find-ccsplayerpawnbase-postthink

name

find-CCSPlayerPawnBase_PostThink

description

IDA Pro string analysis and function reverse engineering workflow. Connect to IDA Pro via ida-pro-mcp for binary analysis to locate the CCSPlayerPawnBase_PostThink function. Use cases: (1) Search for specific strings in binary files (2) Find cross-references (xrefs) to strings (3) Decompile functions that reference strings and view pseudocode (4) Locate specific code segments in pseudocode (5) Rename functions and variables to improve readability (6) Analyze function call relationships and data flow Trigger: CCSPlayerPawnBase_PostThink

CCSPlayerPawnBase_PostThink Function Location Workflow

Overview

This workflow is used to locate the CCSPlayerPawnBase_PostThink function in CS2 server binary files. This function is the PostThink handler for player Pawns, responsible for handling enter/exit events for buy zones, bomb zones, and rescue zones.

Location Steps

1. Search for Signature String

Use find_regex to search for the enter_buyzone string:

mcp__ida-pro-mcp__find_regex(pattern="enter_buyzone")

Expected result: Find string address (e.g., 0x86ebfd for Linux, varies by version)

2. Find Cross-References

Use xrefs_to to find locations that reference this string:

mcp__ida-pro-mcp__xrefs_to(addrs="<string_addr>")

Expected result: Find the function that references the string (e.g., sub_A58DE0)

3. Rename Function

Use rename to give the function a meaningful name:

mcp__ida-pro-mcp__rename(batch={"func": {"addr": "<function_addr>", "name": "CCSPlayerPawnBase_PostThink"}})

4. Find VTable and Calculate Offset

ALWAYS Use SKILL /get-vtable-index to get vtable offset and index for the function.

VTable class name: CCSPlayerPawn

5. Generate and Validate Unique Signature

ALWAYS Use SKILL /generate-signature-for-function to generate a robust and unique signature for CCSPlayerPawnBase_PostThink.

6. Write IDA analysis output as YAML beside the binary

ALWAYS Use SKILL /write-vfunc-as-yaml to write the analysis results.

Required parameters:

• func_name: CCSPlayerPawnBase_PostThink
• func_addr: The function address from step 2
• func_sig: The validated signature from step 6

VTable parameters (when this is a virtual function):

• vtable_name: CCSPlayerPawn
• vfunc_offset: The offset from step 5
• vfunc_index: The index from step 5

Function Characteristics

The CCSPlayerPawnBase_PostThink function contains the following signature strings:

• enter_buyzone / exit_buyzone - Buy zone events
• enter_bombzone / exit_bombzone - Bomb zone events
• enter_rescue_zone / exit_rescue_zone - Rescue zone events
• weapon_c4 - C4 bomb detection
• SpottedLooseBomb - AFK player dropped bomb notification
• isplanted - Bomb planted state check

VTable Information

• VTable Name: CCSPlayerPawn
• VTable Mangled Name:
  • Windows: ??_7CCSPlayerPawn@@6B@
  • Linux: _ZTV13CCSPlayerPawn
• VTable Offset: 0xB98 (may change with game updates)
• VTable Index: 371 (may change with game updates)

Output YAML Format

The output YAML filename depends on the platform:

• server.dll → CCSPlayerPawnBase_PostThink.windows.yaml
• server.so / libserver.so → CCSPlayerPawnBase_PostThink.linux.yaml

Related Functions

• sub_1387560 - Check if in buy zone
• sub_1390A80 - Check if can purchase
• sub_15A47B0 - Find specified weapon (e.g., "weapon_c4")
• qword_257FF40 - Game event manager