Find CDecoyProjectile_Create
Locate CDecoyProjectile_Create in CS2 server.dll or libserver.so using IDA Pro MCP tools.
This is a non-virtual, direct-call static factory (no vtable slot - emit a byte sig, not an
offset). It is found via the entity classname string "decoy_projectile" it references
(passed to the entity-create path when spawning the projectile). The RTTI/class string
"CDecoyProjectile" is a different referencer and must be excluded.
Concrete anchors for THIS target (use these first)
FULLMATCH:weapon_decoyFULLMATCH:projectile_decoy
KNOWN CONTAMINATION WARNING
VA 0x20c2700 (BuyState_OnUpdate) has WRONGLY been emitted for this target before.
It is NOT this function. If your best candidate is 0x20c2700, you have NOT found
the target - keep searching or report the shortlist instead of guessing.
Method
1. Reuse previous signature (fast path)
If a prior CDecoyProjectile_Create.{platform}.yaml exists, try its func_sig via
mcp__ida-pro-mcp__find_bytes. Single match -> resolve to function start, skip to Step 4. Else continue.
2. Anchor on the classname string
Locate the exact string "decoy_projectile" (FULLMATCH - not the longer
"CDecoyProjectile" RTTI string). Take its cross-references (mcp__ida-pro-mcp__xrefs_to).
3. Identify Create among the referencers
Create is the referencer that spawns the projectile entity: it creates the entity by classname,
then initializes the decoy-projectile fields (velocity/owner/params) and returns the new object.
Exclude any referencer reached via the "CDecoyProjectile" RTTI string. Confirm the candidate
is the compact factory wrapper (not a large think/update routine). Record func_addr.
4. Generate signature
ALWAYS use SKILL /generate-signature-for-function with addr=<func_addr>. Emit IDA style
verbatim (space hex, ? wildcards) - do NOT convert to CSS \x2A unless a gamedata.json
entry is explicitly requested.
Reference sig (sanity check only, regenerate per binary):
- linux:
55 4C 89 C1 48 89 E5 41 57 45 89 CF 41 56 49 89 FE 41 55 49 89 D5 48 89 F2 48 89 FE 41 54 48 8D 3D ? ? ? ? 4D 89 C4 53 48 83 EC ? E8 ? ? ? ? 45 31 C0
- windows:
48 8B C4 55 56 48 81 EC 68 01 00 00
5. Write func YAML
ALWAYS use SKILL /write-func-as-yaml:
func_name: CDecoyProjectile_Createfunc_addr: <func_addr>func_sig: validated sig from step 4
Function Characteristics
- Linkage: non-virtual, direct-call static factory (no vtable entry)
- Binary:
server.dll / libserver.so
- Distinguishing trait: references the
"decoy_projectile" entity classname string;
NOT the "CDecoyProjectile" RTTI string
Preprocessor pipeline equivalent
find-CDecoyProjectile_Create [xref_strings FULLMATCH:decoy_projectile,
exclude_strings CDecoyProjectile]
Output YAML Format
server.dll -> CDecoyProjectile_Create.windows.yamllibserver.so -> CDecoyProjectile_Create.linux.yaml