Exiled Wealth scanner

The Windows tray app behind Exiled Wealth, a stash net worth tracker for Path of Exile 2. GGG has no stash API for PoE2, so the scanner reads your special stash tabs (Currency, Essences, Runes and so on) off the screen while you play and sends the item counts to your Exiled Wealth account.

This is the complete source of the app you install, public so you can check what runs on your PC. (The website, and the script that packs and signs releases, are in a separate private repository.)

What it does

• Every 2 s, if Path of Exile 2 is the window in front, it copies a thin strip of the screen to see whether the stash is open. Only then does it copy the stash panel (CopyFromScreen). With the game in the background or closed, it reads nothing (it just checks for the game's process).
• On your PC it works out which tab is open, by matching item pictures against tab layouts from the game data, and reads each stack count by matching digit templates. The tab's name is read with Windows' built-in OCR.
• Ctrl+Shift+F12 (a registered hotkey, not a keyboard hook) reads the open tab right away. It too only reads the game while it's in front.

What it sends

Everything goes to exiledwealth.com over https, except item pictures, which come from GGG's image server (web.poecdn.com).

When	Request	Contents
Once, when you link	POST /api/scanner/link	the code from the website, and this PC's name (so you can tell your PCs apart on the website)
Reads waiting (once the stash has been quiet for 30 s, at least every 2 min while you sort, at once for Read now)	POST /api/scanner/sync	for each tab whose counts changed: its type, name, position and when it was read, and per slot a slot number and a count (the slot says what item it holds); for each tab you opened that didn't change (at most every 5 min per tab): its type, name, position and when (Snapshots.cs)
At start and hourly	GET /api/scanner/layouts	nothing: downloads the tab layouts
At start and after errors	GET /api/scanner/whoami	nothing: checks the link still works
At start and every 6 h	GET /api/scanner/releases/…	nothing: checks for updates
Only on the dev server (below), when you ask	POST /api/scanner/captures	a screenshot of the game window and its metadata

Every request carries the app's version in its User-Agent.

What it never does

• No input. It never clicks, presses keys or switches tabs.
• No game memory, files or traffic. It doesn't open the game's process, read its memory or its network traffic, or read its files.
• No screenshots leave your PC. The one exception is a diagnostics mode we use in development: Ctrl+Shift+F12 and "Send diagnostic screenshot" upload a screenshot of the game window, with the display and UI sections of the game's settings file, to help fix misreads. Only the game, only while it's in front: if another window is in front, nothing is taken. The mode only exists while the scanner is pointed at our test server, dev.exiledwealth.com (tray menu → Server, which asks first and says this; appsettings.json next to the exe can only name the live site or that one). On the live site it's off, its menu items are hidden, and any queued screenshots are deleted at start.
• No account details. You link it with a code from the website.

What it keeps on your PC

In %LocalAppData%\ExiledWealth: the device token (token-exiledwealth.com.bin, encrypted for your Windows user with DPAPI), log.txt (up to 1 MB, includes tab names), the tab layouts, cached item pictures (icons/), and reads waiting to upload (snapshots/). Unlink from the tray menu or the website to stop it; delete the folder to remove everything.

Updates

The scanner updates itself with Velopack: it downloads an update in the background and installs it when you quit or pick "Restart to update". It only installs an update whose release list is signed with the Exiled Wealth release key (SignedFeed.cs; public key in Resources/update-key.pem). The list holds each package's SHA-256, which Velopack checks on download. The private key is kept offline, not on GitHub.

Check your install

From 0.4.6 on, each version is built by GitHub Actions from a tag in this repository (release.yml) and published as an immutable release. The build's files carry a signed provenance attestation, and the installer and updates carry them unchanged. With the GitHub CLI, check your installed copy:

gh attestation verify "$env:LOCALAPPDATA\ExiledWealthScanner\current\ew-capture.dll" `
  -R jcossin03/exiledwealth-scanner --source-ref refs/tags/v0.4.6

It prints the commit and workflow that built the file; a changed file has no attestation. Our code is ew-capture.dll and EwCapture.Core.dll (ew-capture.exe is .NET's launcher). The release script that packs the installer and signs the update feed is private: this check is what ties your install to the public source.

Build it yourself

You need the .NET 10 SDK. It builds on Windows, macOS or Linux (it only runs on Windows).

dotnet build EwCapture
dotnet test EwCapture.Tests --filter "FullyQualifiedName!~RecognitionTests&FullyQualifiedName!~TabStripTests&FullyQualifiedName!~StashGateTests&FullyQualifiedName!~StripCoverTests"

The skipped tests read real stash screenshots, which aren't in the repository: they contain game art, which only GGG may distribute.

License

AGPL-3.0. You may read, build, change and share it. If you distribute a changed version, you must publish its source under the same license.

Exiled Wealth isn't affiliated with or endorsed by Grinding Gear Games in any way. Path of Exile is a trademark of Grinding Gear Games.