find-INetworkGameServer_GetGameServerSteamID

Find INetworkGameServer_GetGameServerSteamID (final-guarantee fallback)

Recover the virtual function INetworkGameServer::GetGameServerSteamID in CS2 client.dll / libclient.so using IDA Pro MCP tools. This is the Agent fallback for the find-INetworkGameServer_GetGameServerSteamID skill: it runs only when the preprocessor script returned failure (almost always a transient LLM error, or the predecessor's call structure moved).

Realworld Function References

Read the platform-relevant reference YAMLs before searching in IDA. Treat their addresses as reference-build values only; verify against the current binary.

• Windows baseline: ida_preprocessor_scripts/references/client/GetRichPresenceStatusString.windows.yaml
• Linux baseline: ida_preprocessor_scripts/references/client/GetRichPresenceStatusString.linux.yaml

Step 1. Load and decompile the predecessor

ALWAYS Use SKILL /get-func-from-yaml with func_name=GetRichPresenceStatusString to obtain its func_va. If it returns an error, STOP and report to user (this fallback cannot run without the predecessor).

Decompile it:

mcp__ida-pro-mcp__decompile addr="<GetRichPresenceStatusString.func_va>"

Step 2. Locate the vtable-slot reference to the target

The predecessor resolves the network game server through a second interface hop and then fetches the steam id from that object's vtable. Anchor by the semantic fingerprint, not a fixed offset:

• Windows: mov rax, [rcx] -> call qword ptr [rax+0B8h] -> test rax, rax -> mov rcx, [rax] -> mov r8, [rcx+1E8h] -> mov rcx, rax -> call r8
• Linux: mov rax, [rdi] -> call qword ptr [rax+0C0h] -> test rax, rax -> mov rax, [rax] -> call qword ptr [rax+1E8h]

Important: on Windows the compiler hoists the slot into a register instead of calling it in place, so the reference is a mov, not a call. Searching only for call qword ptr [reg+...] will find nothing there.

Reference build vtable offset (verify, do not hardcode): vfunc_offset = 0x1E8 (488), vfunc_index = 61 on both platforms.