sapdragon/vac

What this is

This repository rebuilds 15 classic x86 Valve Anti-Cheat (VAC) scan modules and steamservice.dll in C++20, aiming for byte-for-byte output parity with the original signed Valve binaries. It is a reverse-engineering study, not a working anti-cheat product: the goal is to reproduce the original output packets, including the quirks and bugs (annotated // valve bug, keep it) README.

The layout separates a shared module runtime (sdk/, with _runfunc@20, dispatcher, ICE, raw RSA-512, MD5/CRC32, LZ4 and PE/NT helpers), the 15 scanners under modules/, and a service/ reconstruction covering the IPC module manager, RSA-1024 signature check, manual mapper and a 5-minute ETW process monitor README. Reconstructed workers cover things like BCD/testsigning checks, CPUID dumps, PCI/USB device enumeration, driver inventory, PE image scanning, process memory maps, handle enumeration, and direct x64 syscalls from WoW64 processes README.

It suits reverse engineers, anti-cheat researchers, and Windows internals learners who want to compare a faithful reimplementation against the real binaries. A full technical breakdown of steamservice.dll, the module SDK, all scanners and Valve's bugs is provided in English and Russian, with PDF versions.

Getting started

Requirements are Windows, Visual Studio 2022, a Python interpreter, and the original Valve binaries plus research material in a sibling ../vac-research directory, which the parity tests compare against.

1. Open vac.sln in Visual Studio 2022 and select the Release | Win32 configuration, or work from the command line.
2. Build the test suites and run the full parity checks:

python tests/build_tests.py
python tests/parity/run_all.py
python tools/ida/fill_orig.py --check sdk modules service

run_all.py runs each worker live against the original DLLs, first running the original binary twice against itself to filter OS noise, then verifies full _runfunc@20 output packets including ICE and RSA-512 sealing, followed by the synthetic fuzz suites README. The fill_orig.py --check step verifies the @orig marker annotations in the source.

Constraints and caveats

• The build targets Release | Win32; this is a 32-bit x86 reconstruction and is not a portable or general-purpose library.
• Byte-exact parity depends on having the original signed Valkyrie binaries in ../vac-research; without them the live parity suite cannot run.
• Several modules deliberately reproduce uninitialized stack contents and Valve's bugs, so outputs are intentionally not cleaner than the originals.
• The project is an educational/analysis reconstruction of proprietary software; check the MIT license and Valve's terms before reusing code.

HotRepo's take

HotRepo has no all-language daily rank recorded for this repository. In its one snapshotted day on the new-project list for C++ (2026-11-11), it recorded 113 stars and a gain of 8 stars and 1 fork over roughly one hour, with the star count tracked rising from 105 to 113 in the same window. That is a narrow observation base, so it supports only the fact of a short early burst rather than a trend. The draw is specific: an exact reproduction of VAC internals with a published technical writeup, which is a small, technical audience rather than a mass-market tool.