Find CNetworkGameServerBaseIsHLTV (Agent fallback)

Locate the CNetworkGameServerBase_IsHLTV virtual function in CS2 engine2.dll / libengine2.so using IDA Pro MCP tools. This is the Agent fallback for the find-CNetworkGameServerBase_CheckTimeouts-decompiles preprocessor: it runs only when the preprocessor script returned failure. It reproduces the LLM_DECOMPILE step by hand — collecting the virtual-call reference to IsHLTV inside its caller CNetworkGameServerBase_CheckTimeouts.

The output is a virtual dispatch (found_vcall): the YAML records the vtable slot and a vfunc_sig that pins the call instruction. There is no concrete implementation address — do not resolve or emit func_va.

Realworld Function Reference

Read the platform-relevant reference YAML before searching in IDA. It provides concrete disassembly, decompiler output, and the annotated call site. Treat its addresses and offsets as reference-build values only; verify every result against the current binary.

• Windows: ida_preprocessor_scripts/references/engine/CNetworkGameServerBase_CheckTimeouts.windows.yaml
• Linux: ida_preprocessor_scripts/references/engine/CNetworkGameServerBase_CheckTimeouts.linux.yaml

Background — where IsHLTV is called

CNetworkGameServerBase_CheckTimeouts(this) loops over connected clients. For each timed-out client it decides how to disconnect. In that decision it makes a virtual call on the server object itself to test whether the server is an HLTV/relay server:

// Linux reference (offset 0x258)
if ( !(*(unsigned __int8 (__fastcall **)(__int64))(*(_QWORD *)a1 + 600LL))(a1)   // IsHLTV(this)
     && g_pSource2Server
     && ... )
// Windows reference (offset 0x230)
if ( !(*(unsigned __int8 (__fastcall **)(__int64))(*(_QWORD *)a1 + 560LL))(a1) ) // IsHLTV(this)

IsHLTV takes only this and returns a bool. When it returns false the routine takes the g_pSource2Server "server-decided timeout" path. That semantic role — the vcall on the server object whose negated result gates the g_pSource2Server branch — is the anchor, not the raw offset, which changes across updates.

Do not confuse it with the many other vcalls in this function. Those are dispatched on the client (v5/rdi) or the netchan (v7/rsi/r15) objects, not on the server this (a1). Only the IsHLTV call is call qword ptr [rax+OFF] where rax = [a1].

Step 0. Skip if already produced

If CNetworkGameServerBase_IsHLTV.<platform>.yaml already exists next to the binary and parses to a non-empty mapping, skip — nothing to do. /get-func-from-yaml also reports existence.

Step 1. Load and decompile the caller

ALWAYS Use SKILL /get-func-from-yaml with func_name=CNetworkGameServerBase_CheckTimeouts to obtain its func_va.

If the skill returns an error, STOP and report to user (this fallback cannot run without the predecessor).

Decompile it:

mcp__ida-pro-mcp__decompile addr="<CNetworkGameServerBase_CheckTimeouts.func_va>"

Confirm the this register (first argument — rcx on Windows, rdi on Linux, usually copied to r14/r12).

Step 2. Locate the IsHLTV vcall

Find the virtual call dispatched on this that gates the g_pSource2Server path:

mov     rax, [this]            ; load the server object's vtable
mov     this-reg, this
call    qword ptr [rax+OFF]    ; OFF = vfunc_offset  (ref: 0x258 Linux / 0x230 Windows)
test    al, al
...                            ; g_pSource2Server used just after

Confirm the semantic fingerprint:

1. It is the vcall on the server object (this/a1), not on a client or netchan pointer.
2. It takes only this and returns a byte/bool tested immediately with test al, al.
3. Its (negated) result is followed by a load / use of g_pSource2Server.

Then:

• vfunc_offset = OFF (the displacement in the call qword ptr [rax+OFF] instruction)
• vfunc_index = vfunc_offset / 8 (ref: 75 Linux 0x258, 70 Windows 0x230)

Step 3. Generate the vfunc signature

ALWAYS Use SKILL /generate-signature-for-vfuncoffset on the call qword ptr [rax+OFF] instruction to obtain vfunc_sig (the offset bytes are fixed in the signature; vfunc_sig_disp is 0).

Step 4. Write the YAML

ALWAYS Use SKILL /write-vfunc-as-yaml with:

• func_name: CNetworkGameServerBase_IsHLTV
• vtable_name: CNetworkGameServerBase
• vfunc_offset: the resolved offset (hex, e.g. 0x258 / 0x230)
• vfunc_index: vfunc_offset / 8
• vfunc_sig: from Step 3
• func_addr: None (no concrete implementation address for a virtual dispatch)
• func_sig: None

Failure handling

• If the predecessor CNetworkGameServerBase_CheckTimeouts YAML is missing → STOP and report to user.
• If the vcall cannot be located → STOP and report exactly what could not be found, so the user can extend the reference.

Output YAML filenames

• Windows (engine2.dll): CNetworkGameServerBase_IsHLTV.windows.yaml
• Linux (libengine2.so): CNetworkGameServerBase_IsHLTV.linux.yaml