i needed to get the address of a global variable, "g_pSteamEngine", so i jumped to the first usage of it that ghidra spotted which was this function named CAppInfoCache::WriteToDisk

the first call has 2 hardcoded constants as its arguments, which makes unique assembly not found anywhere else in the binary. perfect for searching for it!

because the return value of the ISteamEngine::GetConnectedUniverse function is a 32-bit integer, right after it is an "rldicl" instruction - effectively just masking off the lower 32-bits of it. which is "unique" in that function and serves as a good anchor point to finding when GetConnectedUniverse is called

at that point i just need to look up back from that anchor point until i find the two instructions that set the value of the r3 register to g_pSteamEngine before calling GetConnectedUniverse, and i've found it

very simple method but i find it so cool :D

and. if by *any miracle*, you work at Microsoft and have the ability to pull this off or convince someone to, you can make the responsible developerservices.windowsphone.com endpoints (RegisterDevice and DeviceStatus) return the XML data i mentioned in this repo. this will not happen but i can dream

it's impossible to have sensitive data sent to those endpoints, and you don't have to parse anything... just let us have this...