# find-IGameSystem_InitAllSystems-AND-IGameSystem_InitAllSystems_pFirst > Find and identify IGameSystem_InitAllSystems (function) and IGameSystem_InitAllSystems_pFirst (global variable) in CS2 binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or server.so to locate the game system initialization linked list head pointer by searching for the "IGameSystem::InitAllSystems" string and analyzing cross-references. - Skill: `tools-only/find-igamesystem-initallsystems-and-igamesystem-initallsyste` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds add tools-only/find-igamesystem-initallsystems-and-igamesystem-initallsyste` - Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/find-igamesystem-initallsystems-and-igamesystem-initallsyste/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: tools-only (https://skillmd.com/u/tools-only) - Updated: 2026-09-08 - Page: https://skillmd.com/skills/tools-only/find-igamesystem-initallsystems-and-igamesystem-initallsyste --- # Find IGameSystem_InitAllSystems and IGameSystem_InitAllSystems_pFirst Locate `IGameSystem_InitAllSystems` (function) and `IGameSystem_InitAllSystems_pFirst` (global variable) in CS2 server.dll or server.so using IDA Pro MCP tools. ## Method 1. Search for the debug string: ``` mcp__ida-pro-mcp__find_regex pattern="IGameSystem::InitAllSystems" ``` 2. Get cross-references to the string: ``` mcp__ida-pro-mcp__xrefs_to addrs="" ``` 3. Decompile the referencing function: ``` mcp__ida-pro-mcp__decompile addr="" ``` 4. Verify the code pattern - look for: ```c ToolsStallMonitorInternal_BeginScope(v17); for ( i = IGameSystem_InitAllSystems_pFirst; i; i = *(_QWORD *)(i + 8) ) { v2 = *(const char **)(i + 16); if ( *(_WORD *)CUtlSymbolTable::Find(&unk_XXXXXXXX, &v20, v2) != 0xFFFF ) { Plat_FatalError("Game System %s is defined twice!\n", v2); __debugbreak(); } ``` * The matching function is "IGameSystem::InitAllSystems" 5. Rename the function (if not already named): ``` mcp__ida-pro-mcp__rename batch={"func": [{"addr": "", "name": "IGameSystem_InitAllSystems"}]} ``` 6. Identify the global variable address and rename it: - The global variable is referenced in the for loop: `for ( i = IGameSystem_InitAllSystems_pFirst; ...` - If it shows as `qword_XXXXXXXX`, rename it: ``` mcp__ida-pro-mcp__rename batch={"data": {"old": "", "new": "IGameSystem_InitAllSystems_pFirst"}} ``` 7. Generate and validate unique signature for `IGameSystem_InitAllSystems`: **ALWAYS** Use SKILL `/generate-signature-for-function` to generate a robust and unique signature for the function. 8. Write IDA analysis output for `IGameSystem_InitAllSystems` as YAML beside the binary: **ALWAYS** Use SKILL `/write-func-as-yaml` to write the analysis results. Required parameters: - `func_name`: `IGameSystem_InitAllSystems` - `func_addr`: The function address from step 3 - `func_sig`: The validated signature from step 7 Note: This is NOT a virtual function, so no vtable parameters are needed. 9. Generate and validate unique signature for `IGameSystem_InitAllSystems_pFirst`: **ALWAYS** Use SKILL `/generate-signature-for-globalvar` to generate a robust and unique signature for the global variable: IGameSystem_InitAllSystems_pFirst. 10. Write IDA analysis output for `IGameSystem_InitAllSystems_pFirst` as YAML beside the binary: **ALWAYS** Use SKILL `/write-globalvar-as-yaml` to write the analysis results. Required parameters: - `gv_name`: `IGameSystem_InitAllSystems_pFirst` - `gv_addr`: The global variable address from step 6 - `gv_sig`: The validated signature from step 9 - `gv_sig_va`: The virtual address that signature matches - `gv_inst_offset`: Offset from signature start to GV-accessing instruction - `gv_inst_length`: Length of the GV-accessing instruction - `gv_inst_disp`: Displacement offset within the instruction ## Code Pattern The `IGameSystem_InitAllSystems` function iterates through a linked list of game systems: ```c for ( i = IGameSystem_InitAllSystems_pFirst; i; i = *(_QWORD *)(i + 8) ) { // i + 0x00: unknown // i + 0x08: next pointer // i + 0x10: system name (const char*) } ``` ## Global Variable Characteristics - **Type**: `qword` (8 bytes, pointer to linked list node) - **Purpose**: Head pointer of the game system initialization linked list - **Usage**: Iterated during game system initialization to register and initialize all game systems ## Instruction Pattern The global variable is typically accessed with a RIP-relative MOV instruction: ``` 48 8B 1D XX XX XX XX mov rbx, cs:IGameSystem_InitAllSystems_pFirst 48 85 DB test rbx, rbx 0F 84 XX XX XX XX jz ``` ## Output YAML Format The output YAML filename depends on the platform: - `server.dll` → `IGameSystem_InitAllSystems.windows.yaml`, `IGameSystem_InitAllSystems_pFirst.windows.yaml` - `server.so` → `IGameSystem_InitAllSystems.linux.yaml`, `IGameSystem_InitAllSystems_pFirst.linux.yaml` ### Function YAML (IGameSystem_InitAllSystems) ```yaml func_va: 0x1804F3DC0 # Virtual address of the function - changes with game updates func_rva: 0x4F3DC0 # Relative virtual address (VA - image base) - changes with game updates func_size: 0x329 # Function size in bytes - changes with game updates func_sig: XX XX XX XX XX # Unique byte signature for pattern scanning - changes with game updates ``` ### Global Variable YAML (IGameSystem_InitAllSystems_pFirst) ```yaml gv_va: 0x181d7d128 # Global variable virtual address - changes with game updates gv_rva: 0x1d7d128 # Relative virtual address (VA - image base) - changes with game updates gv_sig: 48 8B 1D ?? ?? ?? ?? 48 85 DB 0F 84 ?? ?? ?? ?? BD FF FF 00 00 gv_sig_va: 0x1804f3df3 # The virtual address that signature matches gv_inst_offset: 0 # GV instruction starts at signature start gv_inst_length: 7 # 48 8B 1D XX XX XX XX = 7 bytes gv_inst_disp: 3 # Displacement offset starts at position 3 (after 48 8B 1D) ``` ## Runtime Resolution At runtime, after pattern scan finds the signature: ```cpp // C++ example uint8_t* instr_addr = scan_result + gv_inst_offset; int32_t rip_offset = *(int32_t*)(instr_addr + gv_inst_disp); void* gv_address = instr_addr + gv_inst_length + rip_offset; ```