Warface:Basic Nametags

Original work by: Dark1027 Imported by: Dark1027 (forum link)

First of all we need to find the address for SSystemGlobalEnvironment.

Open a dump of warface in IDA or OllyDbg or something similar.

Search for the strin "ai_CompatibilityMode"

Then go to the xref. It should look something like this:

.text:010F4E65 ; ---------------------------------------------------------------------------
.text:010F4E65
.text:010F4E65 loc_10F4E65:                            ; CODE XREF: sub_10F4E10+42�j
.text:010F4E65                 mov     eax, ds:dword_189E010
.text:010F4E6A                 push    offset aAi_compatibili ; "ai_CompatibilityMode"
.text:010F4E6F                 mov     ecx, [eax+3Ch]
.text:010F4E72                 mov     eax, [ecx]
.text:010F4E74                 call    dword ptr [eax+24h]
.text:010F4E77                 test    eax, eax
.text:010F4E79                 jz      short loc_10F4E87
.text:010F4E7B                 mov     edx, [eax]
.text:010F4E7D                 push    offset aWarfacetv ; "warfacetv"
.text:010F4E82                 mov     ecx, eax
.text:010F4E84                 call    dword ptr [edx+4]

The mov eax, ds:dword_189E010 is our SSystemGlobalEnvironment, so in this case its SSystemGlobalEnvironment_address = 0x189E010

Now lets get into the code of getting the Nametags:

First we need the actual command: cmd = "g_show_actor_names"

Now we can use this:

mov ecx, dword ptr ds:[SSystemGlobalEnvironment_address]
mov ecx, dword ptr ds:[ecx + 0x50]
mov edx, dword ptr ds:[ecx]
mov eax, dword ptr ds:[edx + 0xD0]
push cmd
call eax
mov edx, dword ptr ds:[eax + 0x18]
mov dword ptr ds:[edx], 1 ;

The result should look like this: