Extracting Steam TOTP from the Steam 3.0 Android app

[null-dev]

I don't see this documented yet so I'm going to document it here.

Here's how you extract the Steam TOTP secret from the Steam 3.0 Android app. The easiest way is to just use a rooted phone but there are other methods (not mentioned here because they are quite complicated).

1. Follow the instructions here: 【Wiki Enhancement】New ways to export steam-guard on Steam3.0 for Root Android Device JustArchiNET/ArchiSteamFarm#2786
2. You will end up with something like this:

{
  "accounts": {
    "76561197960287930": {
      "shared_secret": "9jMbHnerWZPtmzjdyEexyEnyHS8=",
      "identity_secret": "****************************",
      "secret_1": "****************************",
      "serial_number": "********************",
      "revocation_code": "******",
      "account_name": "Rabscuttle",
      "token_gid": "****************",
      "steamguard_scheme": 2,
      "steamid": "76561197960287930"
    }
  }
}

3. The field that you are interested in is the shared_secret field, this is your TOTP secret. You can't use it directly however, as it's in Base64. You need to convert it into Base32.
   • On Linux/Mac, you can use the following command: printf 'PUT YOUR shared_secret HERE' | base64 -d | base32
     • Example usage: printf '9jMbHnerWZPtmzjdyEexyEnyHS8=' | base64 -d | base32
   • On Windows you can use an online tool (although for security, I wouldn't recommend it). Here's a sample tool. You put your shared_secret in the top left "Control" that says "Push". The output in the top right "Control" that says "Pull" will be your TOTP secret.

[Barmem]

What are other methods? Don't wanna actually root my phone and wanna keep a copy of authenticator on my phone.

[null-dev]

If you don't have root, you can follow the same guide linked except instead of installing frida on the phone, you add frida to the Steam app APK.

There is a big caveat however: Since the Steam app has been modified, you can't update it from the play store anymore. You have to generate a new modified version of the Steam app every time you want to update.

[wyfang]

mac tip:
zsh: command not found: base32

[xperia-droid]

For Windows Users:

Save this code to an .cmd file on your PC:

@echo off
Rem Make powershell read this file, skip a number of lines, and execute it.
Rem This works around .ps1 bad file association as non executables.
PowerShell -Command  "$s = GC '%~dpnx0' | Select -Skip 5 | Out-String; $s='cd ""%~pd0"";'+$s; IEX $s"
goto :eof
# Start of PowerShell script here
$csharp = @"
public static class b32
{
    public static string BytesToBase32(byte[] bytes) {
        const string alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
        string output = "";
        for (int bitIndex = 0; bitIndex < bytes.Length * 8; bitIndex += 5) {
            int dualbyte = bytes[bitIndex / 8] << 8;
            if (bitIndex / 8 + 1 < bytes.Length)
                dualbyte |= bytes[bitIndex / 8 + 1];
            dualbyte = 0x1f & (dualbyte >> (16 - bitIndex % 8 - 5));
            output += alphabet[dualbyte];
        }
        return output;
    }
}
![Steamguardtoken](https://github.com/keepassxreboot/keepassxc/assets/24463981/eb906852-d14a-4bf9-a081-0a77c74bd8c1)

"@
Add-Type -TypeDefinition $csharp
$encodedSecret = Read-Host -Prompt ("Steam Guard Base64 Token") 
$decodedSecret = [System.Convert]::FromBase64String($encodedSecret)
$b32 = [b32]::BytesToBase32($decodedSecret)
Write-Host ("Steam Guard Base32 Token Result: " + $b32)
pause

start the .cmd file, then enter your shared_secret press enter and your token in base 32 returns:

[xperia-droid]

If you have root and LSPosed installed on your Android phone, you can get the Steam Guard Token with the following LSPosed module:
https://github.com/YifePlayte/SteamGuardDump/releases

After installing the app, you must activate the module in LSPosed and check that the Steam app is checked. Then restart the cell phone. After restarting, open the Steam app and the Steam Guard data will automatically be copied to the phone's clipboard.

The Steam Guard data is available in a json formatted string.
The string contains the word otpauth and you only need the part after secret= up to the & character. Copy the part between secret= and the & character into the TOTP settings of your Steam Keepass entry and you then you can use the Steamguard Token in KeepassXC :).