FREE TOOL

Backdoor Scanner

Downloaded a free, cracked or leaked resource? Drop it here before it touches your server. Every Lua file is scanned for the patterns real backdoors use — code downloaded and run at startup, obfuscated \x and string.char strings, injected blobs, admin escalation, txAdmin tampering and known malware-panel hosts. It also spots decompiled and escrow-stripped copies, and lists every outbound address the resource contacts so you can check them yourself. Nothing is uploaded — the scan runs in your browser.

Drop a resource folder here

or CHOOSE FOLDER · a single .lua file or a .zip also works

A clean result is not a guarantee — it means none of the known patterns were found. Always review resources you do not trust.

a made-up resource with one backdoor, one cracked file and one bought file

How server backdoors hide — and what to do

Short, plain explanations of the patterns above. Written by Dispersia; the community reference we learned the most from is credited under each item.

Obfuscated \x / hex strings

Malware rarely writes PerformHttpRequest in plain text — it hides it as "\x50\x65\x72\x66...", which Lua turns back into the real word at runtime. A normal script has no reason to spell its own function names in hex. A block of these escapes is the single strongest signal that code is trying not to be read.

What to do: decode it (this scanner does) and see what it builds. If it rebuilds load, assert, an event name or a URL, delete the resource.

Reference: JG / Yorick security notes on FiveM backdoors — docs.yorick.gg/Security/Backdoors.

load() / assert(load(...)) runtime loaders

These run code that is assembled while the script starts, so the dangerous part never appears in the file you read. assert(load(decode(...)))() is the classic backdoor shape: decode a blob, compile it, run it, all on one line. Legitimate resources almost never build and execute code from a string.

What to do: treat any load/loadstring fed by concatenation, a decoder or a downloaded string as hostile until proven otherwise.

Reference: docs.yorick.gg/Security/Backdoors.

Hidden HTTP calls (data exfiltration)

PerformHttpRequest to an address that is not the script's own update or license server is how a backdoor sends your server data — tokens, player counts, connection strings — to its owner. The Cipher panel, for example, phones home to cipher-panel.me.

No tool can tell a good address from a bad one by its name — the author's licence server and an attacker's collector look identical. So this scanner does not try. It flags the shape of the attack (a web response compiled with load(), a URL assembled in hex, known panel hosts) and then simply lists every other outbound address under the OUTBOUND tab. You are the only one who knows which of them belong.

What to do: read that list. An address you recognise as the author's is fine. One you do not recognise is a reason to ask them — or to remove the resource.

Signatures for the Cipher panel were shared within the MenanAk47 / server-owner community.

os.execute, io.open, io.popen

A FiveM resource has no legitimate need to run shell commands or read and write arbitrary files on the host. These calls let a backdoor install a persistent loader, edit other resources, or run a program on your machine.

What to do: any of these in a gameplay resource is a red flag — verify the exact use or remove it.

Reference: docs.yorick.gg/Security/Backdoors.

Decompiled and “cracked” resources

Most paid FiveM scripts ship under Cfx escrow (a .fxap file). Escrow itself is completely normal — it is what a resource you bought looks like. A cracked copy is the opposite: somebody ran the protected code through a decompiler to make it readable again and give it away. The result is unmistakable, because a decompiler renames every variable to L0_1, A1_2 and so on. No person writes code that way.

A cracked resource does not have to contain a backdoor to be dangerous. It usually arrives with no updates and no support, and it passed through the hands of somebody who could change any line in it before handing it to you. That is why leaked packs are the most common way servers get infected — not because the original script was bad, but because of what was added on the way.

What to do: buy it from the author, or do not run it. If you already did, treat the server as exposed.

Detection thresholds were measured against a real leaked resource and its bought original.

Events that trust the client

A server RegisterNetEvent that hands out money, items or admin rights without checking who fired it is not a hidden backdoor but an open door: any player can trigger it. This is the most common way servers get drained. It is a design flaw, not obfuscation, so read the handler, not just the name.

What to do: every money/item/permission event must verify the source server-side. Never trust values the client sends.

Reference: docs.yorick.gg security notes.

This scanner matches known patterns; it cannot prove a resource is safe, only flag the signs of the common ones. Deep obfuscation can still hide. When in doubt, do not run untrusted code on a live server.