CS2签名生成

Requirements

1. uv

1. depotdownloader

1. claude / codex

1. IDA Pro 9.0+

1. ida-pro-mcp

1. idalib (mandatory for ida_analyze_bin.py)

1. Clang-LLVM (mandatory for run_cpp_tests.py)

`CItemDefuser_Spawn` and `CBaseModelEntity_SetModel` for example

1.Look for desired symbols in IDA

• Search string "weapons/models/defuser/defuser.vmdl" in IDA, look for code snippet with following pattern in xrefs to the string:

    v2 = a2;
    v3 = (__int64)a1;
    sub_180XXXXXX(a1, (__int64)"weapons/models/defuser/defuser.vmdl"); //This is CBaseModelEntity_SetModel, rename it to CBaseModelEntity_SetModel
    sub_180YYYYYY(v3, v2);
    v4 = (_DWORD *)sub_180ZZZZZZ(&unk_181AAAAAA, 0xFFFFFFFFi64);
    if ( !v4 )
      v4 = *(_DWORD **)(qword_181BBBBBB + 8);
    if ( *v4 == 1 )
    {
      v5 = (__int64 *)(*(__int64 (__fastcall **)(__int64, const char *, _QWORD, _QWORD))(*(_QWORD *)qword_181CCCCCC + 48i64))(
                        qword_181CCCCCC,
                        "defuser_dropped",
                        0i64,
                        0i64);

The function with this code snippet is CItemDefuser_Spawn

2. Create preprocessor script and update config.yaml

Claude Code:

/create-preprocessor-scripts Create "find-CItemDefuser_Spawn" in server by xref_strings "weapons/models/defuser/defuser.vmdl" "defuser_dropped", where CItemDefuser_Spawn is a vfunc of CItemDefuser_vtable.

Claude Code:

/create-preprocessor-scripts Create "find-CBaseModelEntity_SetModel" in server by LLM_DECOMPILE with "CItemDefuser_Spawn", where CBaseModelEntity_SetModel is a regular function being called in "CItemDefuser_Spawn".

`IGameSystem_InitAllSystems_pFirst` for example

1. Look for desired symbols in IDA

• Search string "IGameSystem::InitAllSystems" in IDA, search xrefs for the string. the function with xref to the string is IGameSystem_InitAllSystems.
• Rename it to IGameSystem_InitAllSystems if not renamed yet.
• Look for code pattern at very beginning of IGameSystem_InitAllSystems: "( i = qword_XXXXXX; i; i = (_QWORD )(i + 8) )"
• Rename qword_XXXXXX previously found to IGameSystem_InitAllSystems_pFirst if it was not renamed yet.

2. Create preprocessor script and update config.yaml

Claude Code:

/create-preprocessor-scripts Create "find-IGameSystem_InitAllSystems" in server by xref_strings "IGameSystem::InitAllSystems", where IGameSystem_InitAllSystems is a regular func.

Claude Code:

/create-preprocessor-scripts Create "find-IGameSystem_InitAllSystems_pFirst" in server by LLM_DECOMPILE with "IGameSystem_InitAllSystems", where IGameSystem_InitAllSystems_pFirst is a global variable being used in "IGameSystem_InitAllSystems".

`CGameResourceService_m_pEntitySystem` for example.

1. Look for desired symbols in IDA

• Search string "CGameResourceService::BuildResourceManifest(start)" in IDA, search xrefs for the string.

• The xref should point to a function - this is CGameResourceService_BuildResourceManifest. rename it to CGameResourceService_BuildResourceManifest if not renamed yet.

2. Create preprocessor script and update config.yaml

Claude Code:

/create-preprocessor-scripts Create "find-CGameResourceService_BuildResourceManifest" in engine by xref_strings "CGameResourceService::BuildResourceManifest(start)" , where CGameResourceService_BuildResourceManifest is a vfunc of CGameResourceService_vtable.

/create-preprocessor-scripts Create "find-CGameResourceService_m_pEntitySystem" in engine by LLM_DECOMPILE with "CGameResourceService_BuildResourceManifest", where CGameResourceService_m_pEntitySystem is a struct offset.

2. Find and generate signatures for all symbols declared in `config.yaml`

 uv run ida_analyze_bin.py -gamever 14156 [-oldgamever=14155] [-configyaml=path/to/config.yaml] [-modules=server] [-platform=windows] [-agent=claude/codex/"claude.cmd"/"codex.cmd"] [-maxretry=3] [-vcall_finder=g_pNetworkMessages|*] [-llm_model=gpt-4o] [-llm_apikey=your-key] [-llm_baseurl=https://api.example.com/v1] [-llm_temperature=0.2] [-llm_effort=medium] [-llm_fake_as=codex] [-rename] [-debug]
 

• Shared LLM CLI parameters:
• -llm_apikey: required when an LLM-backed workflow is enabled, including vcall_finder aggregation and LLM_DECOMPILE
• -llm_baseurl: optional custom compatible base URL (required when -llm_fake_as=codex)
• -llm_model: optional, defaults to gpt-4o
• -llm_temperature: optional; sent only when explicitly set
• -llm_effort: optional; defaults to medium; supports none|minimal|low|medium|high|xhigh
• -llm_fake_as: optional; codex switches to direct /v1/responses SSE transport
• Env fallbacks: CS2VIBE_LLM_APIKEY, CS2VIBE_LLM_BASEURL, CS2VIBE_LLM_MODEL, CS2VIBE_LLM_TEMPERATURE, CS2VIBE_LLM_EFFORT, CS2VIBE_LLM_FAKE_AS
• LLM workflows do not read OPENAI_API_KEY, OPENAI_API_BASE, or OPENAI_API_MODEL

• Old signatures from bin/{previous_gamever}/{module}/{symbol}.{platform}.yaml will be used to find symbols in current version of game binaries directly through mcp call before actually running Agent SKILL(s). No token will be consumed in this case.

• -agent="claude.cmd" is for claude cli installed from Windows npm

• We prefer programmatic preprocessor scripts > LLM_DECOMPILE based preprocessor scripts > Agent with SKILL.md

• when -rename specified, run rename/comment post-processing over existing expected-output YAML files.

vcall_finder related

• -vcall_finder=g_pNetworkMessages filters by an object declared in the module-level vcall_finder config; -vcall_finder=* processes every declared object from config.yaml.

• When -vcall_finder is enabled, the script exports full disassembly and pseudocode for each referencing function into vcall_finder/{gamever}/{object_name}/{module}/{platform}/, then runs LLM aggregation after all module/platform IDA work finishes; if a detail YAML already has a top-level found_vcall, that function skips the LLM call and reuses the cached result directly.

• After a successful LLM response, the script immediately writes back found_vcall: [...] or found_vcall: [] to the corresponding detail YAML so reruns can skip that function's LLM call.

• vcall_finder/{gamever}/{object_name}.txt is now an appended YAML document stream; each record directly contains insn_va, insn_disasm, and vfunc_offset without a nested found_vcall: wrapper.

uv run ida_analyze_bin.py -gamever=14141 -modules=networksystem -platform=windows -vcall_finder=g_pNetworkMessages -llm_model=gpt-5.4 -llm_apikey=your-key -llm_effort=high -llm_fake_as=codex -llm_baseurl=http://127.0.0.1:8080/v1

Example outputs:

• vcall_finder/14141/g_pNetworkMessages/networksystem/windows/sub_140123450.yaml
• vcall_finder/14141/g_pNetworkMessages.txt

• IDA preprocessor environment:
• CS2VIBE_STRING_MIN_LENGTH: controls optional IDA string-list setup for preprocessor string enumeration only
• Unset or empty: do not call idautils.Strings.setup; use the IDB's current string-list state
• Integer >=1: call idautils.Strings.setup(strtypes=[ida_nalt.STRTYPE_C], minlen=<value>) when the current IDB has not already been set up with the same parameters
• Non-integer or values <1: fall back to 4 and use the same IDB-level setup guard
• Setup state is stored per IDB; changing the effective minlen triggers setup again
• This is not an LLM parameter

reference YAML for LLM_DECOMPILE

Reference YAML path:

• ida_preprocessor_scripts/references/<module>/<func_name>.<platform>.yaml

Preparation steps:

1. Confirm the target function already has a current-version YAML with func_va, or can be resolved in IDA by symbol name/alias from config.yaml.
2. Run standalone CLI:

uv run generate_reference_yaml.py -gamever 14141 -module engine -platform windows -func_name CNetworkGameClient_RecordEntityBandwidth -mcp_host 127.0.0.1 -mcp_port 13337

Auto-start idalib-mcp example:

uv run generate_reference_yaml.py -gamever 14141 -module engine -platform windows -func_name CNetworkGameClient_RecordEntityBandwidth -auto_start_mcp -binary bin/14141/engine/engine2.dll

3. Check generated YAML: - func_va is credible - disasm_code is non-empty and matches target function semantics - procedure matches expected semantics when available (it can be an empty string when Hex-Rays is unavailable) - func_name only confirms the output file targets your requested canonical name; it does not prove address resolution correctness 4. Wire it in target find-*.py LLM_DECOMPILE: - Generated file path in repository: - ida_preprocessor_scripts/references/<module>/<func_name>.<platform>.yaml - If LLM_DECOMPILE uses relative path, write: - references/<module>/<func_name>.<platform>.yaml - Example tuple: - ("CNetworkMessages_FindNetworkGroup", "prompt/call_llm_decompile.md", "references/engine/CNetworkGameClient_RecordEntityBandwidth.windows.yaml") - LLM_DECOMPILE uses the same shared ida_analyze_bin.py -llm_* flags: -llm_model, -llm_apikey, -llm_baseurl, -llm_temperature, -llm_effort, -llm_fake_as

CI/CD workflow references

@echo Download latest game binaries

uv run download_bin.py -gamever %CS2_GAMEVER%

@echo Analyze game binaries

uv run ida_analyze_bin.py -gamever %CS2_GAMEVER% -agent="claude.cmd" -platform %CS2_PLATFORM% -debug

@echo Update gamedata with generated yamls

uv run update_gamedata.py -gamever %CS2_GAMEVER% -debug

@echo Find mismatches in CS2SDK headers and fix them

uv run run_cpp_tests.py -gamever %CS2_GAMEVER% -debug -fixheader -agent="claude.cmd"

Overall workflow

Troubleshooting