Find CBaseTrigger_vtable-decompiles
Target: CBaseTrigger_vtable (func) in the module loaded in THIS session.
The old artifact/preprocessor anchors no longer match this build. Use anchors
only to locate candidates; derive the artifact from the ACTUAL bytes you read.
Produce ONLY this session's platform output. NEVER open another binary.
func_sig is required for CBaseTrigger_EndTouch / StartTouch
The CounterStrikeSharp generator keeps the template sig when a vfunc artifact has no
func_sig; on 14181 the stale template resolved CBaseTrigger_EndTouch.windows to an
unrelated function (RVA 0x136a0d0) while the vtable slot is RVA 0x3cb540. Always emit
func_sig for these two artifacts (linux EndTouch: sig the real function 55 BA ?? ?? ?? ?? 48 89 E5 41 57 ..., not the null-check thunk 48 85 F6 74 ?? E9 the vtable points at).
uv run abi_guard.py checks artifact + template.
Method
Locate via distinctive constants/strings in the body, cross-references from
known callers/callees, or the owning class vtable (RTTI) if virtual. Verify by
decompilation before committing to a candidate.
Mandatory self-check before emitting
The pipeline re-reads the bytes at your func_va and regenerates func_sig from
them - a mismatch aborts the run. Therefore: read the real bytes via IDA MCP,
derive the artifact FROM those bytes (wildcard relocated operands as ??), start
at the TRUE function head, and only then write the YAML. A mismatch is always a
bug in YOUR output.
Output schema (STRICT)
Write CBaseTrigger_vtable.{platform}.yaml with EXACTLY these fields:
func_name: <TASK>
func_va: "<hex virtual address>"
func_rva: "<hex rva>"
func_size: "<hex size>"
func_sig: "<byte pattern, ?? wildcards, function head, minimal-unique>"
NEVER include vfunc_* or struct fields.
Verification
- Decompile and confirm the behavior matches the symbol's semantics.
- Uniqueness: the pattern must match exactly ONE location in the loaded binary.
- If no candidate can be confirmed, report the shortlist - a skipped symbol is
safer than a wrong signature.