Levandor

hypelevels

2 min read

hypelevels

Reverse-engineering notes for the Steam Connection Manager and Game Coordinator protocols, with the immediate goal of fetching CS2 player level / XP / Prime / Premier rating from the GC. The four detail notes below were produced from a top-to-bottom pass over the upstream open-source implementations (SteamKit, node-steam-user, node-globaloffensive) and the SteamDatabase protobuf mirror, with every claim anchored to a file_path:line in the local clones.

Read order

These notes are intended to be read in sequence: this landing page → Steam Protocol Overview for the synthesis → TCP Transport and Handshake / Auth v2 Login Flow / CS2 Game Coordinator for the layer-specific details, as needed.

For Agents

Source repos are checked out under /Volumes/bandi/coding/hypelevels/: SteamKit/ (C# reference), node-steam-user/ (Node.js production code), node-globaloffensive/ (CS2 GC client), Protobufs/ (SteamDatabase mirror). All file_path:line citations in these notes are absolute filesystem paths into those clones — treat them as inline code, not URLs.

Audit pass: four EMsg corrections + two unverified GC claims

An audit pass surfaced four EMsg corrections and two unverified GC claims (Prime detection mechanism, Premier rank_type_id value). See Validation Report for the full audit trail.

Companion notes

  • Steam Protocol Overview — layered synthesis, end-to-end byte sequence, constants quick-reference, common pitfalls.
  • Validation Report — per-claim audit trail; what’s verified, what’s caveated, what’s still empirically unconfirmed.
  • TCP Transport and Handshake — TCP frame, three-message handshake, AES-256-CBC bulk encryption with HMAC-SHA1 IV derivation, RSA-OAEP-SHA1 key wrap.
  • Auth v2 Login Flow — Unified Messages transport, GetPasswordRSAPublicKey → BeginAuthSessionViaCredentials → optional UpdateAuthSessionWithSteamGuardCode → PollAuthSessionStatus → JWT → CMsgClientLogon.
  • CS2 Game Coordinator — CMsgGCClient envelope, mounting appid 730 via CMsgClientGamesPlayed, the two-hello dance (ClientHello 4006 / MatchmakingClient2GCHello 9109), parsing the 9110 response to extract player_level, player_cur_xp, Prime bit, and Premier rating.

Quick reference — protocol constants

ItemValue
TCP frame magic"VT01" = 0x31305456 LE
EMsg.ChannelEncryptRequest1303
EMsg.ChannelEncryptResponse1304
EMsg.ChannelEncryptResult1305
EMsg.ClientLogon5514
EMsg.ClientLogonResponse751
EMsg.ClientHeartBeat703
EMsg.ClientGamesPlayed742
EMsg.ServiceMethodCallFromClient151
EMsg.ServiceMethodCallFromClientNonAuthed9804
EMsg.ServiceMethodResponse147
EMsg.ClientToGC5452
EMsg.ClientFromGC5453
Transport RSA paddingOAEP-SHA1, 1024-bit modulus, exponent 0x11
Password RSA paddingPKCS#1 v1.5 (different layer!)
AES key size256 bits, key = sessionKey[0..32]
HMAC-SHA1 keysessionKey[0..16] (first 16 bytes!)
IV length16 bytes (13 bytes HMAC ‖ 3 bytes random)
AES modeCBC, PKCS7 padding
IV-of-IV modeECB, no padding
GC proto-mask high bit0x80000000
CS2 appid730
k_EMsgGCClientHello4006
k_EMsgGCClientWelcome4004
k_EMsgGCCStrike15_v2_MatchmakingClient2GCHello9109
k_EMsgGCCStrike15_v2_MatchmakingGC2ClientHello9110
Prime bit in player_xp_bonus_flagsbit 4 (value 0x10)
rank_type_id for Premier11

Graph View