Hi, I wanna hook a DX game's text output, it uses d3dx9_35.dll. I'm not good at DirectX, the game looks like:

I hooked D3DXCreateFontA/W, D3DXCreateFontIndirectA/W , they are not called. And the GDI api TextOutA/W DrawTextA/W are not used either. The game is not protected, I can debug it with OllyDbg, I add breakpoints to these functions, never breaks. So how does the game draw text?

Thanks.

"Render a text" will most probably mean "reander a vertex buffer (small quads, one of each letter) with a texture". The texture contains all the necessary chars. So you can try to look for that. Is the texture pre-made with all possible chars (can you find it somewhere in the game assets)? Is it made when the application starts and the letters are somehow drawn in it? Or is it changed even when the application runs if the text needs new letters (Btw I think the last variant is what D3DXFont does).

Is that Japanese? If so, doesn't it have tons of "characters"/symbols? As far as I know, the ID3DXFont etc just creates a spritefont from the parameters and uses it, which I can imagine would be impractical for some languages since the spritesheet would be huge. I could very well be wrong here though, I've never worked with anything that couldn't fit in ISO8859-1..

Are you sure it's not just prerendered?

In a slightly more generalized answer: If you can attach PIX then that will help track down any specific DX API call used to perform an operation or render (as it gives you a breakdown of DX calls in a frame along with a before and after of the state and rendered frame -- in the frame capture mode). It will also help in debugging any issues you might have (though unfortunately MS saw fix to break PIX with a certain Win7 patch...). The various GPU vendors also provide similar free tools (NSight for nVidia, GPUPerfStudio for AMD and GPA for Intel).

The game might possibly call D3DPERF_SetOptions() to disable PIX, but its very easy to NOP/remove.

If you can attach PIX then that will help track down any specific DX API call used to perform an operation or render

Thanks, I tried PIXWin, it works. The game calls SetTexture -> SetStreamSource -> DrawIndexedPrimitive to draw the text

I can see the Mesh, VertexBuffer and some other visual information from PIXWin, but I don't see any relationship between these stuff and the text being drawn. So I tried to analyze the Text3D from DirectX examples, because it uses ID3DXFont::DrawText to draw this red string(on the first image), and may be I can find the how the underlying things are done.

I captured one frame of Text3D, opened in PIXWin, it draws this line first:

and here's the call of DrawText:

I checked all the functions in the call tree, 0x010016F8 is never used, why? maybe I missed something?

Thanks.