find-g_pGameTypes-AND-IGameTypes_CreateWorkshopMapGroup

Find g_pGameTypes and IGameTypes_CreateWorkshopMapGroup

Locate g_pGameTypes (global variable) and IGameTypes_CreateWorkshopMapGroup (virtual function offset) in CS2 server.dll or server.so using IDA Pro MCP tools.

Method

1. Search for the string

mcp__ida-pro-mcp__find_regex pattern="mapgroup workshop"

Expected match: "mapgroup workshop;" at some address in the binary.

2. Get cross-references to the string

mcp__ida-pro-mcp__xrefs_to addrs="<string_addr>"

3. Decompile the referencing function

mcp__ida-pro-mcp__decompile addr="<function_addr>"

Verify the function contains the pattern:

(*(void (__fastcall **)(__int64, const char *, __int64 *))(*(_QWORD *)qword_XXXXXXXX + 296LL))(
    qword_XXXXXXXX,      // This is g_pGameTypes
    "workshop",
    &v_local);
sub_XXXXXXXXX((char *)&v_local2 + 4, "mapgroup workshop;");

The key identifiers:

• qword_XXXXXXXX accessed with a virtual function call at offset 296 (0x128) — this is g_pGameTypes
• The vfunc call at offset 0x128 is IGameTypes::CreateWorkshopMapGroup, can change on game update

4. Disassemble around the call to find exact instruction addresses

mcp__ida-pro-mcp__disasm addr="<load_instruction_addr>" max_instructions=15

Look for the instruction sequence:

mov     rcx, cs:qword_XXXXXXXX     ; loads g_pGameTypes
lea     r8, [rsp+...]
lea     rdx, aWorkshop              ; "workshop"
mov     rax, [rcx]
call    qword ptr [rax+128h]        ; IGameTypes::CreateWorkshopMapGroup
lea     rdx, aMapgroupWorksh        ; "mapgroup workshop;"

Record:

• The address of qword_XXXXXXXX — this is the g_pGameTypes global variable
• The address of call qword ptr [rax+128h] — this is the vfunc call instruction

5. Rename the global variable

mcp__ida-pro-mcp__rename batch={"data": {"old": "qword_XXXXXXXX", "new": "g_pGameTypes"}}

6. Generate signature for g_pGameTypes

ALWAYS Use SKILL /generate-signature-for-globalvar to generate a robust and unique signature for g_pGameTypes.

7. Generate signature for IGameTypes_CreateWorkshopMapGroup

ALWAYS Use SKILL /generate-signature-for-vfuncoffset to generate a robust and unique signature for the vfunc call instruction.

Parameters:

• inst_addr: The address of the call qword ptr [rax+128h] instruction from step 4
• vfunc_offset: 0x128 (296 decimal), can change on game update.

8. Write IDA analysis output as YAML

For IGameTypes_CreateWorkshopMapGroup:

ALWAYS Use SKILL /write-vfunc-as-yaml to write the analysis results.

Required parameters:

• func_name: IGameTypes_CreateWorkshopMapGroup
• func_addr: None (this is a vfunc call site, not a direct function)
• func_sig: None
• vfunc_sig: The validated signature from step 7
• vtable_name: IGameTypes
• vfunc_offset: 0x128
• vfunc_index: 37 (0x128 / 8)

For g_pGameTypes:

ALWAYS Use SKILL /write-globalvar-as-yaml to write the analysis results.

Required parameters:

• gv_name: g_pGameTypes
• gv_addr: The global variable address from step 4
• gv_sig: The validated signature from step 6
• gv_sig_va: The virtual address that signature matches
• gv_inst_offset: 0
• gv_inst_length: Length of the GV-accessing instruction
• gv_inst_disp: Displacement offset within the instruction

Signature Pattern

The function contains a workshop map group registration pattern:

"workshop"           — passed as the map group type identifier
"mapgroup workshop;" — used to build a console command string

Function / Global Variable Characteristics

g_pGameTypes

• Type: Global pointer (IGameTypes*)
• Purpose: Singleton interface pointer to the game types system, managing map groups, game modes, and game types
• Access Pattern: Typically accessed via mov rcx, cs:g_pGameTypes before calling virtual methods through the vtable
• Virtual Function Table: Contains methods for managing game types including CreateWorkshopMapGroup at offset 0x128

IGameTypes_CreateWorkshopMapGroup

• Interface: IGameTypes
• VTable Offset: 0x128 (296 decimal)
• VTable Index: 37
• Purpose: Creates/registers a workshop map group with the given map paths
• Call Pattern: g_pGameTypes->vtable[37](g_pGameTypes, "workshop", &mapPathArray)
• Parameters:
  1. this — g_pGameTypes pointer
  2. const char* — group type identifier ("workshop")
  3. CUtlVector* — array of workshop map path strings

Output YAML Format

The output YAML filename for IGameTypes_CreateWorkshopMapGroup depends on the platform:

• server.dll → IGameTypes_CreateWorkshopMapGroup.windows.yaml
• server.so / libserver.so → IGameTypes_CreateWorkshopMapGroup.linux.yaml

The output YAML filename for g_pGameTypes depends on the platform:

• server.dll → g_pGameTypes.windows.yaml
• server.so / libserver.so → g_pGameTypes.linux.yaml