It has a check box in the local chat window to show muted text, it can do fancy rainbow and multi selection particle effects, double click teleport and fun stuff like that, much like Emerald. These features are controlled from a window called HaxSwitch. The HaxSwitch window has some features that look like they are designed to crash people’s clients, but these features do not work.
Exporting Avatars
To pirate clothing off of an avatar you need to either take the textures or the clothing. Pirating the clothes is free, quick and easy. You just click, name the files and the clothes wind up in your inventory or on your hard drive in the form of .xml files ready for import.
Pirating the textures used to make the clothes is slower and costs 10L per texture to re-upload but it would be an attractive option for somebody who wants to modify their clothes. If you pirate the textures you can modify them or just re-upload them as is and use them to manually make clothes. This could be used to remix clothes that you already have.
For example, maybe you have a jacket or a shirt that doesn’t fix exactly how you want, or a more common problem would be that your shirt doesn’t come down far enough so there’s a gap between it and your pants. Perhaps it’s at the wrong clothing layer for the outfit you are trying to create. If you pirate the textures in it you can modify it on your own computer and re-upload it to any clothing layer you want. Whether you take the texture or the clothing, though, you get full access to the appearance menus like this so you can change the tint of the skin or the color of the clothing easily after it's ripped and you own it.
To pirate the textures you would right click the target avatar, go to more and select AvTextures. Ignore the Export option here. This will freeze your client. The AvTextures window will pop up and show all of the avatar textures in both baked and unbaked forms. From here you can click the blue dump button on the right and it will display each individual texture for you in its own window. To pirate the texture just change the focus to the window with the texture you want to take by clicking on it, go to file and select “Save texture as…” and save it. This method also works on temporary textures if an avatar is wearing a temporary texture as clothing, but it won’t save you any L$s, since you still have to pay to re-upload the texture.
Pirating Avatars
The fast way to pirate an avatar is in the third pie menu where you can select jClothing. This will open a jClothing menu where you can select which individual layers of clothing you want to take and how you want to take it. You can take it by copying to inventory or by exporting the textures and body parts. At the bottom you have options to export all or copy all to inventory. This process is very fast. In the wild it’s really the only way to go. You can rip the clothing quickly from unsuspecting avatars and later on in the privacy of an empty sandbox you can rip the textures from the clothing you have already taken.
Copying to inventory is a problem when taking clothes because when you copy body parts, skin and non-prim avatar hair to your inventory you will automatically wear them. It becomes obvious that you are copying somebody’s avatar when you start to turn into them right in front of them. If you are caught you will probably get ARed and banned from the sim. If you copy to inventory the items will show up in your inventory with the names “[avatar name] Eyes” or Shape or Skin, or whatever. The client IMs you the message “rip completed” for each item you copy directly to inventory.
Exporting is the stealthy way to do it. When you export you don't wear your targets avatar. Export just copies the avatar to your local hard drive. When you click it you will get a window asking you to name the items you are about to take. If I want Bobs avatar I might type “Bob” here and CryoLife will append “eyes”, “hair”, “shirt”, etc., to the end of whatever I type in the file name window. In main chat the client IMs you with “ripping [avatar name] Shape to inventory.” When it is done you will get the message “ripped all clothing”.
To export a primor an attachment you have to right click the item and go to the thirdpie menu. Here you will find the “Export” option (It’s ok, exportworks on objects. Just don’t try to use it when the avatar is selectedor you will freeze up.). The zTake option on this menu doesn’t seem todo anything. When you click export you will get a window asking youwhere you want to save the object on your local hard drive. Give it aname and click OK.
[in part 2 and part 3 of The CryoLife Papers, Junius covers copying prims, stealthy CryoLife use, how to identify a CryoLife copier, and effective counter measures - the Editrix ]
Phox
Aug 1st, 2009
You’re mistaken, CryoLife can copy animations and gestures easily, it can also modify the permissions of existing items, and change creator information.
You have no idea how to correctly use this client, you’re missing out on all of the features that make it different from your typical copybot.
I guess that’s what happens when you get a client from a leaked source.
Junius
Aug 1st, 2009
Phox: If that is true then show me that I’m wrong. I can admit when I’ve made a mistake if you prove it. Provide photographic evidence of your claims and document the method or else you are no better than the rest of the fear-mongers out there spreading hysterical lies.
Alyx Stoklitsky
Aug 1st, 2009
What what Pattehphox said.
Anonymous
Aug 1st, 2009
Linden Labs recently made CryoLife disfunctional in many aspects. For one, animation stealing doesnt work anymore due to the fact that free uploads was patched by Linden Labs. Other functions, that are normal to Second Life, like normal uploads, do not work anymore since the server version changed and the client is based on 1.22.11. Most likely, users will not be able to enter Adult sims. Baked Texture will not work once Linden Labs switches to capability for baked textures and capabilities for inventory. Thus, CryoLife will be no more, since the creator is not developing the client anymore. The creator is greatly sorry for the leak of this client, since it was only intented for friends that do not copybot for money or to steal, but to back-up their avatars.
Susan Tsuki
Aug 1st, 2009
Build one that can copy scripts by black box analysis and that would be news.
LordGregGreg Back
Aug 1st, 2009
This post makes cryo look pretty bad.. so, let me flip the page and give you an update.
Cryo has discontinued work on cryo life, and has instead dedicated his efforts constructively. Although the past client he had was bad, that was then. Now he is an invaluable asset to the greenlife team, and everyone who uses it. His knowledge of some of the more evil things allows him to effectually protect emerald from as many attacks as possible.
I would like to encourage people to judge based on current actions, not the past.
Bah
Aug 2nd, 2009
These things about parts of CryoLife’s copy tools not working anymore are all lies because Linden Labs only hires Stalinists. I read that on a blog somewhere.
Katey
Aug 2nd, 2009
If you really cared more about protecting content creators, you’d have been more upfront with these mysterious effective counter measures.
Junius
Aug 2nd, 2009
Katey: Don’t worry, the countermeasures are in the second and third installments. The article was 9 pages single spaced so Pix had to cut it up a bit for this format.
LordGregGreg: Thanks for the update. I honestly don’t know much at all about the history of how this program was written. I hold you and the rest of the Emerald team in the highest regard. You are making a great client, and its clothing layer protection is the best defense against this that I have found so far. Other clothing layer defenses work, but Emerald will be the easiest to implement on a broad scale because of it’s attractiveness to the average user.
I don’t judge Cryo at all for making this. Every coder should test systems for vulnerabilities like this. The program was probably innocently leaked out by accident, but that doesn’t change the fact that the ethical thing to do with it now is to fully expose it to the world. The problems of security through obscurity are well known and documented. We’ve let flamers and trolls keep us silent for too long and as a result people have lost countless digital assets through piracy and deception.
Whether or not this particular client will still function in the same way after the 1.23 client becomes mandatory is irrelevant. The code to do this is widely known among developers and will be implementable on newer clients. The ability to implement this and compile a client is not a skill limited to elite coders. More information on that is forthcoming. Cryo was not the first person to code this kind of thing and he certainly won’t be the last.
Perhaps I could have taken the time to get a current, more dangerous copybot client to write about. That might have been more exciting for you to read about but I decided that it isn’t necessary. The subject at hand is the capabilities of these programs and what that means to the creative class in SecondLife. This has to be discussed here, in public, not hidden in the SLDEV mailing list, which most people don’t know about and couldn’t follow even if they did.
LordGregGreg Back
Aug 2nd, 2009
“If you really cared more about protecting content creators, you’d have been more upfront with these mysterious effective counter measures.”
thus letting every script kiddie know how to crash people. no thx. counter measures are private for the protection of thoes without protection.
Junius
Aug 2nd, 2009
Don’t worry, Greg, I won’t give out that kind of countermeasure. I gave out countermeasures that creators and merchants can use to protect their goods. You’ll see what I mean.
LordGregGreg Back
Aug 2nd, 2009
and yes, its very important for content creators to understand that the permissions system is both technically, and inherently flawed.
Inherently because people can always steal stuff that is sent to their computer, textures, animations, anything.
and technically as well, as even stuff that should never be sent, like scripts.. yeah.
Your only option is to get used to it. This is the digital age and you must be prepared for someone to steal your work. Every web page maker in existence understands this.
Cryolife features some of the basic features of stealing, just in a user friendly manner, please understand that making sl closed source, banning all cryo life people, etc, will not solve the inherently flawed issue, your content is still sent, anything bad on the other persons computer can get at it. (sorry, rant from a jira im discusted at)
Keep in mind that a program that can steal, is not illigal untill someone uses it to steal. (granted, its still not very nice..)
The solution is what it has always been. find the bastards that abuse it, and get them in jail. Cryo and I will be working in emerald and other programs to help in this matter, till then, manual detection still works pretty well too.
Alyx Stoklitsky
Aug 2nd, 2009
>If you really cared more about protecting content creators, you’d have been more upfront with these mysterious effective counter measures.
All that normally does is render said counter measures useless. Duh.
unknown
Aug 2nd, 2009
There are better than cryo. You need to catch up.
Ebaumsworld
Aug 3rd, 2009
Oh lawdy secondlifeherald. slowpoke is slooooow
mars
Aug 3rd, 2009
You said you only learned of it from the herald, now you are teaching more people.
Tell people how to stop it, not how to GET IT.
Now every unskilled newb will take your article about getting it, and go freebie red grave skins all day long.
Obvious Schism
Aug 4th, 2009
“Someday virtual worlds might become like TV where only the flat 2D image is piped to your computer, but that is years away from where we are now.”
Actually, a company called Vollee was doing this years ago, albeit to mobile devices.
Thelius
Aug 22nd, 2009
The first person to actually write the first import/export (copybot system) was actually a hack discovered by Nexis from the PN, possibly even someone before him by altering a SLBot program.
Then you had Discrete code it into the actual viewer, then you had Jcool410, or Jay as he is known to everyone at Bug Island, who implemented it into VLife. The later versions of VLife known as Onyx actually have one button avatar export, textures, shape and all prims. Too bad you have to pay for uploads now that LL broke the system for it, thanks to the leak of CryoLife. Not to mention, the best part is, it shows the hack work by Linden Labs to actually protect their sellers, or any of their residents from these type of hacks due to the obvious reason that LL actually is aware of the systems since they had a version of Cryo actually posted to them. Jay from South Carolina has actually acheieved a permissions hack that actually changed an entire object including the scripts and the original owner to a full permissions version that he was able to take and then give away at his leisure.
Where is the logic in actually posting that these things should actually be exploited when they are financial gain for the hacks, such as Jay selling his viewer for 50k Lindens to anyone who is willing to pay it? Not to mention, he will tell it to anyone at Bug Island? Janius and LordGregGreg, you are both saying that countermeasures should be exclusive to anyone that finds them, but are defending an obvious copybot system that is actually sold for money.. This makes no sense.
FAILNESS
Aug 24th, 2009
This post sucks, you did your work wrong.
CryoLife indeed steals EVERYTHING but scripts. One may steal animations, gestures, and etc they own by dropping them in a notecard > save > drag it out.
Enjoy.
LordGregGreg Back
Aug 31st, 2009
Mmm, developments.
i accurate way to detect cryo life that goes beyond any plugin mask or any of that crap.
(please use this because im sick of people banning people who use my proxy without cryo life -.-)
https://www.xstreetsl.com/modules.php?name=Marketplace&file=item&ItemID=1738925
waltdisneys cryotank
Sep 15th, 2009
I stole a copy of this news article using ctrl+c
Lisa
Sep 29th, 2009
I’ve read the three articles, and thank you for providing a thorough disserte’ on the ins and outs of how at least this viewer can be used by pirates. Repeatedly you refer to creators (like myself) protecting themselves. It seems the only practical suggestions you make that might address this are to use the Emerald viewer and sell attachments with a prim puke in the box so the attachments will be protected. You make it fairly clear that at least CryoLife can get around every other protection out there, piracy WILL happen, and there is so far nothing that can be done about it, and likely nothing long-term effective ever will be able to be done about it without changing the very nature of the internet itself in ways most of us wouldn’t like. So how, practically speaking, can a seller “factor in piracy” effectively? I ask this because I am a new creator and new business person in SL and would like to know what measures I can take to protect my business from going under in the inevitable event that someday someone wants to pirate something I’ve made. I accept that piracy does happen, will happen, and my “intellectual property” belongs to me only in my little head, my little imaginary universe. In the real world, and its extension, Second Life, anyone can steal anything I make and sell it as their own. Great, having accepted that, now how do I keep this from ruining my business later on down the line? Prim Puke only protects attachments. It does not protect houses, furniture, gadgets. It does not protect skins, shapes, system clothing. It does not protect gestures, animations or sounds. Using the Emerald viewer may protect me from having my stuff stolen off my avatar when I’m inworld, but I’m unclear how it protects me from a pirate stealing my stuff off an avatar who is not using the Emerald viewer. I might have gotten confused amongst the unfamiliar territory and wealth of information presented in your articles, so please don’t take my tone to be critical at all. I really need to know these things and would appreciate any input you can send me. I would prefer to have the reply, if you are willing to take the time to reply, sent to my email rather than posted here, as I’m not even sure I’ll find my way back to this site again anytime soon. In case you don’t see my email, its bdr_design@yahoo.com. Needless to say, its also not necessary to post this epistle on the site, I just have no other way to get ahold of you and you seem rational enough and informed enough to at least give me some starter points for future reference. Thank you!
molly
Oct 15th, 2009
i have read this article and it is very well writen so far but where is the sound and animations part of the article
mosqitoo
Oct 18th, 2009
how can get it, how can ı use it pls…. thank you
Muziekfreak1980 miles
Nov 13th, 2009
Im a merchant/Creator in sl since beginnin 2007.
There many ways to steal content, Cryolife as far is my knowledge goes about this client. Does not STEAL animations/gestures. It enables you to change permissions and thats something that i do see as a VERY WELL KNOWN choice of the creator of Cryolife.
One said here “do not judge someone on the past actions, but the present” So when a killer goes back to school in rl, we should set him free. Afterall his actions WERE in the past. Common do not give me that kind of hypocritical bullocks. In second life there more then one way to steal
How about GLintercept? It is not even a client free to download, some fiddling in the config file. And with one shortcut you rip a entire sim including avatars.
How bout Copybot, easy way to rip buildings, avatars and still easy to find.
My point? It will never stop, does not matter how much the try or do. Sl is opensource and thus a invitation for piracy. And the worst part is LL does not give a crap at all. The see there numbers go up that is all what the care about. The big companies that juice them..
Dimitrov
Dec 19th, 2009
Lol what a fucking douche bagger Pixie is. ” It’s like buying pot: – just network your way in and stay cool or the dealer won’t give you what you want.” You’re a child.
For those wondering, the one who wrote the code for VLife now called Onyx as previously mentionned was walking around under the name Jcool410 Wildcat
but now is Fractured Crystal and hangs at ‘Emerald Point’ sim pretending to be innocent with his banhappy face when he’s actually the biggest mushroom-headed faggot there is. Alot of people know how code better than this idiot does. He is simply doing it in a so-called ”Virtual World” filled with uneducated retards who failed at school.
You suck.