find-ccsplayer-weaponservices-selectitem

name	find-CCSPlayer_WeaponServices_SelectItem
description	Find and identify the CCSPlayer_WeaponServices_SelectItem virtual function in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or server.so to locate the SelectItem function in CCSPlayer_WeaponServices vtable. Trigger: CCSPlayer_WeaponServices_SelectItem, SelectItem, weapon select, switch weapon
disable-model-invocation	true

CCSPlayer_WeaponServices_SelectItem Function Location Workflow

Overview

This workflow is used to locate the CCSPlayer_WeaponServices_SelectItem function in CS2 server binary files. This is a virtual function in the CCSPlayer_WeaponServices vtable responsible for switching the player's active weapon. It is called by bot AI (e.g., CCSBot::SwitchToBestWeapon) and other weapon management code.

Location Steps

1. Search for Signature String

Use find_regex to search for the Grenade.*THROW FAILED string, which appears in a caller of this function:

mcp__ida-pro-mcp__find_regex(pattern="Grenade.*THROW FAILED")

Expected result: Find string address (e.g., 0x18155aaf8 for Windows, varies by version)

2. Find Cross-References to String

Use xrefs_to to find the function referencing this string:

mcp__ida-pro-mcp__xrefs_to(addrs="<string_addr>")

Expected result: Find a grenade think function (e.g., sub_1802D0550) that contains the string reference.

3. Decompile and Identify the Caller Function

Decompile the function found in step 2:

mcp__ida-pro-mcp__decompile(addr="<function_addr>")

Look for the following code pattern in the THROW FAILED branch:

sub_XXXXXXX(a1, 1);  // CCSBot_SwitchToBestWeapon(bot, forceEquip)

4. Rename and Decompile CCSBot_SwitchToBestWeapon

the function called with (a1, 1) in the THROW FAILED branch is CCSBot_SwitchToBestWeapon

mcp__ida-pro-mcp__rename(batch={"func": {"addr": "<CCSBot_SwitchToBestWeapon_function_addr>", "name": "CCSBot_SwitchToBestWeapon"}})

Decompile CCSBot_SwitchToBestWeapon. Look for the weapon selection pattern:

// Pattern: weaponServices->vtable[SelectItem](weaponServices, weapon, 0)
(*(void (__fastcall **)(...))(**(_QWORD **)(*(_QWORD *)(a1 + 24) + <WeaponServices_offset>LL) + <vtable_offset>LL))(
    *(_QWORD *)(*(_QWORD *)(a1 + 24) + <WeaponServices_offset>LL),
    weapon,
    0LL);

The function at the vtable offset used in this indirect call is CCSPlayer_WeaponServices_SelectItem.

5. Get VTable Info and Resolve the Target Function

ALWAYS Use SKILL /get-vtable-from-yaml with class_name=CCSPlayer_WeaponServices.

If the skill returns an error, STOP and report to user.

Otherwise, use the vtable entries to calculate the index from the vtable offset observed in the disassembly:

• vfunc_index = vtable_offset / 8 (for 64-bit binaries)

Read the function address from vtable_entries[index].

6. Rename Function

Use rename to give the function a meaningful name:

mcp__ida-pro-mcp__rename(batch={"func": {"addr": "<function_addr>", "name": "CCSPlayer_WeaponServices_SelectItem"}})

7. Generate and Validate Unique Signature

ALWAYS Use SKILL /generate-signature-for-function to generate a robust and unique signature for the function.

8. Write IDA analysis output as YAML beside the binary

ALWAYS Use SKILL /write-vfunc-as-yaml to write the analysis results.

Required parameters:

• func_name: CCSPlayer_WeaponServices_SelectItem
• func_addr: The function address from step 5
• func_sig: The validated signature from step 7

VTable parameters:

• vtable_name: CCSPlayer_WeaponServices
• vfunc_offset: The offset from step 5
• vfunc_index: The index from step 5

Function Characteristics

The CCSPlayer_WeaponServices_SelectItem function:

• Is a virtual function in the CCSPlayer_WeaponServices vtable
• Signature: bool SelectItem(CCSPlayer_WeaponServices *this, CBasePlayerWeapon *weapon, int switchReason)
• Handles weapon switching logic including:
  • Checking if weapon switching is allowed (sub_180B88A20)
  • Getting current active weapon
  • If target weapon is already active: special handling for holster/deploy cycles
  • If target weapon is different: holster old weapon, deploy new weapon, handle old weapon cleanup
• Returns 1 on successful switch, 0 on failure

VTable Information

• VTable Name: CCSPlayer_WeaponServices
• VTable Mangled Name:
  • Windows: ??_7CCSPlayer_WeaponServices@@6B@
  • Linux: _ZTV24CCSPlayer_WeaponServices
• VTable Offset: 0xD0 (may change with game updates)
• VTable Index: 26 (may change with game updates)

Output YAML Format

The output YAML filename depends on the platform:

• server.dll → CCSPlayer_WeaponServices_SelectItem.windows.yaml
• server.so / libserver.so → CCSPlayer_WeaponServices_SelectItem.linux.yaml

Related Functions

• CCSBot_SwitchToBestWeapon - Bot AI function that calls SelectItem to equip best weapon
• CCSPlayer_WeaponServices_Weapon_GetSlot - Gets weapon in a specific slot
• Grenade think function - Contains THROW FAILED string, calls SwitchToBestWeapon on failure