Find CNetworkGameClientBase_vtable

Fallback agent to locate the CNetworkGameClientBase_vtable symbol in the CS2 engine via IDA Pro MCP and emit a verified YAML signature artifact.

Sby Skills Guide Bot
SecurityAdvanced
209/13/2026
Claude Code
#reverse-engineering#ida-pro#binary-analysis#signature-generation#cs2

Recommended for


name: find-CNetworkGameClientBase_vtable description: | Agent fallback for CNetworkGameClientBase_vtable (auto-generated, category: func). Locate CNetworkGameClientBase_vtable in the CS2 engine module via IDA Pro MCP and emit a fresh, minimal-unique artifact. The deterministic preprocessor could not resolve this symbol on the current gamever - your job is the re-sign. Trigger: CNetworkGameClientBase_vtable, CNetworkGameClientBase_vtable disable-model-invocation: true

Find CNetworkGameClientBase_vtable

Target: CNetworkGameClientBase_vtable (func) in the module loaded in THIS session.

The old artifact/preprocessor anchors no longer match this build. Use anchors only to locate candidates; derive the artifact from the ACTUAL bytes you read. Produce ONLY this session's platform output. NEVER open another binary.

Method

Locate via distinctive constants/strings in the body, cross-references from known callers/callees, or the owning class vtable (RTTI) if virtual. Verify by decompilation before committing to a candidate.

Mandatory self-check before emitting

The pipeline re-reads the bytes at your func_va and regenerates func_sig from them - a mismatch aborts the run. Therefore: read the real bytes via IDA MCP, derive the artifact FROM those bytes (wildcard relocated operands as ??), start at the TRUE function head, and only then write the YAML. A mismatch is always a bug in YOUR output.

Output schema (STRICT)

Write CNetworkGameClientBase_vtable.{platform}.yaml with EXACTLY these fields:

func_name: <TASK>
func_va: "<hex virtual address>"
func_rva: "<hex rva>"
func_size: "<hex size>"
func_sig: "<byte pattern, ?? wildcards, function head, minimal-unique>"

NEVER include vfunc_* or struct fields.

Verification

  1. Decompile and confirm the behavior matches the symbol's semantics.
  2. Uniqueness: the pattern must match exactly ONE location in the loaded binary.
  3. If no candidate can be confirmed, report the shortlist - a skipped symbol is safer than a wrong signature.
Related skills