Part 1: Introduction
⚠️ Disclaimer:
The content on this blog is provided for educational and informational purposes only. I do not encourage, endorse, or support any illegal activity. Any techniques, tools, or concepts discussed are intended solely for learning, research, defensive security, or experimentation in safe, legal environments. Use this information responsibly and at your own risk. The author is not responsible for any misuse or legal consequences that may result from applying what’s written here.
How This Rabbit Hole Started:
It all began when I was messing around with Ghost of Tsushima, trying to locate the View-Projection matrix to build a working world-to-screen (w2s) function. I eventually found it and it worked as intended. But while digging through memory, I came across several other interesting matrices. Two of them stood out: the Camera World Matrix and the Perspective Projection Matrix. I figured i could reconstruct the View-Projection matrix myself by multiplying the inverse of the camera world matrix with projection matrix as most Direct-X games do. But the result didn’t match the actual View-Projection matrix. Curious, I started tracing the functions that write to the View-Projection matrix using IDA Pro, ReClass, and Cheat Engine. That’s when I discovered the engine was building the matrix in a non-standard way, or at least, a way that was unfamiliar to me and different from the basic graphics pipeline I was expecting.
Prerequisites
- Understanding the assembly language (x86-64)
- Basic Reverse Engineering Skills
- Intermediate knowledge in C++
- Windows API Familiarity
- Linear algebra
I assume you already understand the linear-algebra concepts used throughout: vectors, matrices (4×4), homogeneous coordinates (Vec4(x,y,z,1)), dot/cross products, matrix × vector, and the perspective divide
What Are we Trying to achieve?
In this write-up series, we’re going to reverse engineer how Ghost of Tsushima constructs its View-Projection matrix, the thing that turns 3D world positions into 2D screen coordinates. This is super important for stuff like ESP overlays (you can’t draw a box around an enemy if you don’t know where they are on screen).
We’ll be reverse engineering the game’s rendering pipeline using tools like IDA Pro, breaking down how the View-Projection matrix is built step by step including all the weird SIMD instructions it uses. The goal is to figure out where it’s stored, how it’s constructed, and how it’s used in the game.
What is an ESP?
ESP stands for Extra-Sensory Perception. In game hacking, it refers to any feature that shows you information you normally wouldn’t be able to see, stuff the game doesn’t intend to show. For example, an ESP might let you:
- See players through walls
- Know their exact health
- Track what’s in their inventory
- Spot hidden loot, traps etc…
This gives a huge unfair advantage over others.
Write-Up Outline:
- Part 1: Introduction
- Part 2.1: View Matrix
- Part 2.2: Projection Matrix
- Part 2.3: View Projection Matrix
- Part 3: Finding & Reversing Matrices
- Part 4.1: Tracing the Matrix Construction Path
- Part 4.2: Reversing SIMD Instructions for Matrix Math
- Reversing SIMD instructions
- Masking Out w with SIMD (Theory)
- _mm_shuffle_ps (Theory)
- Negating a Vector with SIMD (Theory)
- _mm_unpack (Theory)
- Transposing and Shuffling Intermediate Vectors (Theory)
- Manual Matrix Reconstruction from SIMD Operations (Example)
- SIMD-Based Vec4 × 4x4 Matrix Multiplication (Theory)
- Comparing Constructed Matrix with Camera World Matrix:
- Fast inverse for orthonormal Matrices
- Continuation of Manual Matrix Reconstruction (Example)
- Confirmation Of VP Matrix from Manual Construction
- Part 4.3: Completing the View-Projection Matrix
- Matrix Loading into Memory
- Making sense
- Many Redundant SIMD math functions
- Negated Camera position Multiplication with View-Projection Matrix
- Even More redundant SIMD operations
- Biggest reduction in SIMD operations
- Continuation of Manual Matrix Reconstruction
- The View-Projection Matrix - Fully Reversed
- Final Verification
- Camera World Matrix Does Not Match?
- Completion of VP matrix construction from SIMD operations
- Part 4.4: Optimizing Redundant SIMD Instructions
- Part 4.5: Detour Hooking to Optimize SIMD Operations
- Part 5: Trampoline Hooking to Capture Entity Positions
- Part 6: World To Screen Explanation And Code
- Part 7: Final ESP with ImGui
- Introduction
- Entire Code Explanation
- Step 1: Reading Entities and Their Data
- Step 2: Filtering Unique and Relevant Entities
- Step 3: Toggle ESP
- Step 4: Loop Through Entities and Get Screen Positions
- Step 5: Drawing Snaplines Using ImGui
- TL;DR of the Code Flow
- Closing Thoughts
What it should look like:
Snippets of what we will be working with:
IDA PRO:
Cheat Engine:
Visual Studio:
Reclass:
This blog series is just me sharing what I’ve figured out so far while reverse engineering Ghost of Tsushima. There’s always more to understand, and I’m sure some things I say might not be 100% perfect, so if you spot something I missed, or you have better insights, I’d really love to hear from you.
Feel free to reach out to me:
- Discord: zer0_1rp
- Email: Zer0_1rp@proton.me
- Reddit: u/zer0_1rp
- UC: z1rp