Hey guys,
So I'm going to show you how to find the WorldToScreenMatrix for Source Engine Games. The example I'm giving is in CS:S
Start off by getting the Pointer to VEngineClient by searching VEngineClient0 as a string in client.dll (depending on the game, you may have to search in the engine.dll).
Now open Reclass and follow these steps:
4 = Add 1024 Bytes to that vtable
Now in CS:S Index 36 Is WorldToScreenMatrix and 37 WorldToViewMatrix. To find it in your game just look for functions that look exactly like this or use Mac bins + IDA.
(Reclass doesn't detect the Function end)
Now go to the function in olly:
Use CE to determinate EDX, follow the function and by reversing it, we get to know:
So what does this mean for us?
Means:
You just need to find a pointer for ECX then, but you can do that fast.
So I'm going to show you how to find the WorldToScreenMatrix for Source Engine Games. The example I'm giving is in CS:S
Start off by getting the Pointer to VEngineClient by searching VEngineClient0 as a string in client.dll (depending on the game, you may have to search in the engine.dll).

Now open Reclass and follow these steps:



4 = Add 1024 Bytes to that vtable
Now in CS:S Index 36 Is WorldToScreenMatrix and 37 WorldToViewMatrix. To find it in your game just look for functions that look exactly like this or use Mac bins + IDA.

(Reclass doesn't detect the Function end)
Now go to the function in olly:

Use CE to determinate EDX, follow the function and by reversing it, we get to know:

So what does this mean for us?
Means:
C++:
DWORD dwRender = Read( ECX + 0xDC );
VMatrix flMatrix = Read( dwRender + 0x2D4 );
Last edited: