Guide [Source] Battlefield 6 — Havok Raycast & Visibility Logic

[byte_corvus]

Remember when raycasting in BF3 or BF4 was a walk in the park? Everything was virtual, and the engine handled the cleanup for you. Those days are over. In the latest Battlefield title, everything is inlined, and if you don't manually handle the result and cleanup, you're going to crash your client faster than a bad DLL injection.

The Transition to Inlined Physics

Unlike older titles, you now have to call everything yourself. There are wrappers available if you dig deep enough, but the core implementation requires manual handling of the ray results. This is the foundation for any serious visibility check or penetrable wall logic (auto-wall) that isn't just relying on basic occlusion.

Main Raycast & Physics World Signatures

To get started, you'll need to locate the main raycast function and the global physics world. Note that the physics world access is now a function rather than a simple pointer.

// Main Raycast Signature
// E8 ? ? ? ? 0F 10 45 ? 44 8B 7D ? 0F 11 45 ? 45 85 FF 0F 84

// HavokPhysicsWorld Getter
// E8 ? ? ? ? 48 8B F8 8B 46 ? 83 F8

class HavokPhysicsWorld
{
public:
    static HavokPhysicsWorld* GetInstance()
    {        
        auto func = addr::getPhysicWorldFunc.as<HavokPhysicsWorld* (__fastcall*)(int)>();
        return func(0);
    }
};

Core Data Structures & Alignment

CRITICAL: Vec3 and the input/result structures MUST be 16-byte aligned. If you ignore this, the Havok engine will throw an exception or simply SIGSEGV.

Spoiler: Technical Structures

struct alignas(16) RayCastInput
{
    fb::Vec3 start; // 16-byte aligned
    fb::Vec3 end;
    int queryFilter = 0;
    int _unused = 0; // Set to 1 if using excludes
    float latency = 0.0f;
    int flags = 0;
    int64_t allocator = 0;
    eastl::fixed_vector<PhysicsHandle, 16> excludes;
};

struct RawResult
{
    struct WorldRef* worldRef;
    struct HavokBodyData* havokBody;
    int64_t entityPair;
    int startIdx;
    int hitCount;
    char rest[48];
};

Implementation & Mandatory Cleanup

If you don't call the cleanup function after your raycast, the memory leakage will lead to a crash after a certain amount of calls. It's also recommended to call your ray logic during the end-frame of the renderer to ensure the physics state is stable.

1. Grab the HavokPhysicsWorld instance.
2. Prepare RayCastInput with your start/end coordinates.
3. Use queryFilter 0x81A0021 for general visibility or 0x4B010107 for a simple triggerbot line.
4. Execute the wrapped raycast.
5. Parse the RawResult and loop through hitCount.
6. Call cleanupRayWrapped immediately after processing.

Visibility & Penetration Logic

You can determine if a target is truly visible by checking material flags like MfSeeThrough and MfPenetrable. This allows your aimbot to distinguish between a brick wall and a glass window.

bool isEntityHit(const fb::ray::HitInfo& hit)
{
    if (!IsValidPtr(hit.entity))
        return false;

    fb::ClassInfo* ci = (fb::ClassInfo*)hit.entity->GetType();
    if (ci->m_ClassId == 12457) // Soldier ID check
        return true;

    if (ci->m_ClassId == 12454) // Vehicle ID check
        return ((fb::ClientVehicleEntity*)hit.entity)->IsOccupiedEntry();

    return false;
}

This setup gives you a much cleaner visibility check than the standard engine occlusion methods, which are often buggy or delayed.

Anyone found a cleaner way to resolve the query filter enums at runtime without hardcoding the hex values?