find-CNetworkMessages_dtor

Find CNetworkMessages_dtor

Locate CNetworkMessages_dtor vfunc in CS2 networksystem.dll or libnetworksystem.so using IDA Pro MCP tools.

Deterministic Preprocessor

Normal analyzer runs use ida_preprocessor_scripts/find-CNetworkMessages_dtor.py. It selects the ABI-defined destructor slot from CNetworkMessages_vtable.{platform}.yaml and regenerates func_sig with the shared deterministic signature generator. This Agent skill is only the fallback when that preprocessor fails; the trusted finalizer replaces any Agent-provided func_sig from func_va before accepting the output.

Method

1. Load CNetworkMessages VTable from YAML

ALWAYS Use SKILL /get-vtable-from-yaml with class_name=CNetworkMessages.

If the skill returns an error, STOP and report to user.

Otherwise, extract:

• vtable_numvfunc
• vtable_entries

2. Identify Destructor Candidates

The destructor is located in the last three vtable entries. Check the entries at indices:

• vtable_numvfunc - 3
• vtable_numvfunc - 2
• vtable_numvfunc - 1

Read the function addresses from the vtable entries for these three slots.

3. Decompile and Identify the Destructor

Decompile all three candidate functions:

mcp__ida-pro-mcp__decompile addr="<candidate_1_addr>"
mcp__ida-pro-mcp__decompile addr="<candidate_2_addr>"
mcp__ida-pro-mcp__decompile addr="<candidate_3_addr>"

Windows (networksystem.dll)

The destructor has this characteristic two-argument pattern:

__int64 __fastcall CNetworkMessages_dtor(__int64 a1, char a2)
{
  CNetworkMessages_dtor2(a1);
  if ( (a2 & 1) != 0 )
    (*(void (__fastcall **)(_QWORD, __int64))(*g_pMemAlloc + 24LL))(g_pMemAlloc, a1);
  return a1;
}

Key identification rules for Windows:

1. Takes two parameters: (__int64 a1, char a2) (this + flags)
2. Calls another large destructor function (CNetworkMessages_dtor2) with just a1
3. Conditionally frees memory via g_pMemAlloc if (a2 & 1) != 0
4. Returns a1