How To Use Engine Text and Other Functions

01-18-2015, 11:29 PM #1

Black Panther

Guest

n/a

Posts

n/a

Reputation

n/a

Credits

Member

Once upon a time...

NextGenUpdate

(adsbygoogle = window.adsbygoogle || []).push({}); READ THE ENTIRE THREAD BEFORE REPLYING!

I'm going to tell you all how to do this because well I don't care having this to myself or whatever anymore. It's really simple to do and Xbox has had this for a few years. So I DON'T see the point in having this.

In this thread I will teach how to use Engine text and stuff

What is engine text?
Engine text is text that is called by the call of duty game engine. You maybe familiar with my offhost menu, this uses engine text and another thing that uses engine text is the "FPS" function.

What do I use this for?
You can use engine text for a lot of things. Mainly it is used for making nonhost mods such as: ESP, nonhost menus, etc.

How Do I Start Using This?

For starters you need to know how to hook functions. This basically means you need to hook a function that runs every frame of the game such as R_FrameSetFog (Or whatever it's called) or "FPS" function. This being said, you cannot hook functions like this with any external program, so sorry TMAPI and CCAPI users this must be done in a plugin either system or a game plugin (.SPRX)

Here is the function I use to hook my functions. Credits to Theriftboy for his help on Ps3hax and a few xbox modders.

PatchInJump

    

	int32_t write_process(uint64_t ea, const void * data, uint32_t size)

	{

		system_call_4(905, (uint64_t)sys_process_getpid(), ea, size, (uint64_t)data);

		return_to_user_prog(int32_t);

	}

	int Memcpy(PVOID destination, const PVOID source, size_t size)

	{

		system_call_4(905, (uint64_t)sys_process_getpid(), (uint64_t)destination, size, (uint64_t)source);

		__dcbst(destination);

		__sync();

		__isync();

		return_to_user_prog(int);

	}

	void PatchInJump(int Address, int Destination, bool Linked) {



		// use this data to copy over the address

		int FuncBytes[4];



		// Get the actual destination address

		Destination = *(int *)Destination;



		FuncBytes[0] = 0x3D600000 + ((Destination >> 16) & 0xFFFF); // lis     %r11, dest>>16

		if (Destination & 0x8000) // If bit 16 is 1

			FuncBytes[0] += 1;



		FuncBytes[1] = 0x396B0000 + (Destination & 0xFFFF); // addi    %r11, %r11, dest&0xFFFF

		FuncBytes[2] = 0x7D6903A6; // mtctr    %r11



		FuncBytes[3] = 0x4E800420; // bctr



		if (Linked)

			FuncBytes[3] += 1; // bctrl



		Memcpy((void*)Address, FuncBytes, 4 * 4);

	}

If this code gives you errors, make sure to add the following additional dependencies and header files

    

#pragma comment(lib, "sysmodule_stub")

#include <cell/pad.h>

#include <string>

#include <sys/random_number.h>

#pragma comment(lib, "c")

#include <sys/memory.h>

#include <fastmath.h>

#include <ppu_intrinsics.h>



$(SCE_PS3_ROOT)\target\ppu\lib\libc.a

$(SCE_PS3_ROOT)\target\ppu\lib\libc_stub.a

$(SN_PS3_PATH)\ppu\lib\sn\libsn.a

$(SCE_PS3_ROOT)\target\ppu\lib\libm.a

$(SCE_PS3_ROOT)\target\ppu\lib\libio_stub.a

$(SCE_PS3_ROOT)\target\ppu\lib\libsysutil_stub.a

$(SCE_PS3_ROOT)\target\ppu\lib\libsysmodule_stub.a

$(SCE_PS3_ROOT)\target\ppu\lib\libsyscall.a

$(SCE_PS3_ROOT)\target\ppu\lib\libstdc++_stub.a

$(SCE_PS3_ROOT)\target\ppu\lib\fno-exceptions\libstdc++_stub.a

$(SCE_PS3_ROOT)\target\ppu\lib\fno-exceptions\fno-rtti\libstdc++_stub.a

$(SCE_PS3_ROOT)\target\ppu\lib\libgcm_sys_stub.a

Next, what you want to do is go to your prx entry function and add your patchinjump code like I do here
You must login or register to view this content.

    

- The 0x4A5508is AW's "FPS" function

-(int)CL_DrawTextHook is my function that I'm using to display the engine functions

-false is an argument that you put

Next you want to create your function like I made mine "CL_DrawTextHook"

In my menu I'm using R_AddCmdDrawText and R_AddCmdDrawStretchPic for Text and Material

Some Engine Functions for Advanced Warfare 1.06

    

opd_s R_AddCmdDrawStretchPic_t = { 0x5D59D8, TOC };//Maybe 0x5D5980

opd_s R_AddCmdDrawText_t = { 0x5D5F28, TOC };

opd_s Material_RegisterHandle_t = { 0x5C9900, TOC };

opd_s R_RegisterFont_t = { 0x22B938, TOC };



void*(*R_RegisterShader)(const char * material, int imageTrack) = (void*(*)(const char *, int))&Material_RegisterHandle_t;

void*(*R_RegisterFont)(const char * font, int imageTrack) = (void*(*)(const char *, int))&R_RegisterFont_t;

typedef void(*R_DSI)(float x, float y, float w, float h, float xScale, float yScale, float xay, float yay, const float *color, void * material);

R_DSI R_AddCmdDrawStretchPic = (R_DSI)(opd_s*)&R_AddCmdDrawStretchPic_t;

void(*R_AddCmdDrawText)(const char *text, int maxChars, void *font, float x, float y, float xScale, float yScale, float rotation, const float *color, int style) = (void(*)(const char*, int, void*, float, float, float, float, float, const float*, int))&R_AddCmdDrawText_t;

Here is what each function does

    

-R_RegisterShader/Material_RegisterHandle = Returns address or pointer for your material you want to use. R_RegisterShader("white", 0);



-R_RegisterFont = Returns address or font_s * pointer for font you want to use. R_RegisterFont("fonts/consoleFont", 0);



-R_AddCmdDrawStretchPic = Draw Material On Screen.

-R_AddCmdDrawText = Draw Text On Screen

Here are some functions I use as well as font types for AW

    

float RED[4] = {1, 0, 0, 1};

float WHITE[4] = {1,1,1,1};

void DrawText(const char *xtext, float xx, float xy, const char *xfont, float xfontSize)

{

	R_AddCmdDrawText(xtext, 0x7FFFFFFF, R_RegisterFont(xfont, 0), xx, xy, xfontSize, xfontSize, 0, WHITE, 0);

}

void DrawShader(float x, float y, float width, float height, const float * color, const char * material)

{

	R_AddCmdDrawStretchPic(x, y, width, height, 1, 1, 1, 1, color, R_RegisterShader(material, 0));

}

#define titleFontBold24px			"fonts/titleFontBold24px"

#define titleFontBold50px			"fonts/titleFontBold50px"

#define titleFontBold30px			"fonts/titleFontBold30px"

#define titleFontBold36px			"fonts/titleFontBold36px"

#define titleFontBold18px			"fonts/titleFontBold18px"

#define titleFontBolder24px			"fonts/titleFontBolder24px"

#define titleFontBolder50px			"fonts/titleFontBolder50px"

#define titleFontBolder30px			"fonts/titleFontBolder30px"

#define titleFontBolder36px			"fonts/titleFontBolder36px"

#define titleFontBolder18px			"fonts/titleFontBolder18px"

#define bodyFontBold				"fonts/bodyFontBold"

#define consoleFont					"fonts/consoleFont"

#define titleFont					"fonts/titleFont"

#define titleFontBold				"fonts/titleFontBold"

And here is a simple CL_DrawTextHook function to display a shader and text

    



void CL_DrawTextHook()

{

	DrawShader(300, 0, 400, 400, RED, "white");

	DrawText("This is a text example", 400, 200, consoleFont, 1);

}

This isn't the best tutorial but if you read and understand it will be easy. If not just google "How to use engine text"

This can be used for All CODS and even more games you just have to find the right functions. I've done this with MW3 as well, it's pretty much the same just use the correct addresses. Those can be found here You must login or register to view this content.

If you need more help you can use my open source MW3 Engine text menu base as an example, it's not the best coding but it will help all the noobs it's pretty much the same as AW just different addresses

You must login or register to view this content.

Credits

    

SC58

Teh1337

Theriftboy

OSM

+More

Please do not post this tutorial in any other site, also please do not just convert this to other games and release that's kind of a dick move.

The following 15 users say thank you to Black Panther for this useful post:

Boliberrys, flynhigh09, Geo, hacking247, HiddenHour, JLM, LBK, MrToxlcBooty, OLDSCHOOLMODZHD, RatchetBooty, RGaming, RTE, Swaqq, SyGnUs, xProvXKiller

01-19-2015, 03:21 PM #20

Sabotage

Gaming Squad

1,107

Posts

27,420

Reputation

116

Credits

Former Staff

Sep 2012

NextGenUpdate

Originally posted by cl

Oh yeah I bet

the hook offset is wrong, the button monitoring doesn't work and even when I fixed everything, all I get is a black screen on the menus (I managed to get on a game and everything works but I can't see the hud but I can see the everything else) Also I tried it on Aw and it works without a problem. Do you know why the black screen on the menus?

Right FPS Offset MW3: 0x0277158

01-19-2015, 03:33 PM #21

Black Panther

Guest

n/a

Posts

n/a

Reputation

n/a

Credits

Member

Once upon a time...

NextGenUpdate

Originally posted by Sabotage

the hook offset is wrong, the button monitoring doesn't work and even when I fixed everything, all I get is a black screen on the menus (I managed to get on a game and everything works but I can't see the hud but I can see the everything else) Also I tried it on Aw and it works without a problem. Do you know why the black screen on the menus?

Right FPS Offset MW3: 0x0277158

Okay.

1.) the hook address is right.
2.) the button monitoring does work
3.) ik not using FPS
4.) it's just an example it's not a literal base I just posted that for people to get a sense on how I was using it

01-19-2015, 03:42 PM #22

Sabotage

Gaming Squad

1,107

Posts

27,420

Reputation

116

Credits

Former Staff

Sep 2012

NextGenUpdate

Originally posted by cl

Okay.

1.) the hook address is right.
2.) the button monitoring does work
3.) ik not using FPS
4.) it's just an example it's not a literal base I just posted that for people to get a sense on how I was using it

Well, I tried those offsets in another project and they didn't work
Tried the button monitoring by its self for a non host aimbot (Haven't found a good non host button monitoring, tried key_isdown but don't like it)
I also tried the address 0x3BC990 and it doesn't work, but then I tried it with the fps offset again and it worked. So either my mw3 is not the same as yours or the offset is wrong but enough of that. Any idea why I get a black screen? can't see anything, just the number on the corner but everything else works, i can hear the sound, i can go to private match start the game and play (still can't see the hud but not a black screen any more) but the text engine works.

01-19-2015, 05:59 PM #23

Swaqq

Professional Thanker

800

Posts

17,079

Reputation

269

Credits

Former Staff

Nov 2013

NextGenUpdate

Originally posted by cl

Oh yeah I bet

I did, OSM showed me how to hook, and I just hooked R_AddCMDDrawStretchPic and R_AddCmdDrawText... These functions like you said have been released on xbox for a long time... And SC58 made a thread long ago on those addresses and they were reversed... The parameters are straight forward lmao so it wasn't hard to do

01-19-2015, 06:07 PM #24

John

skid

1,823

Posts

65,834

Reputation

155

Credits

NextGenUpdate Elite

Dec 2012

NextGenUpdate

Originally posted by cl

$(SCE_PS3_ROOT)\target\ppu\lib\libc.a
$(SCE_PS3_ROOT)\target\ppu\lib\libc_stub.a
$(SN_PS3_PATH)\ppu\lib\sn\libsn.a
$(SCE_PS3_ROOT)\target\ppu\lib\libm.a
$(SCE_PS3_ROOT)\target\ppu\lib\libio_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\libsysutil_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\libsysmodule_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\libsyscall.a
$(SCE_PS3_ROOT)\target\ppu\lib\libstdc++_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\fno-exceptions\libstdc++_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\fno-exceptions\fno-rtti\libstdc++_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\libgcm_sys_stub.a

Nevermind, I figured it out. But now having other problems..

Last edited by John ; 01-19-2015 at 06:49 PM.

01-19-2015, 08:49 PM #25

lutsch1234

Bounty hunter

168

Posts

470

Reputation

23

Credits

Member

Apr 2014

NextGenUpdate

Somethings wrong with the button Monitoring i tried to call a simple print and it doesnt work maybe you can post the correct offsets

The following user thanked lutsch1234 for this useful post:

Sabotage

01-19-2015, 11:07 PM #26

Black Panther

Guest

n/a

Posts

n/a

Reputation

n/a

Credits

Member

Once upon a time...

NextGenUpdate

Originally posted by lutsch1234

Somethings wrong with the button Monitoring i tried to call a simple print and it doesnt work maybe you can post the correct offsets

These are not the wrong addresses for local button monitoring check in debugger that's how I found them. They work for me. Second the project is not an example not a fully functioning menu base. It's to show you how to make your own.

01-19-2015, 11:08 PM #27

Black Panther

Guest

n/a

Posts

n/a

Reputation

n/a

Credits

Member

Once upon a time...

NextGenUpdate

Originally posted by lutsch1234

Somethings wrong with the button Monitoring i tried to call a simple print and it doesnt work maybe you can post the correct offsets

I wouldn't release something that doesn't work.

01-20-2015, 12:59 AM #28

SC58

Former Staff

4,467

Posts

119,403

Reputation

1,237

Credits

NextGenUpdate Elite

Sep 2012

NextGenUpdate

Originally posted by lutsch1234

Somethings wrong with the button Monitoring i tried to call a simple print and it doesnt work maybe you can post the correct offsets

Just use the PS3 Button Monitoring for Local controllers

You must login or register to view this content.

The following user thanked SC58 for this useful post:

LBK