Luigi Auriemma

Luigi, I noticed your commented code on the "user" selection of the ClientRegistry.blob keys and I just had a couple of comments.

The Steam program actually stores every account name ever used to log in, inside the ClientRegistry.blob. It also stores along with that account name the password associated with it, IF the person selected "save these details to my computer", however the first occurrence of "PHRASE" is only the last one used. I am finishing up some work of my own on this and will probably post it when I am finished. So in summary, it is possible to list at least every account used to log in and where applicable the account name and the password. The only way to wipe this data out of ClientRegistry.blob is to delete the file itself and restart Steam, this will create the file new from scratch and only include the last account name and if applicable the password too.

Here is some already public GPL source code on the Steam Client Registry, also a compiled GUI front-end for anyone to use (note: I am not the author, refer to linked thread):


ClientRegistry Toolkit 0.5.0
http://cs.rin.ru/forum/viewtopic.php?t=44155

Cheers.

I have made some tests here just before the releasing of version 0.2.3 and the only password saved is the last one in fact if you have two accounts and login the first it's all ok, then you login the second one and it's ok but if you try to select the first one the password is lost and I have verified everything with the blob file step-by-step in which in fact there is only the latest password saved.
so how you allowed the saving of multiple passwords?

about the user field, I simply added that commented code for fun because the only purpose of the tool is decrypting the password so all the rest (included the format of the blob file) is secondary or just not important 8-)