find-ccsplayer-itemservices-givenameditem

name	find-CCSPlayer_ItemServices_GiveNamedItem
description	Find and identify the CCSPlayer_ItemServices_GiveNamedItem function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the GiveNamedItem wrapper function in CCSPlayer_ItemServices vtable by searching for the "GiveNamedItem: interpreting" string reference and analyzing vtable entries.

Find CCSPlayer_ItemServices_GiveNamedItem

Locate CCSPlayer_ItemServices_GiveNamedItem in CS2 server.dll or libserver.so using IDA Pro MCP tools.

Method

1. Search for the target string

Search for the debug string used by the underlying GiveNamedItem function:

mcp__ida-pro-mcp__find_regex pattern="GiveNamedItem: interpreting"

This will find: "GiveNamedItem: interpreting '%s' as '%s'\n"

2. Get cross-references to the string

mcp__ida-pro-mcp__xrefs_to addrs="<string_addr>"

This identifies the main GiveNamedItem function that uses this string.

3. Read CCSPlayer_ItemServices vtable information from yaml

ALWAYS Use SKILL /get-vtable-from-yaml with class_name=CCSPlayer_ItemServices.

If the skill returns an error, STOP and report to user.

Otherwise, extract these values for subsequent steps:

• vtable_va: The vtable start address (use as <VTABLE_START>)
• vtable_numvfunc: The valid vtable entry count (last valid index = count - 1)
• vtable_entries: An array of virtual functions starting from vtable[0]

4. Read vtable entries at indices 18-24

Get the vtable address from step 3, then read the virtual function pointers:

mcp__ida-pro-mcp__get_int queries=[
  {"addr": "<vtable_addr + 0xb0>", "ty": "u64le"},
  {"addr": "<vtable_addr + 0xb8>", "ty": "u64le"},
  {"addr": "<vtable_addr + 0xc0>", "ty": "u64le"},
  {"addr": "<vtable_addr + 0xc8>", "ty": "u64le"},
  {"addr": "<vtable_addr + 0xd0>", "ty": "u64le"},
  {"addr": "<vtable_addr + 0xd8>", "ty": "u64le"},
  {"addr": "<vtable_addr + 0xe0>", "ty": "u64le"}
]

5. Decompile each vtable function

For each function address retrieved in step 4:

mcp__ida-pro-mcp__decompile addr="<function_addr>"

6. Identify the target function

For EACH function from step 5, determine whether:

• A) The function directly references the target string from step 1, OR
• B) The function calls (directly or indirectly) the GiveNamedItem function from step 2

The target function will be the FIRST wrapper that directly calls GiveNamedItem. Look for decompiled code like:

__int64 __fastcall sub_XXXXXX(__int64 a1, char *a2, double a3, float a4) //This is actually the vfunc "CCSPlayer_ItemServices::GiveNamedItem", or what we called "CCSPlayer_ItemServices_GiveNamedItem"
{
  return GiveNamedItem(a1, a2, 0, 0, 0, 0, a3, a4);//It calls a regular function "GiveNamedItem"
}

7. Rename the function

mcp__ida-pro-mcp__rename batch={"func": [{"addr": "<function_addr_sub_XXXXXX>", "name": "CCSPlayer_ItemServices_GiveNamedItem"}]}

8. Find vtable offset and index

ALWAYS Use SKILL /get-vtable-index to get vtable offset and index for the function.

VTable class name: CCSPlayer_WeaponServices

9. Generate and validate unique signature

ALWAYS Use SKILL /generate-signature-for-function to generate a robust and unique signature for the function.

10. Write IDA analysis output as YAML

ALWAYS Use SKILL /write-vfunc-as-yaml to write the analysis results.

Required parameters:

• func_name: CCSPlayer_ItemServices_GiveNamedItem
• func_addr: The function address from step 6
• func_sig: The validated signature from step 9

Vtable parameters:

• vtable_name: CCSPlayer_ItemServices
• vfunc_offset: The offset from step 8
• vfunc_index: The index from step 8

Function Characteristics

• Type: Virtual function wrapper
• Purpose: Thin wrapper around the main GiveNamedItem function
• Parameters:
  • this - CCSPlayer_ItemServices pointer
  • itemName - Name of the item to give
  • Additional parameters for position/rotation (zeroed in wrapper)
• Implementation: Calls GiveNamedItem with zeroed optional parameters

Signature Pattern

The target function is a simple wrapper that:

1. Clears registers (r9d, r8d, ecx, edx) to zero
2. Jumps directly to the main GiveNamedItem function

This pattern makes the function very short (typically 15 bytes) and requires including surrounding context (padding or next function prologue) for signature uniqueness.

Vtable Information

Windows (server.dll)

• Vtable Name: CCSPlayer_ItemServices::\vftable'`
• Vtable Mangled Name: ??_7CCSPlayer_ItemServices@@6B@
• Vtable Index: 20 - May change with game updates
• Vtable Offset: 0xb0 - May change with game updates

Linux (libserver.so)

• Vtable Name: vtable for CCSPlayer_ItemServices
• Vtable Mangled Name: _ZTV22CCSPlayer_ItemServices
• Vtable Index: 20 - May change with game updates
• Vtable Offset: 0xb0 (from virtual function table start, +0x10 from symbol start) - May change with game updates

Important for Linux: The first 16 bytes of the vtable symbol are RTTI metadata. The actual virtual function pointers start at _ZTV22CCSPlayer_ItemServices + 0x10.

Output YAML Format

The output YAML filename depends on the platform:

• server.dll → CCSPlayer_ItemServices_GiveNamedItem.windows.yaml
• libserver.so → CCSPlayer_ItemServices_GiveNamedItem.linux.yaml

Related Functions

Other vtable entries at indices 18-24 include:

• Index 18: Returns 0 (nullsub)
• Index 19: Destructor wrapper
• Index 20: CCSPlayer_ItemServices_GiveNamedItem ⭐ (This function)
• Index 21: GiveNamedItem with different parameters (returns bool)
• Index 22: Another GiveNamedItem wrapper
• Index 23-24: Other item service functions

Only indices 20, 21, and 22 directly call the main GiveNamedItem function.