IDA Source2Forge
C++ 1
// Overview
ConVar and ConCommand recovery for Source 2 binaries in IDA Pro 9. It finds the registration constructors from their argument shape rather than hardcoded addresses, names every registered global and command handler, decodes FCVAR flags, and lists every place a variable's object is referenced. Runs on Windows, Linux and macOS, with JSON/CSV export and an IDAPython API.
// Built with
C++IDA Pro SDKSource 2ConVar
// The problem
A Source 2 binary registers hundreds of console variables and commands, but a stripped build leaves them as anonymous globals and unnamed callbacks. Recovering them by hand means chasing every registration call, decoding the flag word by eye, and starting over on the next game patch.
// Approach
- Discover the registration constructors from the call sites themselves, by walking the strings shaped like convar names and profiling what each argument slot carries.
- Separate variables from commands by behaviour: a variable's object is read again after registration, a command's is written once and dispatched through its callback.
- Surface it all inside IDA: ConVar and Command choosers, decoded FCVAR flags, descriptions as repeatable comments, use-site lists, JSON/CSV export and an IDC API for IDAPython.
// Engineering challenges
- Telling a real registration constructor apart from a string helper with the same argument shape: the helper pours many names into one buffer, a registration gives each object exactly one.
- Recovering a command's handler when the constructor only ever sees a pointer to the stack delegate the function was loaded into.
- Naming hl2sdk functions only where the evidence settles which one it is, since a real SDK name on the wrong function is worse than the address name.
