OnServerVoiceData_IsPlayingDemo_Callee Patch Workflow
Overview
This Windows-only patch finder converts the already-generated
IVEngineClient2_IsPlayingDemo.windows.yaml vfunc metadata into
OnServerVoiceData_IsPlayingDemo_Callee.windows.yaml.
The target call site is inside C_ServerVoiceHandler::OnServerVoiceData:
asmmov rcx, cs:g_pSource2EngineToClient mov rax, [rcx] call qword ptr [rax+150h] ; IVEngineClient2::IsPlayingDemo test al, al jz short loc_...
The patch address is the address of the indirect call instruction itself.
Prerequisite
The following input YAML must already exist in the current client module output directory:
textIVEngineClient2_IsPlayingDemo.windows.yaml
Its required fields are:
yamlfunc_name: IVEngineClient2_IsPlayingDemo vtable_name: IVEngineClient2 vfunc_offset: '0x150' vfunc_index: 42 vfunc_sig: FF 90 50 01 00 00 84 C0 74 ?? 83 FD ??
Deterministic Preprocessor
Run through the configured ida_analyze_bin.py pipeline. The corresponding script is:
textida_preprocessor_scripts/find-OnServerVoiceData_IsPlayingDemo_Callee.py
The script performs these checks without LLM invocation:
- Rejects every platform except Windows.
- Reads the input vfunc YAML from the current client output directory.
- Verifies the function name, vtable name, and
vfunc_offset / 8 == vfunc_indexrelationship. - Verifies that
vfunc_sigstarts with the concrete encoding ofcall qword ptr [rax+vfunc_offset]. - Calls IDA MCP
find_byteswith the fullvfunc_sigand requires exactly one match. - Writes the match address as
patch_va, derivespatch_rvafrom the image base, copiesvfunc_sigtopatch_sig, and writespatch_sig_disp: 0.
Output
For game version 14173, the expected output is:
yamlpatch_name: OnServerVoiceData_IsPlayingDemo_Callee patch_va: '0x180aec45d' patch_rva: '0xaec45d' patch_sig: FF 90 50 01 00 00 84 C0 74 ?? 83 FD ?? patch_sig_disp: 0
No patch_bytes field is generated because this skill identifies the callee call site;
the downstream consumer decides how that call instruction is patched.
Failure Conditions
Stop and report failure when any of the following occurs:
- The input YAML is missing or malformed.
- The vfunc offset and index disagree.
- The signature does not begin at the expected indirect call.
- The signature has zero or multiple matches.
- The match address or image base is invalid.


