Pin the exact source of every open-source binary Steam ships: - 6766 runtime binaries (verified by SHA-256 against their .debs) map to 755 exact Debian/Valve source packages, plus steam-runtime-tools tags - Valve-built bundled libraries map to upstream tags identified from version strings: FFmpeg 8.1.2 / 4.3.4, SDL 3.4.0, SDL_image 3.2.0, SDL_ttf 3.1.0, libvpx v1.10.0-78-g338013712, libaom 3.6.1, libvorbis 1.3.7, libavif 1.0.3/1.0.4 - Inferred (kept decompiled as well): dav1d 1.0.0, and ANGLE / SwiftShader / Vulkan-ValidationLayers / CEF via Chromium 126.0.6478.183 DEPS SOURCES.tsv and BINARY_SOURCES.tsv record versions and evidence; tools/sources.py fetches them into the gitignored sources/ tree. Decompiled output for exactly-pinned binaries is removed; the proprietary NVIDIA Cg toolkit binaries stay decompiled. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2.3 KiB
2.3 KiB
steam (Rust rewrite) — reverse-engineering workspace
Goal: a Linux-only, slimmed-down Steam client (Rust backend, Qt UI) covering only
the Library: login, install/update/download, in-game presence, Steam Chat, and the
steamclient.so ABI that games (native and Proton via lsteamclient) load.
No Store, Community, Market, or embedded-browser features.
Layout
client/snapshot of the official client binaries being studied (gitignored)decomp/generated output (tracked; logs ignored)<dir>_<binary>/src/<Namespace>.c,functions.tsv,strings.tsv— Ghidra pseudo-Cprotos/—.protofiles extracted from steamclient.so;descriptors.pbis a FileDescriptorSet usable directly withprost_build::Config::compile_fdssteamui/— prettified Library UI JS;steamclient_js_api.txtlists theSteamClient.*backend API the UI callsruntime/— Steam runtime binaries:PROVENANCE.tsvmatches every one by SHA-256 to its published .deb;DUPLICATES.tsvmaps identical copies. Only the proprietary NVIDIA Cg toolkit binaries are decompiled here.
SOURCES.tsv— the original source code for every open-source binary, pinned to the exact version (Debian/Valve.dsc, or upstream git tag/commit) with evidenceBINARY_SOURCES.tsv— which source each binary comes from, and how that was establishedsources/— that source code, fetched bytools/sources.py fetch(gitignored, ~20 GB)
Rule: a binary whose exact source version is public is read from sources/, not
decompiled. Decompiled output is kept only for code with no public source (Steam's
own binaries, RAD Miles, NVIDIA Cg, Valve's WebRTC fork, ...) and for libraries whose
version could only be inferred (dav1d, ANGLE, SwiftShader — see BINARY_SOURCES.tsv).
Tools
tools/decompile.sh <bin>...— headless Ghidra analysis + pseudo-C export (decompile_list.sh,decompile_batch.shfor queues/batches; limits inghidra-env.sh)tools/extract_protos.py <bin>... <out>— protobuf descriptor extractiontools/verify_runtime.py— match runtime binaries to published packagestools/sources.py resolve/fetch [--only ID] [--chromium]— pin and download sources
Re-run everything after a client update by re-copying binaries into client/.