Documentation in progress k

Valve is in your computer, snooping at your programs.

Documentation of Scan #9 (that's the 10th entry in the jumptable)

This is one of many scan features used by VAC and could also be a bit invasive.
It's a simple process scan which is also uploading the names of executables to the Steam servers.

They will loop through the list of processes, selecting random processes and putting them into an array somewhere.
They'll also grab the EXE's as they exist in memory.

Once they build this table, they then pull random winners out of a hat to determine whether to hash the file,
the executable in memory, or both.

Example:
OpenProcess: Process 3628, desired access 0x00000410
Copy string uTorrent.exe -> 0x003CF97C
ReadProcessMemory Handle 00000048, Read 0x00001000 bytes at 0x00400000
Produced MD5 Hash 090fa5f64cfb050b8ffaec7f57c31834

They then write this out to the packet, and repeat the process a few more times.
The final packet ends up looking like this:

00000000 80 00 04 00 00 00 00 00 06 00 01 00 00 00 00 00 ................
00000010 07 00 00 00 00 01 00 00 04 00 00 00 00 00 00 00 ................
00000020 09 0F A5 F6 4C FB 05 0B 8F FA EC 7F 57 C3 18 34 ....L.......W..4
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 03 00 40 00 01 00 40 00 75 54 6F 72 72 65 6E 74 ..@[email protected]
00000050 2E 65 78 65 00 00 00 00 82 61 59 67 BF F0 FB F2 .exe.....aYg....
00000060 64 C1 45 13 78 7C DD 3B CB 31 07 8F 93 7F F0 B2 d.E.x|.;.1......
00000070 89 E4 D1 E6 D7 36 69 72 02 00 2B 01 01 00 2B 01 .....6ir..+...+.
00000080 6D 73 70 64 62 73 72 76 2E 65 78 65 00 00 00 00 mspdbsrv.exe....
00000090 05 0C 86 59 B3 07 13 E3 D4 39 59 44 2E D5 8A C4 ...Y.....9YD....
000000A0 0B 35 09 C6 27 8B DE B3 99 70 52 61 C9 3D 82 A0 .5..'....pRa.=..
000000B0 02 00 57 2F 01 00 57 2F 64 65 76 65 6E 76 2E 65 ..W/..W/devenv.e
000000C0 78 65 00 00 00 00 00 00 FA 28 77 1E C7 B5 CC 10 xe.......(w.....
000000D0 FA C9 6C D3 02 82 95 80 73 5F A8 C5 B1 5F 64 98 ..l.....s_..._d.
000000E0 F0 B1 A4 75 EF D1 FD 62 02 00 13 00 01 00 13 00 ...u...b........
000000F0 52 65 70 6C 61 79 37 2E 65 78 65 00 00 00 00 00 Replay7.exe.....

And there you have it; Valve knows what programs we use.