Guide [Source] BloodStrike NetEase Messiah Engine — Internal Aimbot Implementation

[byte_corvus]

Been messing around with BloodStrike lately and decided to dump some of the engine internals for those struggling with the NetEase Messiah architecture. It can be a headache if you haven't worked with this specific mess of pointers before.

1. Module Base
Everything stems from here. Standard stuff, but don't forget your base calculation:

uintptr_t base = (uintptr_t)GetModuleHandleA(NULL);

2. Engine Hierarchy
The hierarchy is heavily nested. You'll need to navigate this chain to hit the camera and local player structures:

- ClientEngine: base + 0x65F7AD0
- IGameplay: ClientEngine + 0x58
- ClientPlayer: IGameplay + 0x58
- Camera: ClientPlayer + 0x238
- LocalActor: ClientPlayer + 0x288

3. Entity List Traversal
It's a circular linked list. You start at the head and loop until you wrap back around. Here is the pointer for the list head:

- EntityList Head: *(uintptr_t*)(base + 0x6E4D0D8) + 0x8

Spoiler: Traversal Example

uintptr_t head = Memory::Read<uintptr_t>(base + 0x6E4D0D8 + 0x8);
uintptr_t current = Memory::Read<uintptr_t>(head);
do {
    uintptr_t actor = Memory::Read<uintptr_t>(current + 0x18);
    // Add your filter logic here
    current = Memory::Read<uintptr_t>(current);
} while (current != head);

4. Bone Transformations
Messiah is notorious for not storing world-space bones directly. You're dealing with relative matrices and actor transforms. You MUST multiply them to get the actual screen coords.

- Actor Transform: IEntity + 0x58 (3x4 Matrix)
- Bone Pointer Array: ActorInstance + 0x278 -> +0x18 -> +0x40 -> +0x18 -> +0x90 -> +0x8

Use this matrix addition logic for the transformations:

static void MessiahMatrixAdd(const XMFLOAT3X4& bonemat, const XMFLOAT3X4& pos, Vector3& out) {
    out.x = (pos._11 * bonemat._32) + (pos._14 * bonemat._33) + (pos._23 * bonemat._34) + pos._32;
    out.y = (pos._12 * bonemat._32) + (pos._21 * bonemat._33) + (pos._24 * bonemat._34) + pos._33;
    out.z = (pos._13 * bonemat._32) + (pos._22 * bonemat._33) + (pos._31 * bonemat._34) + pos._34;
}

5. Basic Aimbot Execution
For those looking at Y-UP silent aim, your Pitch/Yaw is typically at Camera + 0x110 and FOV at 0x338. For the aimbot, keep it simple: grab the target's screen position, calculate the delta, and feed it to mouse_event with some basic smoothing.

Warnings & Troubleshooting

1. Offsets shift every update—always scan for the patterns rather than hardcoding addresses.
2. Use a decent internal hook if you want to avoid flag-happy mouse events, but if you're just testing the math, this will work.
3. NetEase AC will catch blatant WPM calls in hot paths—keep your read logic lean.

While others are struggling to reverse the Messiah structure from scratch, this should save you a few nights of debugging. Anyone had luck with hooking the Present function here instead of relying on mouse events?

Drop your findings or detection reports below.