Part 4: Finding and Tracing Projection Construction
Let’s try and find the Projection Matrix in Memory:
In Far cry New dawn the Fov Slider exposes the actual degrees used by the projection Matrix thus making it very easy to find it.
Reminder that the xScale is:
\[\frac{1}{\tan\left(\frac{FOV_X}{2}\right)}\]Now we have access to FovX. I will set the in-game slider to 105 degrees. Next, we convert it to radians and calculate the result:
\[\frac{1}{\tan{\left(\frac{1.8326}{2}\right)}} = 0.7673\]And then we simply search for this value:
Now I change the Fov Slider value to “60 degrees”, put this through the formula and we get “1.732” and search for it again. Do it a few more times to narrow it down and we get:
Now verify all matrices manually till we find a Projection Matrix that is close to the textbook layout.
This seems to be a Projection Matrix that comes close but still not “Textbook layout”:
As I’ve said before Game engines need not follow convention
In the first Matrix we can see the expected values in [0][0] (xScale) and [1][1] (yScale) as well as Depth Mapping in [2][2] and [3][2], the unexpected value is 0.13 at [2][1] (which is supposed to be 0 in a standard layout). We will figure out what this anomaly is later. The second Matrix is simply the Inverse Projection.
Let’s try to find out “what writes to this address” using CE
We can see two instructions. Both seem to be from the same function, let’s decompile the function in IDA pro:
Far Cry New Dawn uses Denuvo Anti-Tamper, IDA pro will endlessly loop and will never finish decompiling fully due to the obfuscated nature of the binary. Make sure to turn off auto-analysis and do manual analysis!
Looks like a mess but to a trained eye we can tell it is doing a Projection Matrix Construction!
Why?
Look at these 1/x’s and x/2’s and various calls to Tanf and aTanf. A clear indicator for Perspective Projection Matrix Construction
Visual Verification
Before reversing the function, we need to test if this is the real projection matrix used for rendering. I will be changing the FovX value accessed by the function
Next we will be Reversing this function using IDA pro.