# HL2hake ISurface Drawing — Status Report

## Date: 2026-09-12 (final round)

## Result: WORKING

Overlay drawing works in-game and in menus. Draw path: `PaintTraverseEx`
hook (slot 114) on the copied ISurface vtable, wrapping our draws in
`PushMakeCurrent(panel, false)` / `PopMakeCurrent(panel)` around ISurface
slots 6/10/12/17/18/20/22/66/67.

## Confirmed ISurface VTable Slots (disassembly-verified, binary=SDK header+4)

| Slot | Function                                  | Evidence |
|------|-------------------------------------------|----------|
| 6    | `GetEmbeddedPanel()`                      | returns VPANEL used with PushMakeCurrent |
| 8    | `PushMakeCurrent(VPANEL, bool)`           | verified via disassembly |
| 9    | `PopMakeCurrent(VPANEL)`                  | verified via disassembly |
| 10   | `DrawSetColor(int r,g,b,a)`               | stores RGBA at `this+0x24..0x27` |
| 12   | `DrawFilledRect(int x0,y0,x1,y1)`         | verified via disassembly |
| 17   | `DrawSetTextFont(HFont)`                  | stores HFont at `this+0x290` |
| 18   | `DrawSetTextColor(int r,g,b,a)`           | stores RGBA at `this+0x28..0x2b` |
| 20   | `DrawSetTextPos(int x,y)`                 | stores at `this+0x2c/0x30` |
| 22   | `DrawPrintText(wchar_t*, int, drawType)`  | reads font `0x290`, pos `0x2c/0x30` |
| 66   | `CreateFont()`                            | SDK header 62; empirical (379) |
| 67   | `AddGlyphSetToFont(font,name,tall,weight,blur,scanlines,flags,rangeMin,rangeMax)` | SDK header 62+4; disassembly (slot 67 = 0x6a300, passes 9 args to FontManager) |
| 87   | `SolveTraverse`                           | InternalSchemeSettingsTraverse profiling strings @ 0x73240 |
| 88   | `PaintTraverse(VPANEL)`                   | tail-calls `ipanel->vt+0x1c8(panel,false)` @ 0x697e0 |
| 114  | `PaintTraverseEx(VPANEL, bool paintPopups)` | IsVisible check `ipanel+0x40`, popup array `this+0x250/0x25c`, "Too many popups!" assert @ 0x6dd46 |

Slot mapping rule: **binary slot = SDK-header slot + 4** (confirmed via
CreateFont 62→66 and PaintTraverseEx 110→114). Vtable has 179 entries;
slots 122–148 = second base class `IMatSystemSurface`
(AttachToWindow=122 … DrawSetTextureRGBAEx2=148).

## Draw-Path Decision

- **Primary: PaintTraverseEx (slot 114)** — fires every frame for the root panel.
- **Fallback kept: DrawPrintText (slot 22)** — fires only when the game draws
  text (menus); also used as in-draw call site for the game's own text.
- `g_in_draw` (hl2h.cpp) prevents recursion; both hooks call `outer_draw()`
  (menu.cpp) guarded by it.

## Fonts (the long fight)

Font alignment problem: `Tahoma` placeholder fontconfig-substituted to
Noto Sans → per-glyph baseline jumps (fallback-substitution glyph metrics).
Fixes tried in order: Tahoma → DejaVu Sans (+ANTIALIAS 0x10) → no AA →
**winner: "Liberation Sans" 16px, weight 400, flags 0x400 (FONTFLAG_CUSTOM), glyph range pinned 0x20–0xFF**.
`FONTFLAG_CUSTOM` disables the Asian fallback-compat glyph path; pinned
range forces one font pass → uniform metrics, no jumping letters.

fc-match findings (system fontconfig):
- `Tahoma` → NotoSans-Regular.ttf (substituted — unusable)
- `DejaVu Sans` → native, but jumping letters persisted
- `Verdana` → Noto Sans (substituted)
- `Liberation Sans` → LiberationSans-Regular.ttf (real, installed) ✓

## Surface Internals Observed

- Paint-stack count: `this+0x270` (nonzero while painting)
- Stack array: `this+0x264`, 0x1c-byte entries
- Popup array: `this+0x250/0x25c`
- Current font: `this+0x290`; text pos: `this+0x2c/0x30`

## Menu

- Tree: HL2hake → Climb/Bunnyhop/ABH, children indented (`g_depth[]`, +12px/level).
- Right-aligned state at x=200: `[on]`/`[off]` for Active rows,
  `[keyname]` for Bind rows, `[press key]` while binding.
- Feature gating: `feature_active(int)` (menu.cpp) — active AND
  (bind==0 or key held). Called from `do_move` (hl2h.cpp) to gate
  climb (middle-mouse) and bhop (jump) branches.
- Config: INI at `~/.hl2hake.ini` (climb/bhop/abh active+bind).

## Build / Run

- `./build.sh`: g++ `-m32 -O2 -fPIC -shared`, links 5 TUs, `-ldl`,
  `-Wall -Wextra -Werror` (all warnings fatal).
- `./play.sh -windowed +map d1_trainstation_01` (Steam runtime wrapper,
  `LD_PRELOAD=libhl2hake.so`).
- Logs: `/tmp/hl2hake.log` (logf), `/tmp/hl2run.log` (stderr).
- Probe logging (`hook fired:`, `probe:`) removed 2026-09-12.
- `HL2H_DRAW_TEST=1` env: draws red rect + "HL2H DRAW TEST" without
  opening the menu.

## Lessons

1. **Never pipe-mask build failures**: `./build.sh | tail` hides g++ rc.
   Use `./build.sh > /tmp/build.log 2>&1; echo rc=$?`. This masked a
   dropped `static bool g_in_draw` declaration for a whole session.
2. PIC base recovery in vguimatsurface.so: string refs are
   `lea -disp(%reg)` after `call thunk; add $const,%reg`; base 0x271000
   for slot-87/114 region.
3. Check binary freshness: `strings libhl2hake.so | grep -c <newstr>`
   — mtime can lie (build silently failed).

## File Locations

- Project: `/home/salmon/Documents/rust/hl2h/`
- Hook + feature logic: `src/hl2h.cpp`
- Menu + drawing + config + input: `src/menu.cpp`
- Shared API: `src/hl2h.h`
- SDK headers: `source-sdk-2013/src/public/vgui/`