---

name: find-CSteam3ServerS1_InitGameServer-decompiles description: | Final-guarantee fallback for the find-CSteam3ServerS1_InitGameServer-decompiles preprocessor. Recovers the INetworkSystem::GetUDPPort and INetworkServerService::IsActiveInGame indirect virtual-call slots in CS2 engine2.dll / libengine2.so by decompiling CSteam3ServerS1_InitGameServer and following any de-inlined helper. Use when the deterministic/LLM preprocessor could not resolve every call because the containing code moved across an inline boundary. Trigger: INetworkSystem_GetUDPPort, INetworkServerService_IsActiveInGame disable-model-invocation: true

Find InitGameServer network interface calls (final-guarantee fallback)

Recover every output of find-CSteam3ServerS1_InitGameServer-decompiles in CS2 engine2.dll / libengine2.so using IDA Pro MCP. This Agent fallback runs only after the preprocessor fails, so it must produce any missing output itself while preserving outputs that a partial preprocessor run already wrote.

Realworld Function References

Read the platform-relevant reference YAML before searching in IDA. Its addresses, offsets, and signatures are reference-build values only; verify every result against the current binary.

• ida_preprocessor_scripts/references/engine/CSteam3ServerS1_InitGameServer.windows.yaml
• ida_preprocessor_scripts/references/engine/CSteam3ServerS1_InitGameServer.linux.yaml

Background and robustness principle

CSteam3ServerS1_InitGameServer initializes the game-server networking state. It queries two 16-bit UDP ports from the network system, then uses INetworkServerService::IsActiveInGame to select which port to retain. Both targets are indirect virtual calls: their YAML identifies the call instruction and vtable slot, not a concrete function body.

First inspect the predecessor itself. If either call is absent, enumerate its direct callees, decompile plausible helpers, and search one or two levels down: an update may de-inline the networking setup into a helper (or inline it back into the predecessor). Identify calls by their receiver globals and neighboring behavior, never by a fixed function address or call-site address.

Output inventory

Both outputs are required on both platforms. The slot values below were observed in builds 14181 and 14186; derive and verify the current value from the instruction before writing YAML.

| Output symbol | Kind | Windows reference | Linux reference | Writer skill | |---|---|---|---|---| | INetworkSystem_GetUDPPort | indirect vcall | INetworkSystem, 0x118, index 35 | INetworkSystem, 0x118, index 35 | /write-vfunc-as-yaml | | INetworkServerService_IsActiveInGame | indirect vcall | CNetworkServerService_vtable, 0xC0, index 24 | CNetworkServerService_vtable, 0xC8, index 25 | /write-vfunc-as-yaml |

Step 0. Skip outputs already produced

For each output, check whether <symbol>.<platform>.yaml already exists in the active artifact module directory and parses as a non-empty mapping. Skip an existing output: the preprocessor or an earlier fallback may have written it. Use the analyzer-reported artifact module directory, not a path derived from the binary directory.

Step 1. Load and decompile the predecessor

ALWAYS use SKILL /get-func-from-yaml with func_name=CSteam3ServerS1_InitGameServer to obtain func_va. If it fails, stop and report the missing prerequisite. Then decompile that address:

mcp__ida-pro-mcp__decompile addr="<CSteam3ServerS1_InitGameServer.func_va>"

Record calls made by the predecessor so that a missing direct pattern can be followed into de-inlined helpers.

Step 2. Resolve INetworkSystem_GetUDPPort

Locate the indirect call qword ptr [vtable + offset] whose receiver is loaded from g_pNetworkSystem. Its distinguishing semantic pattern is the pair of adjacent g_pNetworkSystem port queries that precede the IsActiveInGame call: the target is the one whose 16-bit result is retained when IsActiveInGame returns true. The other port query (GetBoundUDPPort, normally slot 0x110) is retained when it returns false; do not confuse this target with it or with unrelated +0x118 calls on other receivers.

The current call displacement is the vfunc_offset; calculate vfunc_index = vfunc_offset / 8. The reference value is 0x118 on both platforms, but the receiver must be verified as g_pNetworkSystem in the current binary. Use vtable_name=INetworkSystem.

Step 3. Resolve INetworkServerService_IsActiveInGame

Locate the following indirect vcall whose receiver is loaded from g_pNetworkServerService. It returns a boolean used to choose between the two preceding network-system results, before the SteamGameServer_Init() logging path. This receiver-global/data-flow pairing distinguishes it from other virtual calls nearby.

Derive the current displacement and vfunc_index = vfunc_offset / 8. Reference values are Windows 0xC0 / index 24 and Linux 0xC8 / index 25; do not assume them if the current instruction differs. Use vtable_name=CNetworkServerService_vtable, matching the other INetworkServerService_* slot outputs.

Step 4. Generate signatures and write YAML

For each missing target, use /generate-signature-for-vfuncoffset on the resolved call instruction with its verified vfunc_offset. The vfunc_sig must start at that instruction, include the displacement bytes without wildcards, and be unique in the current binary.

Then use /write-vfunc-as-yaml with:

• artifact_name: the output symbol's legacy file stem
• func_name: INetworkSystem_GetUDPPortWithFallback for the INetworkSystem_GetUDPPort artifact; otherwise the output symbol unchanged. This call uses the fallback-port accessor, not the separate bound-port method.
• func_addr=None and func_sig=None (these are call-slot outputs, not function bodies)
• vfunc_sig: the generated call-instruction signature
• vfunc_sig_disp=0 (or omit it)
• vtable_name: INetworkSystem or CNetworkServerService_vtable as identified above
• vfunc_offset: the verified instruction displacement
• vfunc_index: vfunc_offset / 8

Do not rename or resolve a concrete implementation address. The expected YAML contains only func_name, vtable_name, vfunc_offset, vfunc_index, and vfunc_sig.

Failure handling

• If the predecessor YAML is unavailable, stop and report it.
• If a required call is missing from the predecessor, follow its plausible callees before declaring it unresolved.
• If one target remains unresolved, write any other verified missing target, then report exactly which output failed.
• Never write a Windows output while analyzing Linux, or vice versa.

Output YAML filenames

Write under the active artifact module directory:

• INetworkSystem_GetUDPPort.windows.yaml / INetworkSystem_GetUDPPort.linux.yaml
• INetworkServerService_IsActiveInGame.windows.yaml / INetworkServerService_IsActiveInGame.linux.yaml