Find IVEngineServer2GetClientSteamID (final-guarantee fallback)

Recover the virtual function IVEngineServer2::GetClientSteamID in CS2 server.dll / libserver.so using IDA Pro MCP tools. This is the Agent fallback for the find-IVEngineServer2_GetClientSteamID skill: it runs only when the preprocessor script returned failure (almost always a transient LLM error, or the predecessor's call structure moved).

Realworld Function References

Read the platform-relevant reference YAMLs before searching in IDA. Treat their addresses as reference-build values only; verify against the current binary.

• Windows baseline: ida_preprocessor_scripts/references/server/CBasePlayerController_HandleCommand_JoinTeam.windows.yaml
• Linux baseline: ida_preprocessor_scripts/references/server/CBasePlayerController_HandleCommand_JoinTeam.linux.yaml

Step 1. Load and decompile the predecessor

ALWAYS Use SKILL /get-func-from-yaml with func_name=CBasePlayerController_HandleCommand_JoinTeam to obtain its func_va. If it returns an error, STOP and report to user (this fallback cannot run without the predecessor).

Decompile it:

mcp__ida-pro-mcp__decompile addr="<CBasePlayerController_HandleCommand_JoinTeam.func_va>"

Step 2. Locate the vtable-slot reference to the target

IVEngineServer2::GetClientSteamID is reached through the global g_engine. Important: in this predecessor the compiler hoists the slot into a register instead of calling it in place, so the reference is a mov, not a call. Searching only for call qword ptr [reg+...] will find nothing.

Anchor by the semantic fingerprint, not a fixed offset — load the interface pointer from g_engine, load its vtable, then fetch the slot:

• Linux: lea rax, g_engine -> mov r12, [rax] -> mov rax, [r12] -> mov r13, [rax+228h]
• Windows: mov rax, cs:g_engine -> mov rcx, [rax] -> mov rbx, [rcx+228h]

Reference build vtable offset (verify, do not hardcode): vfunc_offset = 0x228 (552), vfunc_index = 69 on both platforms. The predecessor contains more than one such fetch; any of them resolves the same slot.

Step 3. Resolve the vfunc slot and write the YAML

1. From the resolved vfunc_offset, rename the reference to IVEngineServer2_GetClientSteamID with mcp__ida-pro-mcp__rename.
2. ALWAYS Use SKILL /generate-signature-for-vfuncoffset for the vfunc at the resolved offset to obtain a validated vfunc_sig.
3. ALWAYS Use SKILL /write-vfunc-as-yaml with:
   • func_name: IVEngineServer2_GetClientSteamID
   • vtable_name: IVEngineServer2
   • vfunc_sig: the validated signature from step 2
   • vfunc_offset / vfunc_index: the resolved values

IVEngineServer2 is an abstract interface with no vtable in the server module, so this YAML is slot-only: do not attempt to emit func_va. The concrete implementation address is resolved separately in the engine module by find-CEngineServer_GetClientSteamID, which inherits this slot.

Output YAML filenames

Written beside the binary by the writer skill, one file per platform:

• Windows (server.dll): IVEngineServer2_GetClientSteamID.windows.yaml
• Linux (libserver.so): IVEngineServer2_GetClientSteamID.linux.yaml

Failure handling

• If the predecessor CBasePlayerController_HandleCommand_JoinTeam YAML is missing -> STOP and report to user.
• If the target slot fetch cannot be located even after inspecting the predecessor -> STOP and report so the user can extend the references.