Find Host_Say

Locate Host_Say in CS2 server.dll / libserver.so using IDA Pro MCP tools.

Method

1. Find the Chat-Relay Format String

mcp__ida-pro-mcp__find_regex pattern="%s %s @ %s:"

Host_Say logs every broadcast chat message to the console/log using a format string of the shape "%s %s @ %s: " (e.g. "<player> say[_team]* @ <lobby/lobbyid>: "-style console relay tag), which is unique in the binary.

Linux 14168 reference: the string "%s %s @ %s: " is at 0x91b835.

2. Get the Referencing Function

mcp__ida-pro-mcp__xrefs_to addr="0x91b835"

The string has exactly one xref; its containing function is Host_Say.

Linux 14168 reference: 0x91b835 is referenced from 0x17ece73, inside the function starting at 0x17ec540 (size 0xa0e).

3. Sanity-Check the Candidate

mcp__ida-pro-mcp__decompile addr="0x17ec540"

Confirm the decompilation is consistent with Host_Say's known role: takes a client/command-context pointer, a parsed command-args structure, and flags distinguishing team-say from all-chat; builds/sanitizes the chat text, applies mute/gag and dead-talk restrictions, then relays the formatted message to the console and to recipients via the networking layer.

4. Generate Function Signature

ALWAYS Use SKILL /generate-signature-for-function with addr=0x17ec540 to generate a robust and unique func_sig.

Linux 14168 reference: generated signature is 55 48 89 E5 41 57 49 89 F7 41 56 41 55 41 89 D5 — already unique across the binary at this length.

5. Write IDA Analysis Output as YAML

ALWAYS Use SKILL /write-func-as-yaml to write the analysis results.

Required parameters:

• func_name: Host_Say
• func_addr: 0x17ec540
• func_sig: The validated signature from step 4

Function Characteristics

• Purpose: Handles the say/say_team command path — validates/sanitizes chat text, applies mute/gag and dead-talk rules, and relays the message to the console log and to the appropriate set of recipients.
• Binary: server.dll / libserver.so
• Parameters: (unsigned __int8 *pEntityOrClient, int *pArgsOrCookie, unsigned __int8 bTeamOnly, unsigned int a4, __int64 a5) (observed decompiled shape; exact semantic naming of the trailing parameters is not confirmed beyond "command context/flags").
• Return value: void.

Discovery Strategy

1. Host_Say unconditionally logs each processed chat message using the distinctive format string "%s %s @ %s: ", which does not appear anywhere else in the binary.
2. The string has a single xref, so its containing function is unambiguous.
3. The candidate's parameter shape (client/command context + team-only flag) and body (text sanitization, mute checks, console relay) match Host_Say's known behavior.

This is robust because the anchor string is a literal, verbatim format string that survives recompilation and refactoring as long as the log format itself is unchanged, and it has a single unambiguous xref.

Output YAML Format

The output YAML filename depends on the platform:

• server.dll -> Host_Say.windows.yaml
• libserver.so -> Host_Say.linux.yaml

Fields: func_name, func_va, func_rva, func_size, func_sig.