find-CEntitySystem_m_entityNames

Name: find-CEntitySystem_m_entityNames
Author: HLND2T

58stars10forks

How to install find-CEntitySystem_m_entityNames?

hlnd2t/cs2_vibesignatures/find-centitysystem_m_entitynames

$npx -y skills add HLND2T/CS2_VibeSignatures --skill find-CEntitySystem_m_entityNames

Installs into the current project.

Summary

Final-guarantee fallback for the find-CEntitySystem_m_entityNames preprocessor. Recovers CEntitySystem::m_entityNames in CS2 server.dll / libserver.so by decompiling CEntitySystem_AddEntityToNameMap and recognizing its ordered-map/RB-tree lookup whether the lookup helper is emitt

Files · 1

View on GitHub

SKILL.md

1	# Find CEntitySystem_m_entityNames (final-guarantee fallback)
2
3	Recover `CEntitySystem::m_entityNames` in CS2 `server.dll` / `libserver.so` using IDA Pro MCP tools. This is
4	the Agent fallback for `find-CEntitySystem_m_entityNames`; it runs only after the preprocessor fails. Produce
5	the missing struct-offset YAML even when the anonymous ordered-map lookup helper was inlined into
6	`CEntitySystem_AddEntityToNameMap` and the expected `sub_*(this + off + 8, this + off, &key)` call no longer
7	exists.
8
9	## Realworld Function References
10
11	Read the platform-relevant YAML before searching in IDA. Treat every address and offset as a reference-build
12	value only and verify it against the current binary.
13
14	- `ida_preprocessor_scripts/references/server/CEntitySystem_AddEntityToNameMap.windows.yaml`
15	- `ida_preprocessor_scripts/references/server/CEntitySystem_AddEntityToNameMap.linux.yaml`
16
17	The Linux reference includes both the historical lookup helper pseudocode and the predecessor pseudocode. Its
18	`a1 + 2800` annotation is an older-layout example; build 14168 moved the Linux member to `0xAF8`. Never copy a
19	reference displacement without checking the current function.
20
21	## Background and semantic fingerprint
22
23	`CEntitySystem_AddEntityToNameMap(this, identity)` reads the entity-name key from `identity + 0x18`, returns
24	when it is null, looks the key up in `this->m_entityNames`, and either appends the entity handle to an existing
25	`CEntityNameList` or allocates a new 32-byte list and inserts it into the ordered map.
26
27	Identify this map operation by the whole fingerprint, not by an anonymous helper name:
28
29	- the key comes from `identity + 0x18`;
30	- RB-tree node indices use `0xFFFF` as the null sentinel;
31	- nodes are 24 bytes and compare their key field against the entity-name key;
32	- the duplicate path calls `_UtlRBTree_FailedInsertDuplicate` or references the assertion text
33	`Found existing value when inserting into tree`;
34	- the new-value path allocates 32 bytes for the `CEntityNameList` and inserts the entity handle into it.
35
36	The first argument is the owning `CEntitySystem *`: `rcx` on Windows and `rdi` on Linux, commonly copied to a
37	callee-saved register such as `rbx` or `r12`. Confirm every candidate displacement is relative to that pointer.
38
39	## Robustness principle: accept both compiler shapes
40
41	Do not search for the literal name `sub_1E59BD0`; anonymous names and function boundaries change per build.
42
43	1. Decompile `CEntitySystem_AddEntityToNameMap` and first look for a separate ordered-map/RB-tree lookup call.
44	Historical Linux builds pass values equivalent to `this + off + 8`, `this + off`, and `&key`. Windows may
45	materialize `this + off`, then pass `this + off + 8` plus a small context object containing the base and key.
46	2. If that call is absent, assume the helper was inlined. Locate the direct RB-tree traversal using the
47	semantic fingerprint above. The usual container field cluster is:
48	- node count at `this + off`;
49	- allocation/capacity flags at `this + off + 2`;
50	- node-storage pointer at `this + off + 8`;
51	- root index at `this + off + 0x10`;
52	- nearby free-list/tree bookkeeping at `this + off + 0x12` and `this + off + 0x14`.
53	3. Infer one common `off` from at least three of those accesses and verify it against the insertion path. Prefer
54	a direct `lea reg, [this + off]` that feeds tree insertion/bookkeeping. On Linux 14168, for example, the
55	inlined traversal accesses `this + 0xB08`, `this + 0xAFA`, and `this + 0xB00`, then materializes
56	`this + 0xAF8`; all four imply `off = 0xAF8`.
57	4. If the predecessor calls a plausible lookup helper instead, decompile it and follow the arguments. Recover
58	`off` from the caller's `this`-relative expressions; helper-local offsets are offsets within the map, not
59	within `CEntitySystem`.
60
61	Reject candidates that do not participate in the entity-name-key lookup and subsequent existing/new
62	`CEntityNameList` branches.
63
64	## Output inventory
65
66	Offsets are ground-truth reference values from build 14168 and must be re-derived for the current binary.
67
68	\| Output symbol \| Kind \| Windows \| Linux \| Writer skill \|
69	\|---------------\|------\|---------\|-------\|--------------\|
70	\| `CEntitySystem_m_entityNames` \| struct member \| `0xAF0` \| `0xAF8` \| `/write-structoffset-as-yaml` \|
71
72	Platform gating: emit this output on both Windows and Linux. `struct_na

People who liked this also viewed

6 picks

Type

find-CEntitySystem_m_entityNames

58stars10forks

View on GitHub

How to install find-CEntitySystem_m_entityNames?

hlnd2t/cs2_vibesignatures/find-centitysystem_m_entitynames

$npx -y skills add HLND2T/CS2_VibeSignatures --skill find-CEntitySystem_m_entityNames

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Find CEntitySystem_m_entityNames (final-guarantee fallback)
2
3	Recover `CEntitySystem::m_entityNames` in CS2 `server.dll` / `libserver.so` using IDA Pro MCP tools. This is
4	the Agent fallback for `find-CEntitySystem_m_entityNames`; it runs only after the preprocessor fails. Produce
5	the missing struct-offset YAML even when the anonymous ordered-map lookup helper was inlined into
6	`CEntitySystem_AddEntityToNameMap` and the expected `sub_*(this + off + 8, this + off, &key)` call no longer
7	exists.
8
9	## Realworld Function References
10
11	Read the platform-relevant YAML before searching in IDA. Treat every address and offset as a reference-build
12	value only and verify it against the current binary.
13
14	- `ida_preprocessor_scripts/references/server/CEntitySystem_AddEntityToNameMap.windows.yaml`
15	- `ida_preprocessor_scripts/references/server/CEntitySystem_AddEntityToNameMap.linux.yaml`
16
17	The Linux reference includes both the historical lookup helper pseudocode and the predecessor pseudocode. Its
18	`a1 + 2800` annotation is an older-layout example; build 14168 moved the Linux member to `0xAF8`. Never copy a
19	reference displacement without checking the current function.
20
21	## Background and semantic fingerprint
22
23	`CEntitySystem_AddEntityToNameMap(this, identity)` reads the entity-name key from `identity + 0x18`, returns
24	when it is null, looks the key up in `this->m_entityNames`, and either appends the entity handle to an existing
25	`CEntityNameList` or allocates a new 32-byte list and inserts it into the ordered map.
26
27	Identify this map operation by the whole fingerprint, not by an anonymous helper name:
28
29	- the key comes from `identity + 0x18`;
30	- RB-tree node indices use `0xFFFF` as the null sentinel;
31	- nodes are 24 bytes and compare their key field against the entity-name key;
32	- the duplicate path calls `_UtlRBTree_FailedInsertDuplicate` or references the assertion text
33	`Found existing value when inserting into tree`;
34	- the new-value path allocates 32 bytes for the `CEntityNameList` and inserts the entity handle into it.
35
36	The first argument is the owning `CEntitySystem *`: `rcx` on Windows and `rdi` on Linux, commonly copied to a
37	callee-saved register such as `rbx` or `r12`. Confirm every candidate displacement is relative to that pointer.
38
39	## Robustness principle: accept both compiler shapes
40
41	Do not search for the literal name `sub_1E59BD0`; anonymous names and function boundaries change per build.
42
43	1. Decompile `CEntitySystem_AddEntityToNameMap` and first look for a separate ordered-map/RB-tree lookup call.
44	Historical Linux builds pass values equivalent to `this + off + 8`, `this + off`, and `&key`. Windows may
45	materialize `this + off`, then pass `this + off + 8` plus a small context object containing the base and key.
46	2. If that call is absent, assume the helper was inlined. Locate the direct RB-tree traversal using the
47	semantic fingerprint above. The usual container field cluster is:
48	- node count at `this + off`;
49	- allocation/capacity flags at `this + off + 2`;
50	- node-storage pointer at `this + off + 8`;
51	- root index at `this + off + 0x10`;
52	- nearby free-list/tree bookkeeping at `this + off + 0x12` and `this + off + 0x14`.
53	3. Infer one common `off` from at least three of those accesses and verify it against the insertion path. Prefer
54	a direct `lea reg, [this + off]` that feeds tree insertion/bookkeeping. On Linux 14168, for example, the
55	inlined traversal accesses `this + 0xB08`, `this + 0xAFA`, and `this + 0xB00`, then materializes
56	`this + 0xAF8`; all four imply `off = 0xAF8`.
57	4. If the predecessor calls a plausible lookup helper instead, decompile it and follow the arguments. Recover
58	`off` from the caller's `this`-relative expressions; helper-local offsets are offsets within the map, not
59	within `CEntitySystem`.
60
61	Reject candidates that do not participate in the entity-name-key lookup and subsequent existing/new
62	`CEntityNameList` branches.
63
64	## Output inventory
65
66	Offsets are ground-truth reference values from build 14168 and must be re-derived for the current binary.
67
68	\| Output symbol \| Kind \| Windows \| Linux \| Writer skill \|
69	\|---------------\|------\|---------\|-------\|--------------\|
70	\| `CEntitySystem_m_entityNames` \| struct member \| `0xAF0` \| `0xAF8` \| `/write-structoffset-as-yaml` \|
71
72	Platform gating: emit this output on both Windows and Linux. `struct_na

People who liked this also viewed

6 picks

Type