Find CNetworkGameServerBase_CreateFakeClient (final-guarantee fallback)

Recover the concrete CNetworkGameServerBase_CreateFakeClient function in CS2 engine2.dll / libengine2.so using IDA Pro MCP tools. This is an Agent fallback: it runs only when ida_preprocessor_scripts/find-CNetworkGameServerBase_CreateFakeClient.py cannot resolve the target.

Realworld Function References

The finder has no dedicated predecessor reference YAML. Use these related references for the class and calling conventions; their addresses and offsets are reference-build values and must be verified against the current binary.

• ida_preprocessor_scripts/references/engine/CNetworkGameServerBase_Init.windows.yaml
• ida_preprocessor_scripts/references/engine/CNetworkGameServerBase_Init.linux.yaml
• ida_preprocessor_scripts/references/engine/CNetworkGameServerBase_ConnectClient.windows.yaml
• ida_preprocessor_scripts/references/engine/CNetworkGameServerBase_ConnectClient.linux.yaml

Semantic fingerprint

CNetworkGameServerBase_CreateFakeClient is a member of CNetworkGameServerBase that creates and initializes a fake network client. The deterministic finder anchors it with both exact string references 30000 and rate. Those literals identify the rate initialization in the target or in a small helper it calls; do not identify the function from either literal alone.

The first argument is the server object (rcx on Windows, usually rdi/r12 on Linux). Confirm that the candidate allocates or initializes a client and that the 30000/rate values belong to that initialization path, not to an unrelated command or diagnostic routine.

Step 0. Skip an existing output

If CNetworkGameServerBase_CreateFakeClient.<platform>.yaml already exists in the active artifact module directory and parses to a non-empty mapping, skip that platform. Never derive the artifact path from bin.

Step 1. Locate the target in IDA

1. Search the current binary for the exact string literals 30000 and rate (including command-table or format string variants), then enumerate their code xrefs.
2. Decompile each function that references both anchors. Prefer the candidate whose first parameter is the CNetworkGameServerBase object and whose body creates a client, sets its connection/rate state, or calls the client initialization helper.
3. If the two strings occur in a helper, follow callers and callees one level in each direction until the containing CNetworkGameServerBase member is identified. The helper may be inlined or outlined on either platform, so use the client-construction and rate-initialization semantics rather than a fixed address.
4. Reject candidates that only register a console command, format a message, or initialize an unrelated rate.

The reference artifacts for build 14167 are only orientation values (verify every field against the current binary):

Platform	Reference func_va	Reference func_rva	Reference size
Windows	0x1800af840	0xaf840	0x24d
Linux	0x6968d0	0x6968d0	0x2b8

Step 2. Generate the signature and write YAML

After confirming the candidate:

1. Use SKILL /generate-signature-for-function with the resolved function address. The signature must be generated from the current function body and pass its uniqueness checks.
2. Use SKILL /write-func-as-yaml with:
   • func_name=CNetworkGameServerBase_CreateFakeClient
   • func_addr=<resolved address>
   • func_rva=<resolved address minus image base>
   • func_size=<current function size>
   • func_sig=<validated signature>

Write one output per input platform:

• CNetworkGameServerBase_CreateFakeClient.windows.yaml beside engine2.dll
• CNetworkGameServerBase_CreateFakeClient.linux.yaml beside libengine2.so

Failure handling

• If no candidate references both semantic anchors, inspect nearby callers/callees and decompiled client creation helpers before stopping.
• If the candidate cannot be distinguished from an unrelated rate-setting routine, stop and report the ambiguity; do not guess from the 14167 values.
• Never emit a Windows result while analyzing Linux or vice versa.