Post: How To Use Engine Text and Other Functions
Options
01-18-2015, 11:29 PM
#1
Black Panther
Guest
I'm going to tell you all how to do this because well I don't care having this to myself or whatever anymore. It's really simple to do and Xbox has had this for a few years. So I DON'T see the point in having this.
In this thread I will teach how to use Engine text and stuff
What is engine text?
Engine text is text that is called by the call of duty game engine. You maybe familiar with my offhost menu, this uses engine text and another thing that uses engine text is the "FPS" function.
What do I use this for?
You can use engine text for a lot of things. Mainly it is used for making nonhost mods such as: ESP, nonhost menus, etc.
How Do I Start Using This?
For starters you need to know how to hook functions. This basically means you need to hook a function that runs every frame of the game such as R_FrameSetFog (Or whatever it's called) or "FPS" function. This being said, you cannot hook functions like this with any external program, so sorry TMAPI and CCAPI users this must be done in a plugin either system or a game plugin (.SPRX)
Here is the function I use to hook my functions. Credits to Theriftboy for his help on Ps3hax and a few xbox modders.
PatchInJump
int32_t write_process(uint64_t ea, const void * data, uint32_t size)
{
system_call_4(905, (uint64_t)sys_process_getpid(), ea, size, (uint64_t)data);
return_to_user_prog(int32_t);
}
int Memcpy(PVOID destination, const PVOID source, size_t size)
{
system_call_4(905, (uint64_t)sys_process_getpid(), (uint64_t)destination, size, (uint64_t)source);
__dcbst(destination);
__sync();
__isync();
return_to_user_prog(int);
}
void PatchInJump(int Address, int Destination, bool Linked) {
// use this data to copy over the address
int FuncBytes[4];
// Get the actual destination address
Destination = *(int *)Destination;
FuncBytes[0] = 0x3D600000 + ((Destination >> 16) & 0xFFFF); // lis %r11, dest>>16
if (Destination & 0x8000) // If bit 16 is 1
FuncBytes[0] += 1;
FuncBytes[1] = 0x396B0000 + (Destination & 0xFFFF); // addi %r11, %r11, dest&0xFFFF
FuncBytes[2] = 0x7D6903A6; // mtctr %r11
FuncBytes[3] = 0x4E800420; // bctr
if (Linked)
FuncBytes[3] += 1; // bctrl
Memcpy((void*)Address, FuncBytes, 4 * 4);
}
If this code gives you errors, make sure to add the following additional dependencies and header files
#pragma comment(lib, "sysmodule_stub")
#include <cell/pad.h>
#include <string>
#include <sys/random_number.h>
#pragma comment(lib, "c")
#include <sys/memory.h>
#include <fastmath.h>
#include <ppu_intrinsics.h>
$(SCE_PS3_ROOT)\target\ppu\lib\libc.a
$(SCE_PS3_ROOT)\target\ppu\lib\libc_stub.a
$(SN_PS3_PATH)\ppu\lib\sn\libsn.a
$(SCE_PS3_ROOT)\target\ppu\lib\libm.a
$(SCE_PS3_ROOT)\target\ppu\lib\libio_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\libsysutil_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\libsysmodule_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\libsyscall.a
$(SCE_PS3_ROOT)\target\ppu\lib\libstdc++_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\fno-exceptions\libstdc++_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\fno-exceptions\fno-rtti\libstdc++_stub.a
$(SCE_PS3_ROOT)\target\ppu\lib\libgcm_sys_stub.a
Next, what you want to do is go to your prx entry function and add your patchinjump code like I do here
You must login or register to view this content.
- The 0x4A5508is AW's "FPS" function
-(int)CL_DrawTextHook is my function that I'm using to display the engine functions
-false is an argument that you put
Next you want to create your function like I made mine "CL_DrawTextHook"
In my menu I'm using R_AddCmdDrawText and R_AddCmdDrawStretchPic for Text and Material
Some Engine Functions for Advanced Warfare 1.06
opd_s R_AddCmdDrawStretchPic_t = { 0x5D59D8, TOC };//Maybe 0x5D5980
opd_s R_AddCmdDrawText_t = { 0x5D5F28, TOC };
opd_s Material_RegisterHandle_t = { 0x5C9900, TOC };
opd_s R_RegisterFont_t = { 0x22B938, TOC };
void*(*R_RegisterShader)(const char * material, int imageTrack) = (void*(*)(const char *, int))&Material_RegisterHandle_t;
void*(*R_RegisterFont)(const char * font, int imageTrack) = (void*(*)(const char *, int))&R_RegisterFont_t;
typedef void(*R_DSI)(float x, float y, float w, float h, float xScale, float yScale, float xay, float yay, const float *color, void * material);
R_DSI R_AddCmdDrawStretchPic = (R_DSI)(opd_s*)&R_AddCmdDrawStretchPic_t;
void(*R_AddCmdDrawText)(const char *text, int maxChars, void *font, float x, float y, float xScale, float yScale, float rotation, const float *color, int style) = (void(*)(const char*, int, void*, float, float, float, float, float, const float*, int))&R_AddCmdDrawText_t;
Here is what each function does
-R_RegisterShader/Material_RegisterHandle = Returns address or pointer for your material you want to use. R_RegisterShader("white", 0);
-R_RegisterFont = Returns address or font_s * pointer for font you want to use. R_RegisterFont("fonts/consoleFont", 0);
-R_AddCmdDrawStretchPic = Draw Material On Screen.
-R_AddCmdDrawText = Draw Text On Screen
Here are some functions I use as well as font types for AW
float RED[4] = {1, 0, 0, 1};
float WHITE[4] = {1,1,1,1};
void DrawText(const char *xtext, float xx, float xy, const char *xfont, float xfontSize)
{
R_AddCmdDrawText(xtext, 0x7FFFFFFF, R_RegisterFont(xfont, 0), xx, xy, xfontSize, xfontSize, 0, WHITE, 0);
}
void DrawShader(float x, float y, float width, float height, const float * color, const char * material)
{
R_AddCmdDrawStretchPic(x, y, width, height, 1, 1, 1, 1, color, R_RegisterShader(material, 0));
}
#define titleFontBold24px "fonts/titleFontBold24px"
#define titleFontBold50px "fonts/titleFontBold50px"
#define titleFontBold30px "fonts/titleFontBold30px"
#define titleFontBold36px "fonts/titleFontBold36px"
#define titleFontBold18px "fonts/titleFontBold18px"
#define titleFontBolder24px "fonts/titleFontBolder24px"
#define titleFontBolder50px "fonts/titleFontBolder50px"
#define titleFontBolder30px "fonts/titleFontBolder30px"
#define titleFontBolder36px "fonts/titleFontBolder36px"
#define titleFontBolder18px "fonts/titleFontBolder18px"
#define bodyFontBold "fonts/bodyFontBold"
#define consoleFont "fonts/consoleFont"
#define titleFont "fonts/titleFont"
#define titleFontBold "fonts/titleFontBold"
And here is a simple CL_DrawTextHook function to display a shader and text
void CL_DrawTextHook()
{
DrawShader(300, 0, 400, 400, RED, "white");
DrawText("This is a text example", 400, 200, consoleFont, 1);
}
This isn't the best tutorial but if you read and understand it will be easy. If not just google "How to use engine text"
This can be used for All CODS and even more games you just have to find the right functions. I've done this with MW3 as well, it's pretty much the same just use the correct addresses. Those can be found here You must login or register to view this content.
If you need more help you can use my open source MW3 Engine text menu base as an example, it's not the best coding but it will help all the noobs it's pretty much the same as AW just different addresses
You must login or register to view this content.
Credits
SC58
Teh1337
Theriftboy
OSM
+More
Please do not post this tutorial in any other site, also please do not just convert this to other games and release that's kind of a dick move.
The following 15 users say thank you to Black Panther for this useful post:
01-20-2015, 04:08 PM
#29
lutsch1234
Bounty hunter
01-20-2015, 08:11 PM
#30
JonnyWalker
Grunt
01-20-2015, 09:46 PM
#31
lutsch1234
Bounty hunter
Originally posted by Sabotage
Well, I tried those offsets in another project and they didn't work
Tried the button monitoring by its self for a non host aimbot (Haven't found a good non host button monitoring, tried key_isdown but don't like it)
I also tried the address 0x3BC990 and it doesn't work, but then I tried it with the fps offset again and it worked. So either my mw3 is not the same as yours or the offset is wrong but enough of that. Any idea why I get a black screen? can't see anything, just the number on the corner but everything else works, i can hear the sound, i can go to private match start the game and play (still can't see the hud but not a black screen any more) but the text engine works.
Tried the button monitoring by its self for a non host aimbot (Haven't found a good non host button monitoring, tried key_isdown but don't like it)
I also tried the address 0x3BC990 and it doesn't work, but then I tried it with the fps offset again and it worked. So either my mw3 is not the same as yours or the offset is wrong but enough of that. Any idea why I get a black screen? can't see anything, just the number on the corner but everything else works, i can hear the sound, i can go to private match start the game and play (still can't see the hud but not a black screen any more) but the text engine works.
Me too if you find a way please reply i try to get it working too
01-20-2015, 10:15 PM
#33
lutsch1234
Bounty hunter
The following user thanked JonnyWalker for this useful post:
01-22-2015, 05:45 PM
#37
JonnyWalker
Grunt
For me works all perfect, I only fixed 3 things and it works: [img] [url]https://img3.fotos-hochladen.net/uploads/img20150121wa50fth8pgbz.jpg[/url] [/img] thx to cl for sharing 
The following user thanked JonnyWalker for this useful post:
Copyright © 2025, NextGenUpdate.
All Rights Reserved.
