find-CCSPlayer_MovementServices_FullWalkMove_SpeedClamp

CCSPlayer_MovementServices_FullWalkMove_SpeedClamp Patch Workflow

Overview

Locate the velocity clamping branch inside CCSPlayer_MovementServices_FullWalkMove and generate a patch that converts the conditional jump into an unconditional jump, making the speed-clamp code a dead path.

The target code pattern in pseudocode:

v20 = (float)((float)(v16 * v16) + (float)(v19 * v19)) + (float)(v17 * v17);
if ( v20 > (float)(v18 * v18) )    // <-- patch target: disable this branch
{
    // velocity clamping logic: scale velocity down to maxspeed
    v21 = fsqrt(v20);
    v22 = v18 / v21;
    *(float *)(a2 + 56) = ... * v22;
    *(float *)(a2 + 60) = ... * v22;
    *(float *)(a2 + 64) = ... * v22;
    ...
}

In assembly, this is a comiss + jbe (or jbe short) pair. The jbe skips the clamping block when velocity <= maxspeed^2. Patching jbe to jmp makes it always skip, disabling the clamp entirely.

Prerequisites

• CCSPlayer_MovementServices_FullWalkMove must already be identified. Use SKILL /get-func-from-yaml with func_name=CCSPlayer_MovementServices_FullWalkMove to load its address. If YAML does not exist, run SKILL /find-CCSPlayer_MovementServices_FullWalkMove-AND-CCSPlayer_MovementServices_CheckVelocity-AND-CCSPlayer_MovementServices_WaterMove first.

Location Steps

1. Get FullWalkMove Function Address

ALWAYS Use SKILL /get-func-from-yaml with func_name=CCSPlayer_MovementServices_FullWalkMove.

If the skill returns an error, stop and report to user.

2. Decompile and Locate the Speed Clamp Pattern

Decompile the function:

mcp__ida-pro-mcp__decompile(addr="<func_va>")

In the decompiled output, search for the velocity clamping pattern. The key indicators are:

• A sum-of-squares computation: (x*x) + (y*y) + (z*z) stored in a variable (e.g., v20)
• Compared against another float squared: v20 > (float)(v18 * v18)
• Inside the if-block: fsqrt, division, and writes to a2+56, a2+60, a2+64 (velocity vector)