Find CCSNavArea_IsValidNavMesh
Locate CCSNavArea_IsValidNavMesh in CS2 server.dll or libserver.so using IDA Pro MCP tools.
This is a direct-call predicate (emit a byte sig, not an offset). The whole body is 15 bytes:
lea rax, g_pNavMesh
cmp qword ptr [rax], 0
setnz al
retn
i.e. return g_pNavMesh != nullptr. It has no debug string, and g_pNavMesh has 200+
referencers, so neither anchors it alone.
Primary resolution = the tail byte pattern 48 83 38 ? 0F 95 C0 C3
(cmp [rax],0 ; setnz al ; retn), which is unique in .text. Intersecting it with a
g_pNavMesh reference keeps it robust if the tail ever recurs after an update.
Method
1. Reuse previous signature (fast path)
If a prior CCSNavArea_IsValidNavMesh.{platform}.yaml exists, try its func_sig via
mcp__ida-pro-mcp__find_bytes. Single match → resolve to function start, skip to Step 4. Else continue.
2. Locate via the unique tail pattern
mcp__ida-pro-mcp__find_bytes patterns="48 83 38 ?? 0F 95 C0 C3"
Exactly one match. Resolve the containing function start (mcp__ida-pro-mcp__lookup_funcs) —
that function is CCSNavArea_IsValidNavMesh. Optionally rename it.
3. Confirm (optional)
Decompile and confirm the body is return g_pNavMesh != 0; — a single lea to the g_pNavMesh
global, a cmp [rax], 0, setnz al, retn.
4. Generate signature
ALWAYS use SKILL /generate-signature-for-function with addr=<func_addr>. Emit IDA style
verbatim (space hex, ? wildcards).
Reference sig (build 14165 — sanity check only, regenerate per binary):
- linux:
48 8D 05 ? ? ? ? 48 83 38 ? 0F 95 C0 C3
5. Write func YAML
ALWAYS use SKILL /write-func-as-yaml:
func_name: CCSNavArea_IsValidNavMeshfunc_addr: <func_addr>func_sig: validated sig from step 4
Function Characteristics
- Linkage: direct-call predicate, referenced from a vtable slot (no string referencer)
- Binary:
server.dll / libserver.so
- Distinguishing trait: unique tail
48 83 38 ? 0F 95 C0 C3; reads the g_pNavMesh global
Discovery Strategy (why this is stable across updates)
The body is the minimal "global non-null" predicate, so its byte sig is the whole function and
self-heals once re-resolved. The tail cmp [rax],0 ; setnz al ; retn is unique in .text;
intersecting with a g_pNavMesh reference disambiguates if the tail ever recurs.
Preprocessor pipeline equivalent
find-CCSNavArea_IsValidNavMesh [xref_gvs g_pNavMesh ∩ xref_signatures "48 83 38 ? 0F 95 C0 C3"]
Output YAML Format
server.dll -> CCSNavArea_IsValidNavMesh.windows.yamllibserver.so -> CCSNavArea_IsValidNavMesh.linux.yaml