Hand-written 32-bit trampoline, built at runtime to patch absolute targets. The stolen instructions load esi=a1/eax=a2 from the stack, so they run fir

Runtime 32-bit trampoline. At RecvPkt entry the stack is [esp]=ret, [esp+4]=a1, [esp+8]=a2 (the netpacket). We snapshot a2, call the observer, then ru

Trampoline: run stolen bytes, then read CUser from [ebp+8] and call the capture hook, then resume. ebp is already valid at the hook point. <stolen: pu

Build the raw CM wire bytes for a 819 response: [EMsg|protoflag][hdrLen][header] [body], matching the CProtoBuf packet framing the wrap function expec

Session capture.

<summary> Checks GitHub releases for a newer version. Returns null on any failure (network, parse, etc.) -- callers treat null as "no update / check f

Directory cleanup

Search cloud for all stats.json files; returns JSON array of {account_id, app_id, content}.

<summary>Compute counts/sizes in one pass after classification.</summary>

Connect to the running Steam client as `appId`. Mirrors RemoteStorage.cs.

Validates the tool can reach Steam as appId (via a quota probe). No persistent session; each later call re-inits in a fresh tool process.

Number of savefiles rules declared for this app. 2+ rules resolving to the same dir trigger native's multi-root collision (see ApplyNativeOverQuotaEvi

Factory function

Factory function

Returns empty string on failure (wrong user, corrupted, etc.).

<summary> Delete the named blobs. The facade has already filtered unsafe names (path separators, traversal, reserved DOS names, trailing dot/space). <

<summary> Recursively delete CloudRedirect/{accountId}/{appId}/ on the provider. </summary>

<summary>Deletes a single cloud file (and forgets it so it won't re-sync).</summary>

<summary>Scans for third-party proxy DLLs; distinguishes from SteamTools via marker strings.</summary>

<summary> Downloads the update, validates it, swaps the running exe, and relaunches. Returns an error message on failure, or null on success (the proc

Free queued injections at shutdown without dispatching them; the receive thread is gone so BRouteMsgToJob is unsafe.

Resolve the effective merge method for two entries (prefer the one that has a non-default method; if both are set they should agree since they come fr

Effective quota after multi-root collision floor (2+ rules -> same dir). Used by both quota injection and eviction prediction.

<summary>Save the undo log and reset batch state.</summary>

Lazy-init default reporter for pre-Init error dialogs.

Extract Location header from raw header block

Fetch review-owner SteamIDs from appreviews API. Must NOT run on the network thread.

HTTP owner discovery (uses libcurl via IHttpTransport).

<summary> Find the section that contains the given RVA (using VirtualAddress + VirtualSize). Unlike RvaToFileOffset, this succeeds for BSS regions tha

CCMInterface discovery: CSteamEngine* -> engine+3144 (handle) -> engine+3296 (user map) -> matching CUser* -> CUser+72 (CCMInterface embedded).

Extract a call target by scanning for E8 in [minOff, maxOff] within funcStart.

<summary>Find a zero-filled code cave in an executable PE section, or -1.</summary>

Walk backward page-by-page to find ELF magic (true load base). Labeled-min may be offset into the file due to split PT_LOAD mappings.

<summary> Finds a game's install directory by reading its appmanifest ACF file. Searches all Steam library folders for the app's manifest. Returns nul

Search for "add reg, 0xB88" (81 C0-C7 88 0B 00 00) in a range, then back-trace to find the GOT-relative lea that loads the global engine ptr. Returns

Resolve g_pJobCur by finding the assertion string "g_pJobCur != NULL" in .rodata, locating its code xref, then extracting the GOT-relative lea that lo

<summary> Find LoadLibraryA and GetProcAddress IAT entry RVAs from the PE import directory. Returns (-1, -1) if the entries cannot be found. </summary

<summary> Locate recvPktGlobal: find `lea rcx, SendPkt`, then the nearby `mov [rip+disp], rcx` that stores the original function pointer. Backward sca

<summary> Locate SendPkt (sub_18000DB50) via its alloca_probe setup (B8 00 11 00 00 E8) and walk back to the prologue. Returns -1 if absent. </summary

Cloud sync-icon state (last_sync_state) was never wired up: SetCloudSyncState had no callers, so the icon writer is dead code. Retained as a no-op to