find-IVEngineServer2_GetClientSteamID

Find IVEngineServer2_GetClientSteamID (final-guarantee fallback)

Recover the virtual function IVEngineServer2::GetClientSteamID in CS2 server.dll / libserver.so using IDA Pro MCP tools. This is the Agent fallback for the find-IVEngineServer2_GetClientSteamID skill: it runs only when the preprocessor script returned failure (almost always a transient LLM error, or the predecessor's call structure moved).

Realworld Function References

Read the platform-relevant reference YAMLs before searching in IDA. Treat their addresses as reference-build values only; verify against the current binary.

• Windows baseline: ida_preprocessor_scripts/references/server/CBasePlayerController_HandleCommand_JoinTeam.windows.yaml
• Linux baseline: ida_preprocessor_scripts/references/server/CBasePlayerController_HandleCommand_JoinTeam.linux.yaml

Step 1. Load and decompile the predecessor

ALWAYS Use SKILL /get-func-from-yaml with func_name=CBasePlayerController_HandleCommand_JoinTeam to obtain its func_va. If it returns an error, STOP and report to user (this fallback cannot run without the predecessor).

Decompile it:

mcp__ida-pro-mcp__decompile addr="<CBasePlayerController_HandleCommand_JoinTeam.func_va>"

Step 2. Locate the vtable-slot reference to the target

IVEngineServer2::GetClientSteamID is reached through the global g_engine. Important: in this predecessor the compiler hoists the slot into a register instead of calling it in place, so the reference is a mov, not a call. Searching only for call qword ptr [reg+...] will find nothing.

Anchor by the semantic fingerprint, not a fixed offset — load the interface pointer from g_engine, load its vtable, then fetch the slot:

• Linux: lea rax, g_engine -> mov r12, [rax] -> mov rax, [r12] -> mov r13, [rax+228h]
• Windows: mov rax, cs:g_engine -> mov rcx, [rax] -> mov rbx, [rcx+228h]

Reference build vtable offset (verify, do not hardcode): vfunc_offset = 0x228 (552), vfunc_index = 69 on both platforms. The predecessor contains more than one such fetch; any of them resolves the same slot.