[Mr. Zero]

I'm currently trying to remove a vocalize bug in L4D2 where the survivors will keep mourning over and over if there is a clone of the dead survivor the other survivors are mourning over.

A sound hook worked to block the mourning sound worked, however close caption is still getting spammed with OH BILL OH BILL OH BILL.

I tried to hook the user message CloseCaption but I'm not sure what the bytes are.

[l4dvocalizefixes.smx] CloseCaption: BfGetNumBytesLeft 6

Not to mention its really short message for the "Just so you all know, it hurts to get shot" line.

So does anyone know what the message is or how to capture and block the close caption?

[AtomicStryker]

disassembly

PHP Code:

.text:00285136 E8 2D E9 25 00                  call    _Z16UserMessageBeginR16IRecipientFilterPKc ; UserMessageBegin(IRecipientFilter &,char  const*)
.text:0028513B
.text:0028513B                         loc_28513B:                             ; CODE XREF: CSoundEmitterSystem::EmitCloseCaption(IRecipientFilter &,int,bool,char  const*,CUtlVector<Vector,CUtlMemory<Vector,int>> &,float,bool,bool)+59Aj
.text:0028513B 8B 45 E4                        mov     eax, [ebp+var_1C]
.text:0028513E 89 04 24                        mov     [esp], eax
.text:00285141 E8 F2 E4 25 00                  call    _Z16MessageWriteLongi   ; MessageWriteLong(int)
.text:00285146 D9 45 20                        fld     [ebp+arg_18]
.text:00285149 D8 8B 0C F8 D5 FF               fmul    ds:(flt_B2D01C - 0DCD810h)[ebx]
.text:0028514F D9 9D A0 FD FF FF               fstp    [ebp+var_260]
.text:00285155 F3 0F 2C 95 A0 FD FF FF         cvttss2si edx, [ebp+var_260]
.text:0028515D B8 FF FF 00 00                  mov     eax, 0FFFFh
.text:00285162 81 FA FF FF 00 00               cmp     edx, 0FFFFh
.text:00285168 7F 08                           jg      short loc_285172
.text:0028516A 66 31 C0                        xor     ax, ax
.text:0028516D 85 D2                           test    edx, edx
.text:0028516F 0F 49 C2                        cmovns  eax, edx
.text:00285172
.text:00285172                         loc_285172:                             ; CODE XREF: CSoundEmitterSystem::EmitCloseCaption(IRecipientFilter &,int,bool,char  const*,CUtlVector<Vector,CUtlMemory<Vector,int>> &,float,bool,bool)+3D8j
.text:00285172 C7 44 24 04 0F 00 00 00         mov     dword ptr [esp+4], 0Fh
.text:0028517A 89 04 24                        mov     [esp], eax
.text:0028517D E8 38 E2 25 00                  call    _Z20MessageWriteUBitLongji ; MessageWriteUBitLong(uint,int)
.text:00285182 C7 44 24 04 01 00 00 00         mov     dword ptr [esp+4], 1
.text:0028518A 0F B6 85 9A FD FF FF            movzx   eax, [ebp+var_266]
.text:00285191 89 04 24                        mov     [esp], eax
.text:00285194 E8 21 E2 25 00                  call    _Z20MessageWriteUBitLongji ; MessageWriteUBitLong(uint,int)
.text:00285199 E8 1E E1 25 00                  call    _Z10MessageEndv         ; MessageEnd(void) 


So it's a (signed?) int, followed by two unsigned ones

[Mr. Zero]

For future searches, Atomic suggested I used short word word to get the 3 arguments for the usermessage, which seemed to work.

However I was unable to block the usermessage itself as returning Plugin_Handled or Plugin_Stop did not prevent the client from receiving the close caption.

Whether its client predict or another usermessage is sending the captioning (CloseCaptionDirect did not trigger at all), I don't know.

[psychonic]

No need to reverse it. It's in the sdk.

The 6 bytes start with one 4-byte int, identifying the message (they're indexed).
The remaining two are split into a 15-bit, unsigned duration (in 10ths of a second) and a 1-bit marking whether or not that it's from a player.

CloseCaptionDirect has the same structure as CloseCaption. They also share the same description, but with the word "forced" added to the direct one. Without looking in the client code, I would think that implies that maybe it's for messages that are to bypass the closecaption cvar and always show.

As for why you can't block, can you show your code?

[Mr. Zero]

Sure, but its nothing but the hook, reading and then trying to block.

PHP Code:

public Action:_BM_CloseCaption_UserMsg(UserMsg:msg_id, Handle:bf, const players[], playersNum, bool:reliable, bool:init)
{
    /**
     * CloseCaption Structure
     * - 
     */

    LogMessage("CloseCaption: BfGetNumBytesLeft %d", BfGetNumBytesLeft(bf));

    //LogMessage("CloseCaption: 1:%d 2:%d 3:%d 4:%d 5:%d 6:%d", BfReadByte(bf), BfReadByte(bf), BfReadByte(bf), BfReadByte(bf), BfReadByte(bf), BfReadByte(bf));

    new int1 = BfReadShort(bf);
    new int2 = BfReadWord(bf);
    new int3 = BfReadWord(bf);
    LogMessage("CloseCaption: Int1 %d Int2 %d Int3 %d", int1, int2, int3);

    return Plugin_Handled;
} 


I also tried Plugin_Stop, neither stopped the captioning.
CloseCaptionDirect did not fire at all, or at least not when CloseCaption usermessage was fired.

[psychonic]

Originally Posted by Mr. Zero Sure, but its nothing but the hook, reading and then trying to block. PHP Code: public Action:_BM_CloseCaption_UserMsg(UserMsg:msg_id, Handle:bf, const players[], playersNum, bool:reliable, bool:init) {     /**      * CloseCaption Structure      * -       */     LogMessage("CloseCaption: BfGetNumBytesLeft %d", BfGetNumBytesLeft(bf));     //LogMessage("CloseCaption: 1:%d 2:%d 3:%d 4:%d 5:%d 6:%d", BfReadByte(bf), BfReadByte(bf), BfReadByte(bf), BfReadByte(bf), BfReadByte(bf), BfReadByte(bf));     new int1 = BfReadShort(bf);     new int2 = BfReadWord(bf);     new int3 = BfReadWord(bf);     LogMessage("CloseCaption: Int1 %d Int2 %d Int3 %d", int1, int2, int3);     return Plugin_Handled; }  I also tried Plugin_Stop, neither stopped the captioning. CloseCaptionDirect did not fire at all, or at least not when CloseCaption usermessage was fired.

That still doesn't show everything. Where are you hooking it? Did you set intercept to true in HookUserMessage?

[Mr. Zero]

Originally Posted by psychonic That still doesn't show everything. Where are you hooking it? Did you set intercept to true in HookUserMessage?

Ah that's what I forgot. Silly me. Works now.

About the bit reading, is short word word correct?
Or should it be short float byte?

[psychonic]

Originally Posted by Mr. Zero Ah that's what I forgot. Silly me. Works now. About the bit reading, is short word word correct? Or should it be short float byte?

Neither. Int, 15-bit uint, 1-bit bool

Easiest way would probably be to read the last two together as a short, copy the least significant bit out as the last var and then shift the rest to the right. Multiply the duration by 10 to convert it to seconds.

new id = BfReadNum(bf);
new temp = BfReadShort(bf);
new bool:from_player = (temp & 1);
new signed = (temp >> 1) & 0x7FFF;
new unsigned = (signed < 0) ? signed + 0x10000 : signed;
new Float:duration = float(unsigned) * 10.0;

[Mr. Zero]

Hm I do get some interesting results, but I don't believe the id is correct, maybe not the same structure in L4D2?

L 10/04/2011 - 16:45:47: [l4dvocalizefixes.smx] CloseCaption: Id 778861505 duration 120.000000 from player 1
L 10/04/2011 - 16:45:47: [l4dvocalizefixes.smx] CloseCaption: Id -955261196 duration 140.000000 from player 1
L 10/04/2011 - 16:45:49: [l4dvocalizefixes.smx] CloseCaption: Id -1218106757 duration 60.000000 from player 0
L 10/04/2011 - 16:45:50: [l4dvocalizefixes.smx] CloseCaption: Id 1500203863 duration 50.000000 from player 1

Also isn't duration a bit long? Maybe it doesn't need to be multiplied with 10 in L4D2? It does seem to fit better with the caption without.

[psychonic]

Originally Posted by Mr. Zero Hm I do get some interesting results, but I don't believe the id is correct, maybe not the same structure in L4D2?

It's an index in other games. In the swarm sdk (the closet that we probably have to l4d2), it's labeled as a hash. I would just note the values for the ones that you want to block or dig further into the sdk.

Originally Posted by Mr. Zero Also isn't duration a bit long? Maybe it doesn't need to be multiplied with 10 in L4D2? It does seem to fit better with the caption without.

That seems highly possible given the results you're getting.