find-CCSPlayer_MovementServices_CheckJumpButton_WaterPatch

Name: find-CCSPlayer_MovementServices_CheckJumpButton_WaterPatch
Author: HLND2T

58stars10forks

How to install find-CCSPlayer_MovementServices_CheckJumpButton_WaterPatch?

hlnd2t/cs2_vibesignatures/find-ccsplayer_movementservices_checkjumpbutton_waterpatch

$npx -y skills add HLND2T/CS2_VibeSignatures --skill find-CCSPlayer_MovementServices_CheckJumpButton_WaterPatch

Installs into the current project.

Summary

Find and patch the water jump velocity inside CCSPlayer_MovementServices_CheckJumpButton in CS2 binary using IDA Pro MCP. This patch changes the water jump velocity from 100.0f to 145.0f by modifying the immediate operand of a mov instruction. Use this skill when reverse engineer

Files · 1

View on GitHub

SKILL.md

1	# CCSPlayer_MovementServices_CheckJumpButton_WaterPatch
2
3	## Overview
4
5	Locate the water jump velocity assignment inside `CCSPlayer_MovementServices_CheckJumpButton` and generate a patch that changes the immediate value from `100.0f` (0x42C80000) to `145.0f` (0x43110000).
6
7	The target code pattern in pseudocode:
8	```c
9	if ( v5 == (int *)0x8000 ) // move type check for water
10	{
11	(_DWORD )(a2 + 64) = 1120403456; // <-- patch target: 100.0f -> 145.0f
12	}
13	```
14
15	In assembly, this is a `mov dword ptr [reg+40h], 42C80000h` instruction. The patch changes the immediate operand from `42C80000h` (100.0f) to `43110000h` (145.0f).
16
17	## Prerequisites
18
19	- `CCSPlayer_MovementServices_CheckJumpButton` must already be identified. Use SKILL `/get-func-from-yaml` with `func_name=CCSPlayer_MovementServices_CheckJumpButton` to load its address. If YAML does not exist, run SKILL `/find-CCSPlayer_MovementServices_CheckJumpButton` first.
20
21	## Location Steps
22
23	### 1. Get CheckJumpButton Function Address
24
25	ALWAYS Use SKILL `/get-func-from-yaml` with `func_name=CCSPlayer_MovementServices_CheckJumpButton`.
26
27	If the skill returns an error, stop and report to user.
28
29	### 2. Decompile and Locate the Water Jump Pattern
30
31	Decompile the function:
32
33	```
34	mcp__ida-pro-mcp__decompile(addr="<func_va>")
35	```
36
37	In the decompiled output, search for the water jump velocity pattern. The key indicators are:
38	- A comparison against `0x8000` (water move type)
39	- Inside the if-block: `(_DWORD )(a2 + 64) = 1120403456` (which is 100.0f as IEEE 754)
40	- Note: `1120403456` decimal = `0x42C80000` = `100.0f` in IEEE 754 floating point
41
42	Note the address annotation on the assignment line.
43
44	### 3. Disassemble Around the Assignment
45
46	Disassemble the function around the annotated address to find the exact `mov` instruction:
47
48	```
49	mcp__ida-pro-mcp__disasm(addr="<func_va>", offset=<estimated_offset>, max_instructions=20)
50	```
51
52	Look for this assembly pattern:
53	```asm
54	cmp rax, 8000h ; check water move type
55	jnz short loc_XXXXXXXX ; skip if not water
56	mov dword ptr [rsi+40h], 42C80000h ; <-- patch target: 100.0f
57	```
58
59	Record:
60	- patch_va: Address of the `mov dword ptr [reg+40h], 42C80000h` instruction
61
62	### 4. Determine Patch Bytes
63
64	Read the original bytes of the `mov` instruction:
65
66	```
67	mcp__ida-pro-mcp__get_bytes(regions={"addr": "<patch_va>", "size": 7})
68	```
69
70	The original 7-byte instruction: `C7 46 40 00 00 C8 42`
71	- `C7 46 40` = opcode + ModR/M for `mov dword ptr [rsi+40h]`
72	- `00 00 C8 42` = immediate `0x42C80000` (100.0f, little-endian)
73
74	Patch bytes: `C7 46 40 00 00 11 43`
75	- Same opcode + ModR/M
76	- `00 00 11 43` = immediate `0x43110000` (145.0f, little-endian)
77
78	### 5. Generate Patch Signature
79
80	ALWAYS Use SKILL `/generate-signature-for-patch` to generate and validate the signature.
81
82	Required context for the skill:
83	- `func_name`: `CCSPlayer_MovementServices_CheckJumpButton`
84	- `func_va`: From step 1
85	- `patch_va`: Address of the `mov` instruction from step 3
86	- `original_instruction`: `mov dword ptr [rsi+40h], 42C80000h`
87	- `patched_instruction`: `mov dword ptr [rsi+40h], 43110000h`
88	- `description`: `Change water jump velocity from 100.0f to 145.0f in CheckJumpButton`
89
90	### 6. Write YAML Output
91
92	ALWAYS Use SKILL `/write-patch-as-yaml` to persist the results.
93
94	Required parameters:
95	- `patch_name`: `CCSPlayer_MovementServices_CheckJumpButton_WaterPatch`
96	- `patch_sig`: The validated signature from step 5
97	- `patch_bytes`: `C7 46 40 00 00 11 43`
98	- `patch_sig_disp`: From step 5 result (omit if 0)
99
100	## IEEE 754 Float Reference
101
102	- `100.0f` = `0x42C80000` = `1120403456` decimal
103	- `145.0f` = `0x43110000` = `1125122048` decimal
104
105	## Output YAML Files
106
107	- `CCSPlayer_MovementServices_CheckJumpButton_WaterPatch.windows.yaml`
108	- `CCSPlayer_MovementServices_CheckJumpButton_WaterPatch.linux.yaml`

People who liked this also viewed

6 picks

Type

find-CCSPlayer_MovementServices_CheckJumpButton_WaterPatch

58stars10forks

View on GitHub

How to install find-CCSPlayer_MovementServices_CheckJumpButton_WaterPatch?

hlnd2t/cs2_vibesignatures/find-ccsplayer_movementservices_checkjumpbutton_waterpatch

$npx -y skills add HLND2T/CS2_VibeSignatures --skill find-CCSPlayer_MovementServices_CheckJumpButton_WaterPatch

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# CCSPlayer_MovementServices_CheckJumpButton_WaterPatch
2
3	## Overview
4
5	Locate the water jump velocity assignment inside `CCSPlayer_MovementServices_CheckJumpButton` and generate a patch that changes the immediate value from `100.0f` (0x42C80000) to `145.0f` (0x43110000).
6
7	The target code pattern in pseudocode:
8	```c
9	if ( v5 == (int *)0x8000 ) // move type check for water
10	{
11	(_DWORD )(a2 + 64) = 1120403456; // <-- patch target: 100.0f -> 145.0f
12	}
13	```
14
15	In assembly, this is a `mov dword ptr [reg+40h], 42C80000h` instruction. The patch changes the immediate operand from `42C80000h` (100.0f) to `43110000h` (145.0f).
16
17	## Prerequisites
18
19	- `CCSPlayer_MovementServices_CheckJumpButton` must already be identified. Use SKILL `/get-func-from-yaml` with `func_name=CCSPlayer_MovementServices_CheckJumpButton` to load its address. If YAML does not exist, run SKILL `/find-CCSPlayer_MovementServices_CheckJumpButton` first.
20
21	## Location Steps
22
23	### 1. Get CheckJumpButton Function Address
24
25	ALWAYS Use SKILL `/get-func-from-yaml` with `func_name=CCSPlayer_MovementServices_CheckJumpButton`.
26
27	If the skill returns an error, stop and report to user.
28
29	### 2. Decompile and Locate the Water Jump Pattern
30
31	Decompile the function:
32
33	```
34	mcp__ida-pro-mcp__decompile(addr="<func_va>")
35	```
36
37	In the decompiled output, search for the water jump velocity pattern. The key indicators are:
38	- A comparison against `0x8000` (water move type)
39	- Inside the if-block: `(_DWORD )(a2 + 64) = 1120403456` (which is 100.0f as IEEE 754)
40	- Note: `1120403456` decimal = `0x42C80000` = `100.0f` in IEEE 754 floating point
41
42	Note the address annotation on the assignment line.
43
44	### 3. Disassemble Around the Assignment
45
46	Disassemble the function around the annotated address to find the exact `mov` instruction:
47
48	```
49	mcp__ida-pro-mcp__disasm(addr="<func_va>", offset=<estimated_offset>, max_instructions=20)
50	```
51
52	Look for this assembly pattern:
53	```asm
54	cmp rax, 8000h ; check water move type
55	jnz short loc_XXXXXXXX ; skip if not water
56	mov dword ptr [rsi+40h], 42C80000h ; <-- patch target: 100.0f
57	```
58
59	Record:
60	- patch_va: Address of the `mov dword ptr [reg+40h], 42C80000h` instruction
61
62	### 4. Determine Patch Bytes
63
64	Read the original bytes of the `mov` instruction:
65
66	```
67	mcp__ida-pro-mcp__get_bytes(regions={"addr": "<patch_va>", "size": 7})
68	```
69
70	The original 7-byte instruction: `C7 46 40 00 00 C8 42`
71	- `C7 46 40` = opcode + ModR/M for `mov dword ptr [rsi+40h]`
72	- `00 00 C8 42` = immediate `0x42C80000` (100.0f, little-endian)
73
74	Patch bytes: `C7 46 40 00 00 11 43`
75	- Same opcode + ModR/M
76	- `00 00 11 43` = immediate `0x43110000` (145.0f, little-endian)
77
78	### 5. Generate Patch Signature
79
80	ALWAYS Use SKILL `/generate-signature-for-patch` to generate and validate the signature.
81
82	Required context for the skill:
83	- `func_name`: `CCSPlayer_MovementServices_CheckJumpButton`
84	- `func_va`: From step 1
85	- `patch_va`: Address of the `mov` instruction from step 3
86	- `original_instruction`: `mov dword ptr [rsi+40h], 42C80000h`
87	- `patched_instruction`: `mov dword ptr [rsi+40h], 43110000h`
88	- `description`: `Change water jump velocity from 100.0f to 145.0f in CheckJumpButton`
89
90	### 6. Write YAML Output
91
92	ALWAYS Use SKILL `/write-patch-as-yaml` to persist the results.
93
94	Required parameters:
95	- `patch_name`: `CCSPlayer_MovementServices_CheckJumpButton_WaterPatch`
96	- `patch_sig`: The validated signature from step 5
97	- `patch_bytes`: `C7 46 40 00 00 11 43`
98	- `patch_sig_disp`: From step 5 result (omit if 0)
99
100	## IEEE 754 Float Reference
101
102	- `100.0f` = `0x42C80000` = `1120403456` decimal
103	- `145.0f` = `0x43110000` = `1125122048` decimal
104
105	## Output YAML Files
106
107	- `CCSPlayer_MovementServices_CheckJumpButton_WaterPatch.windows.yaml`
108	- `CCSPlayer_MovementServices_CheckJumpButton_WaterPatch.linux.yaml`

People who liked this also viewed

6 picks

Type