# Find CCSBotManager AddBot BotNavIgnore

> |

- **Type:** Skill
- **Install:** `agentstack add skill-hlnd2t-cs2-vibesignatures-find-ccsbotmanager-addbot-botnavignore`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [HLND2T](https://agentstack.voostack.com/s/hlnd2t)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [HLND2T](https://github.com/HLND2T)
- **Source:** https://github.com/HLND2T/CS2_VibeSignatures/tree/main/.claude/skills/find-CCSBotManager_AddBot_BotNavIgnore

## Install

```sh
agentstack add skill-hlnd2t-cs2-vibesignatures-find-ccsbotmanager-addbot-botnavignore
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# CCSBotManager_AddBot_BotNavIgnore Patch Workflow

## Overview

Locate the `g_pNavMesh` null-check at the beginning of `CCSBotManager_AddBot` and generate a patch that converts the conditional `jz` (jump-if-zero) into an unconditional `jmp` past the early-return, so bots can be added even when no navigation mesh is loaded.

The target code pattern in pseudocode:
```c
if ( !g_pNavMesh || !*(_BYTE *)(g_pNavMesh + 264) )   //  jmp to loc after the nav check
```

The `jz` is a near conditional jump (`0F 84 rel32` — 6 bytes). Patching it to `jmp rel32` (`E9  90` — 5 bytes + 1 NOP) makes it always jump past both the null-pointer check and the `g_pNavMesh + 264` byte check, landing at the code that continues bot creation.

The jump target should be the `loc_` label that is reached after both nav mesh checks pass (the code right after the second `jz` that also targets the same early-return).

## Prerequisites

- `CCSBotManager_AddBot` must already be identified. Use SKILL `/get-func-from-yaml` with `func_name=CCSBotManager_AddBot` to load its address. If YAML does not exist, run SKILL `/find-CCSBotManager_AddBot-AND-g_pCSBotManager-AND-g_pNavMesh` first.

## Location Steps

### 1. Get CCSBotManager_AddBot Function Address

**ALWAYS** Use SKILL `/get-func-from-yaml` with `func_name=CCSBotManager_AddBot`.

If the skill returns an error, stop and report to user.

### 2. Decompile and Locate the Nav Mesh Check

Decompile the function:

```
mcp__ida-pro-mcp__decompile(addr="")
```

In the decompiled output, search for the nav mesh check pattern at the very beginning of the function body. The key indicators are:
- `if ( !g_pNavMesh || !*(_BYTE *)(g_pNavMesh + 264) )` or equivalent
- Immediately followed by `return 0;`

Note the address annotation on the if-statement line.

### 3. Disassemble the Function Prologue

Disassemble the first ~30 instructions of the function to find the exact `test rax, rax` + `jz` pair:

```
mcp__ida-pro-mcp__disasm(addr="", max_instructions=30)
```

Look for this assembly pattern:
```asm
mov     rax, cs:g_pNavMesh
...
test    rax, rax
jz      loc_XXXXXXXX         ; early return if g_pNavMesh == NULL
cmp     byte ptr [rax+108h], 0
jz      loc_XXXXXXXX         ; early return if nav mesh not loaded
```

Record:
- **patch_va**: Address of the first `jz` instruction (the `test rax, rax` / `jz` pair)
- **jump_target**: The address of the code right AFTER the second `jz` — this is where execution continues when both checks pass. This is the label we want to jump to unconditionally.

### 4. Determine Patch Bytes

Read the original bytes of the `jz` instruction:

```
mcp__ida-pro-mcp__get_bytes(regions={"addr": "", "size": 6})
```

The `jz` is a near conditional jump: `0F 84 rel32` (6 bytes).

Compute the new unconditional jump to the target (the code after both nav checks):
- `new_rel32 = jump_target - (patch_va + 5)`
- `patch_bytes` = `E9  90`

Where `` is the 4-byte little-endian encoding of `new_rel32`.

### 5. Generate Patch Signature

**ALWAYS** Use SKILL `/generate-signature-for-patch` to generate and validate the signature.

Required context for the skill:
- `func_name`: `CCSBotManager_AddBot`
- `func_va`: From step 1
- `patch_va`: Address of the `jz` instruction from step 3
- `original_instruction`: e.g., `jz loc_1802A1485`
- `patched_instruction`: e.g., `jmp loc_1802A104F` + `nop`
- `description`: `Remove g_pNavMesh null-check in CCSBotManager_AddBot - patch conditional jz to unconditional jmp to skip nav mesh validation`

### 6. Write YAML Output

**ALWAYS** Use SKILL `/write-patch-as-yaml` to persist the results.

Required parameters:
- `patch_name`: `CCSBotManager_AddBot_BotNavIgnore`
- `patch_sig`: The validated signature from step 5
- `patch_bytes`: The computed patch bytes from step 4
- `patch_sig_disp`: From step 5 result (omit if 0)

## Output YAML Files

- `CCSBotManager_AddBot_BotNavIgnore.windows.yaml`
- `CCSBotManager_AddBot_BotNavIgnore.linux.yaml`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [HLND2T](https://github.com/HLND2T)
- **Source:** [HLND2T/CS2_VibeSignatures](https://github.com/HLND2T/CS2_VibeSignatures)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-hlnd2t-cs2-vibesignatures-find-ccsbotmanager-addbot-botnavignore
- Seller: https://agentstack.voostack.com/s/hlnd2t
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.