Find CBasePlayerPawn_CommitSuicide

Locate CBasePlayerPawn::CommitSuicide in CS2 server.dll / libserver.so using IDA Pro MCP tools.

Method

1. Resolve CBasePlayerPawn's Primary VTable

ALWAYS Use SKILL /get-vtable-address with class_name=CBasePlayerPawn (RTTI walk via the Itanium typeinfo name string "15CBasePlayerPawn"; primary vtable = the candidate whose offset_to_top qword is 0 and whose first few slots point into executable memory).

Linux 14168 reference: CBasePlayerPawn primary vtable 0x23d01c8. Note this class's typeinfo string has an unusually large number (21 on the 14168 build) of raw data xrefs to its typeinfo struct compared to most other classes — most of those hits are not real vtable pointers (they land on non-8-byte-aligned addresses inside .text, which are false positives from IDA's own operand/immediate analysis on this stripped binary). Always filter candidates down to the one whose offset_to_top qword is exactly 0 and whose first 2-3 slots disassemble as executable code before trusting it as the primary vtable — don't just take the first or only "clean-looking" hit.

2. Read Slot 384 Directly

FUNC_VTABLE_RELATIONS = [("CBasePlayerPawn_CommitSuicide", "CBasePlayerPawn")] and the slot index (384) is already known ground truth, so no additional discovery/anchor search is needed for the index itself:

mcp__ida-pro-mcp__idalib get_int queries=[{"addr":"<vtable_va + 0x10 + 384*8>","ty":"u64"}]

Linux 14168 reference: slot 384 resolves to 0x17d99a0 (size 0x108).

3. Confirm the Body Matches CommitSuicide Semantics

Decompile the resolved address and confirm the shape: (CBasePlayerPawn *this, bool bExplode, bool bForce) — i.e. 3 total parameters including this. Expected body:

1. A "god mode"/"buddha mode" bypass check near the top: reads a vtable slot (e.g. offset 0x538/index 167 on the 14168 build) that's compared against a known "default/no override" stub function; if it is the default stub, fall back to checking a plain boolean field on this instead, otherwise call the (overridden) vtable slot directly. If this check indicates the bypass is active, return early without killing the pawn.
2. A rate-limit/cooldown check: compares the current game time against a stored "next allowed suicide time" field on this; skips the cooldown check entirely if bForce is set.
3. On passing both checks: updates the cooldown field to now + 5.0, constructs a damage-info object (via a helper resembling CTakeDamageInfo's constructor) with a damage-type bit derived from bExplode (selects between two different damage-type flag values depending on whether the death should look like an explosion), applies it to this via a TakeDamage-shaped call, then destroys the temporary damage-info object.

Linux 14168 reference: sub_17D99A0's body matches this exactly — the god-mode check reads *this's vtable at offset 1336 (0x538, slot 167) and compares it against sub_A28320; the cooldown field lives at this+3712, set to now + 5.0 on a successful call; the damage-type selector is (bExplode ? 64 : 32) | 0x116 feeding into sub_1AA3160 (damage-info constructor) followed by sub_D4CFA0 (apply-damage) and sub_1A848C0 (damage-info destructor).

Cross-check (optional but recommended — do this if you have time budget): find the bot_kill/kill console command handler via find_regex for the literal command-name string, trace its call graph, and confirm it ultimately calls the same address through the pawn's CommitSuicide vtable slot (devirtualized or indirect — either is fine as corroboration).

4. Generate Function Signature

ALWAYS Use SKILL /generate-signature-for-function with addr=<CommitSuicide_addr> to generate a robust and unique func_sig.

5. Write IDA Analysis Output as YAML

ALWAYS Use SKILL /write-vfunc-as-yaml.

Required parameters:

• func_name: CBasePlayerPawn_CommitSuicide
• func_addr: <CommitSuicide_addr>
• func_sig: The validated signature from step 4

VTable parameters:

• vtable_name: CBasePlayerPawn
• vfunc_offset: 0xC00 (384*8)
• vfunc_index: 384

Function Characteristics

• Purpose: Kills the player pawn via self-inflicted damage (used by the kill/bot_kill-family console commands and any gameplay code that needs to force a player's death). Respects a god-mode/buddha-mode bypass and a short cooldown between successive calls, unless force-overridden.
• Binary: server.dll / libserver.so
• Parameters: (CBasePlayerPawn *this, bool bExplode, bool bForce)
• Return value: void
• VTable: CBasePlayerPawn, slot 384 (vfunc_offset = 0xC00) — matches ground truth.

Discovery Strategy

1. The slot index (384) is already known ground truth from FUNC_VTABLE_RELATIONS, so the only real discovery work is resolving CBasePlayerPawn's primary vtable correctly — which, on this binary, required filtering out a substantial amount of false-positive xref noise to the class's typeinfo struct (see the callout in step 1). The offset_to_top == 0 + "first slots are executable code" filter is what makes this reliable rather than accidentally picking a garbage candidate.
2. Body-shape confirmation (god-mode bypass, cooldown timer, explode-vs-normal damage-type selection, then a construct/apply/destroy damage-info sequence) is a strong independent signal that doesn't depend on the function's address, so it survives the function moving around between builds — only the slot index needs to stay stable, which the Itanium ABI guarantees for as long as CommitSuicide's position in the class's declared-virtuals list doesn't change.

Output YAML Format

The output YAML filename depends on the platform:

• server.dll -> CBasePlayerPawn_CommitSuicide.windows.yaml
• libserver.so -> CBasePlayerPawn_CommitSuicide.linux.yaml

Fields: func_name, func_va, func_rva, func_size, func_sig, vtable_name, vfunc_offset, vfunc_index.