BloodStrike X shipped — bootstrap-injected internal, full engine RE
The largest project on the site so far. A bootstrapper drops the payload DLL into BloodStrike (temp-file scrubbed with zeros before delete), everything after that runs in-process: Present hooked via vtable steal, WndProc subclassed for input, D3D11 device context slots 7/14/15/12/13/20/21/33/34/44 hooked so the world view-projection can be lifted straight out of the vertex-stage constant buffer rather than reconstructed from engine memory. The features the anti-cheat cares about (aim, aura, no-recoil, weapon mods, chams) are wrappers on the game's own Python runtime, not native hooks. Kernel driver handles cross-boundary memory ops and hardware mouse. NetEase's Messiah engine ("NewSpike") reversed cold to make any of it work. Read the case study.
- Bootstrapper — standalone
Loader.exewith the DLL embedded as bytes: waits for the game, drops to a random temp path, injects viaCreateRemoteThread(LoadLibraryW), scrubs the file with zeros before delete. Refuses double-inject, refuses 32-bit targets, cleans handles on every early return. - Present hook, freeze-safe — per-frame RTV lifecycle (no persistent backbuffer references, so DXGI resize always succeeds), throwaway-device vtable steal, four-slot multi-swap-chain ledger so Discord's overlay never gets our ESP.
- Camera from the GPU pipeline — the render camera is not in engine memory; the aim camera doesn't move in third person. Instead of chasing that: hook
VSSetConstantBuffers/Map/Unmap, identify the world view-projection by agreement with the reversed projection algorithm (probe-point projection matches three frames running), lock the (buffer, offset) pair. Measured: 0.04 px error at lock. The old ESP was 261 px off in third person for the whole life of the project. - Python-runtime patching — wraps
SpellWorker.GetShootDirfor silent aim, wrapsSendSpellResultfor hit accounting; kill-aura registers as a bound method onStoryTickso the game's own plugin scanner (which callsinspect.isfunctionand blacklists names like'AIMUpdate') skips it silently. No-recoil patches the placer classes notStateRecoil(which has itsco_constsfingerprinted byqsec.pyand reported if the 0.01 deg→rad literal is missing) via a self-proxy pattern. - Kernel driver (BSXDriver.sys) — six IOCTLs (base, CR3, read, write, pattern-scan, mouse), PML4-walked reads via the target's cached CR3, kernel-side pattern scanner with
MmIsAddressValidguarding, mouse atMouseClassServiceCallbacklevel. Auto-loaded on first launch via an embedded mapper dropped to%TEMP%, cleaned up after. - AC neutralisation surface — the proxy-SDK variant takes down the game's whole usermode reporting stack before
LoadLibraryever has anything to say about the injected DLL: the detection interface and its dispatch path, the per-frame AC tick, the five worker threads (main, log, DRPF, client-log, IO), and four telemetry channels (DRPF, MCount, AppLog, ACSM) plus thewhoamihardware-ID→account bind. On the Python side: theqsec.pyliteral-in-bytecode fingerprint onStateRecoil.OnRecoilEnter, and thestory_tick.pyplugin scanner that walks callbacks and reports'AntiPlugin', both routed around rather than tampered with. Server-streamed Python AC modules are ring-buffered and marshal-dumped from a background GIL-owner thread so new AC pushes are visible on disk before they run. Layered so no one defence relies on another for cover. Mechanism stays private; scope does not. - Engine RE — 3,900 lines of offsets, each field with an RVA and instruction. Actor Manager linked-list walk (from
GetAllActors()decompilation), 67-bone skeleton chain (bind at+0x30is what the engine's accessor returns and it's wrong for gameplay — live pose is at+0x7C), read-only PhysX 3.4.3 walker (external build), Python-sidespace.RawRaycast(internal build). - Own hardening — direct syscalls from disk-mapped
win32u.dll, RW→RX (never RWX) syscall stubs at random page offsets, VMProtect scoped to hot paths (MUTATE per-frame, VIRTUALIZE at init), hashed PEB-walk imports, per-build config salt from__TIME__/__DATE__, hidden background security thread, PE header erasure post-init. - Chams — custom compiled pixel shader hanging off the view-matrix module's draw hook as an observer, not a second vtable patch (which would fight silently). Immediate context only.
- New home-page slot, work footer updated site-wide, palette and terminal search entries, sitemap entry.
- Status — finished and closed. Build private, source private.