Part 2: What is the Projection Matrix?

I previously touched on this here: Reversing The ViewProjection Matrix (Part 2.2), but we need to establish a baseline before we start tearing apart engine binaries.

I won’t be giving a deep-dive computer graphics lecture here (Frustum plane derivations, complex perspective math, etc.). Instead, we will learn how textbooks do the math vs. how real Game Engines do the math.

The Bare Minimum: What is it?

If the View Matrix acts as the camera’s position and rotation in the world, the Projection Matrix is the camera’s lens. It compresses the 3D world flat onto your 2D monitor.

It does this by defining a View Frustum (a 3D truncated pyramid of space) using four variables:

Field of View (FOV): How wide the lens is.
Aspect Ratio: Your monitor’s dimensions (16:9, 21:9).
Near & Far Planes: The minimum and maximum depth the camera can see.

Anything inside this pyramid gets rendered to your screen. Anything outside gets clipped. That is all the theory you need for now.

ESP-Image1

The Memory Layout (What We Actually Care About)

As reverse engineers, understanding the theory is secondary to understanding the memory layout. When you are scanning memory in Cheat Engine, a projection matrix just looks like a contiguous block of 16 floating-point numbers.

To spot it in the sea of data, you have to know what those 16 floats represent. Here is the standard perspective projection matrix layout (DirectX):

\[P = \begin{bmatrix} x_{scale} & 0 & 0 & 0 \\ 0 & y_{scale} & 0 & 0 \\ 0 & 0 & \dfrac{z_{far}}{z_{far} - z_{near}} & 1 \\ 0 & 0 & -\dfrac{z_{near} \cdot z_{far}}{z_{far} - z_{near}} & 0 \end{bmatrix}\]

The formulas used for the zNear and zFar depth mapping (Rows 2 and 3) are not universal and can differ engine to engine, convention to convention. What actually matters is that after projection and perspective divide (in DirectX convention), the near plane maps to 0 and the far plane maps to 1 (or the opposite in Reversed-Z.)

However, the X and Y scales (the floats at [0][0] and [1][1]) are almost always derived directly from the Field of View using tangent math:

\[x_{scale} = \frac{1}{\tan{\left(\frac{Fov_X}{2}\right)}}\] \[y_{scale} = \frac{1}{\tan{\left(\frac{Fov_Y}{2}\right)}}\]

This is our golden ticket. If we know the game’s FOV, we can calculate the exact floating-point value for xScale, and use Cheat Engine to hunt down that exact float in memory.

A Projection Matrix standing out in a sea of floats.

Let’s look at the exact methods we use to hunt this matrix down in Part 3.