find-CSource2Server_Shutdown-decompiles

Find CSource2Server_Shutdown-decompiles (final-guarantee fallback)

Recover the three functions that CSource2Server::Shutdown calls directly, in CS2 server.dll / libserver.so, using IDA Pro MCP tools. This is the Agent fallback for the find-CSource2Server_Shutdown-decompiles preprocessor: it runs only when the preprocessor script returned failure. It reproduces the LLM_DECOMPILE step by hand — the three targets are ordinary direct calls made from one well-known caller, so no cross-version name mapping is actually required: the caller's call graph names them.

Every output is a concrete function (a func_sig), not a vcall. There is no vtable involved.

Realworld Function References

Read the platform-relevant reference YAML before searching in IDA. It provides the concrete disassembly of CSource2Server_Shutdown including the annotated call sites. Treat its addresses and offsets as reference-build values only; verify every result against the current binary.

• Windows: ida_preprocessor_scripts/references/server/CSource2Server_Shutdown.windows.yaml
• Linux: ida_preprocessor_scripts/references/server/CSource2Server_Shutdown.linux.yaml

Background — where the three teardown calls sit

CSource2Server_Shutdown is a short teardown routine. Its body is, in order:

1. shut down the game-event manager (CGameEventManager_Shutdown, passing the gameeventmanager global);
2. run a fixed sequence of four indirect calls through the same global object, each fetched as vtable slot [reg+50h] and each fed one freshly built argument (sub_* producers) — these are not our targets;
3. a contiguous run of four direct calls: the first two are our targets (CLoopModeRegistry_UnregisterLoopModes, then CEngineServiceRegistry_UnregisterEngineServices), followed by ReleaseParticleEffects and ReleaseCSBotManager which are not targets;
4. return through a tail jmp.

So the two requested functions in that run are its first two entries, sitting right after the four [reg+50h] indirect dispatches and right before ReleaseParticleEffects / ReleaseCSBotManager. That position — not the raw address — is the anchor, and it survives decompiler renames and address shifts across updates.