Well No matter how many times I searched, I could never seem to find a decent tutorial on finding the viewmatrix struct. So I decided to stop being lazy and find it myself. This is just how I did it although there is probably a 100X faster way.
Inside the matrix structure lies viewangles/recoil.
So what we want to do is basically find viewangles. I done this by going in game on MW2 load up cheat engine and basically just search for a float @ unknown value, and then move the mouse slightly and search changed value. Yes its pretty lame but it does the trick in the end. After you repeated this a lot of times you will get down to the last few addresses found. What you want to do here is just add the code list and just freeze a few at a time. Then go in game and see if you can move your mouse. if you can move your mouse without it always going back to where it started automatically you have found the correct addresses.
Untill you will find these 2 addresses:
Now we already know these two lie inside the matrix structure so what we need to do now is find the base. To do this I just basically right clicked ViewY found out what accesses this. Then moved my mouse in game and found this:
Okay so double click on 005A65E5 - D9 40 40 - fld dword ptr [eax+40] and then basically look at the registers at the bottom and copy EAX(Which is B36A00) Okay so now lets set up our structures hit memory view. Tools dissect data/structures. Type the address of eax in which was B36A00. Then go structures define new structure name it matrix. When it prompts you to attach debugger hit OK. Okay now as you can see at offset 40 and 44 They are your viewAnglesX & viewAnglesY.
005A6BAE - D9 05 406AB300 - fld dword ptr [00B36A40]
005A5D51 - D9 05 406AB300 - fld dword ptr [00B36A40]
005A5D6B - D9 1D 406AB300 - fstp dword ptr [00B36A40]
005A5D7A - D8 05 406AB300 - fadd dword ptr [00B36A40]
005A5D80 - D9 1D 406AB300 - fstp dword ptr [00B36A40]
005A634F - D9 05 406AB300 - fld dword ptr [00B36A40]
005A6388 - D9 1D 406AB300 - fstp dword ptr [00B36A40]
005A6C53 - D9 05 406AB300 - fld dword ptr [00B36A40]
005A65E5 - D9 40 40 - fld dword ptr [eax+40] //Exactly was we was looking for eax will be the matrix_t base. So matrix+40 = ViewY basically.
005A62CA - D9 05 406AB300 - fld dword ptr [00B36A40]
005A62D4 - D9 1D 406AB300 - fstp dword ptr [00B36A40]
Okay so lets check the offsets between 0000-0008. If you fire in game you can see the values of these offsets fliy up. This must be recoil! So we add add that to are structure now to.
Then you can basically use this just like this example:
float Recoil1; //0000
float Recoil2; //0004
float Recoil3; //0008
char unknown[0x2E]; //0012
float viewAngleY; //0040
float viewAngleX; //0044
extern matrix_t matrix;
matrix_t *matrix = (matrix_t * ) 0xB36A00;//Matrix_t
HRESULT WINAPI D3D9_t::SetStreamSource( LPDIRECT3DDEVICE9 pDevice )
Hope this was detailed enough regards.
SETSTREAMSOURCE, // 100 vTable