跳到正文
cccskills
免费在 GitHub 公开

find-CCSNavArea_IsValidNavMesh

Find and identify the CCSNavArea_IsValidNavMesh function in CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the nav-mesh validity predicate. It is a tiny non-virtual-looking helper that returns `g_pNavMesh != nullptr` (15 bytes), referenced only from a vtable slot, with no debug string of its own. Emits a unique IDA-style byte signature and a func YAML. Mirrors the find-CCSNavArea_IsValidNavMesh.py preprocessor (xref_gvs g_pNavMesh intersected with the tail signature `48 83 38 ? 0F 95 C0 C3`). Trigger: CCSNavArea_IsValidNavMesh, IsValidNavMesh, g_pNavMesh predicate

中文简介正在准备中。当前显示原文说明。

查看安装方法

包含的文件(1)

  • SKILL.md3.4 KB

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

Find CCSNavArea_IsValidNavMesh

Locate CCSNavArea_IsValidNavMesh in CS2 server.dll or libserver.so using IDA Pro MCP tools.

This is a direct-call predicate (emit a byte sig, not an offset). The whole body is 15 bytes:

lea     rax, g_pNavMesh
cmp     qword ptr [rax], 0
setnz   al
retn

i.e. return g_pNavMesh != nullptr. It has no debug string, and g_pNavMesh has 200+ referencers, so neither anchors it alone.

Primary resolution = the tail byte pattern 48 83 38 ? 0F 95 C0 C3 (cmp [rax],0 ; setnz al ; retn), which is unique in .text. Intersecting it with a g_pNavMesh reference keeps it robust if the tail ever recurs after an update.

Method

1. Reuse previous signature (fast path)

If a prior CCSNavArea_IsValidNavMesh.{platform}.yaml exists, try its func_sig via mcp__ida-pro-mcp__find_bytes. Single match → resolve to function start, skip to Step 4. Else continue.

2. Locate via the unique tail pattern

mcp__ida-pro-mcp__find_bytes      patterns="48 83 38 ?? 0F 95 C0 C3"

Exactly one match. Resolve the containing function start (mcp__ida-pro-mcp__lookup_funcs) — that function is CCSNavArea_IsValidNavMesh. Optionally rename it.

3. Confirm (optional)

Decompile and confirm the body is return g_pNavMesh != 0; — a single lea to the g_pNavMesh global, a cmp [rax], 0, setnz al, retn.

4. Generate signature

ALWAYS use SKILL /generate-signature-for-function with addr=<func_addr>. Emit IDA style verbatim (space hex, ? wildcards).

Reference sig (build 14165 — sanity check only, regenerate per binary):

  • linux: 48 8D 05 ? ? ? ? 48 83 38 ? 0F 95 C0 C3

5. Write func YAML

ALWAYS use SKILL /write-func-as-yaml:

  • func_name: CCSNavArea_IsValidNavMesh
  • func_addr: <func_addr>
  • func_sig: validated sig from step 4

Function Characteristics

  • Linkage: direct-call predicate, referenced from a vtable slot (no string referencer)
  • Binary: server.dll / libserver.so
  • Distinguishing trait: unique tail 48 83 38 ? 0F 95 C0 C3; reads the g_pNavMesh global

Discovery Strategy (why this is stable across updates)

The body is the minimal "global non-null" predicate, so its byte sig is the whole function and self-heals once re-resolved. The tail cmp [rax],0 ; setnz al ; retn is unique in .text; intersecting with a g_pNavMesh reference disambiguates if the tail ever recurs.

Preprocessor pipeline equivalent

find-CCSNavArea_IsValidNavMesh   [xref_gvs g_pNavMesh ∩ xref_signatures "48 83 38 ? 0F 95 C0 C3"]

Output YAML Format

  • server.dll -> CCSNavArea_IsValidNavMesh.windows.yaml
  • libserver.so -> CCSNavArea_IsValidNavMesh.linux.yaml

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

Clean up the local workspace after a dev branch has been merged into main. Verifies the current dev branch is fully merged into origin/main, then switches to main, pulls the latest, deletes the local dev branch, and deletes the remote dev branch if it still exists. STOPS and warns the user if the current branch is not yet merged. Triggers: cleanup workspace, cleanup branch, delete merged branch, finish dev branch, post-merge cleanup

中文简介正在准备中。当前显示原文说明。

mrc4tt/CS2_VibeSignatures32026年10月20日 更新

Convert an existing find-XXXX SKILL.md into a preprocessor Python script, updating configs/<GAMEVER>.yaml and removing the old SKILL.md. Covers xref-string-based and LLM_DECOMPILE-based discovery patterns.

中文简介正在准备中。当前显示原文说明。

mrc4tt/CS2_VibeSignatures32026年10月20日 更新

Create an Agent SKILL.md fallback for an existing find-XXXX finder that relies on a fragile discovery foundation — above all LLM_DECOMPILE (patterns C/D/E), which matches the decompiled shape of a predecessor function against a stored reference and breaks when a symbol is inlined or de-inlined in a way the reference does not cover. The generated fallback coexists with the preprocessor and runs only when it returns failure, recovering every target robustly by decompiling the predecessor and following the inline/de-inline boundary with semantic anchors. Use when a finder broke on a game update, or you want to durably backstop one before it does. The recipe generalizes to any finder foundation. Triggers: create agent skill fallback, add SKILL.md fallback, robust fallback for finder, backstop LLM_DECOMPILE finder, final guarantee skill

中文简介正在准备中。当前显示原文说明。

mrc4tt/CS2_VibeSignatures32026年10月20日 更新

Create a new cpp_tests entry for validating a C++ interface vtable layout against binary reference YAMLs. Creates the .cpp test file in cpp_tests/ and appends a configs/<GAMEVER>.yaml entry under cpp_tests:. Use when a user asks to add vtable layout validation for a new hl2sdk_cs2 interface class.

中文简介正在准备中。当前显示原文说明。

mrc4tt/CS2_VibeSignatures32026年10月20日 更新

create-pr

免费

Create a GitHub pull request from staged task changes or an already-committed current branch. Deliver source/config/ reference changes together with their computed source-owned `bin_artifacts` closure. PR validation routing is owned by the default-branch trusted workflow; snapshots, gamedata, and manifests are Release-derived only.

中文简介正在准备中。当前显示原文说明。

mrc4tt/CS2_VibeSignatures32026年10月20日 更新

Create a new find-XXXX preprocessor Python script from scratch (no existing SKILL.md), add configs/<GAMEVER>.yaml skill and symbol entries. Covers xref-string-based and LLM_DECOMPILE-based discovery patterns. Use when a GitHub issue or user instruction specifies a new function to find.

中文简介正在准备中。当前显示原文说明。

mrc4tt/CS2_VibeSignatures32026年10月20日 更新

查看 mrc4tt 的全部技能

报告此技能的问题