Architecture

How AIM-X is put together.

One GUI, a mapped live-service DLL and a read-only sidecar.

Components

LocationResponsibility
Qt desktop appMain window, aim profiles and controller, input runtime, settings, security UI and the control API.
Live-service DLLManual-mapped into the game: telemetry publisher, resolvers, recoil/camera writers, QSec guard and the render hook.
Python data sidecarStandard-library, read-only reader on port 8765: entities, anatomy, player state, loot and tables.
Licensing serviceRuns separately; the desktop pins its origin and verification key at build time.

Process model

The GUI’s runtime worker copies each telemetry sample out of a shared section (~100 Hz) and hands it to the aim controller, the recorder queue and the status API. Gameplay writes — camera direction, recoil, visual adapters, the guard and background fire — are issued by the DLL on request. The sidecar never writes.

One eligibility gate

Scene and avatar eligibility is decided in one place (online_policy.h) and shared by both the desktop runtime and the DLL, so the training range and an online match use the same gate.

Real-time render path

The D3D11 Present hook reads the camera, each enemy’s transform, skeleton bone matrices and damage-zone colliders from game memory every frame, and computes the prediction lead with the same maths the aimbot uses. Shared-section telemetry feeds the aimbot and the window overlay; the sidecar is their fallback, not a frame source.

Backend core

The backend is a Qt-free C++17 header library compiled by both the GUI and the offline test suites. Availability for every control comes from a typed schema — 107 canonical settings, 106 implemented, one inactive — not from tab positions. Offline checks validate decisions, guards, timing and caps; they do not validate game-side behaviour.

Attach & compatibility

At startup, on executable change and at least once a minute, a watcher hashes the configured game binary. An unverified fingerprint blocks normal injection and shows a persistent warning; a mid-session change stops telemetry and rendering. Force inject is bound to one exact build and process and consumed once.

Continue readingSecurity & QSec ↗