Scan FiveM Resources for Backdoors and Security Risks
Upload a FiveM resource as a ZIP. FXScan reads its fxmanifest.lua, parses the Lua and JavaScript, and uses static analysis to trace suspicious code - backdoors, remote code execution chains, unsafe net events - with the file, line and evidence behind every finding.
Three scans a month, free · Source code is parsed, never executed
What the FiveM backdoor scanner detects
66 rules in eight categories, each with a test fixture that must trigger it and one that must not. The full list is in the detection rule catalogue.
Backdoors and remote code execution
The classic FiveM backdoor fetches a payload, decodes it and runs it. FXScan follows the HTTP response through decoders, locals and aliases to load(), loadstring() or eval(), and reports the whole chain.
Anatomy of a FiveM backdoor →PerformHttpRequest abuse
A request on its own is normal. A request whose response becomes code, a server command or a file on disk - or that carries your license key, database string or player identifiers out - is not.
PerformHttpRequest security →Dynamic code execution
load, loadstring, eval, the Function constructor and string timers - including when they are aliased, reached through _G, or handed a literal that decodes to something dangerous.
Remote code execution in FiveM →Unsafe net events
Server-side handlers that grant money, items, weapons, jobs or permissions using values the client sent, or that trust a client-supplied player id instead of source.
Unsafe net events explained →Obfuscation
Long Base64 and hex blobs, strings built from character codes, XOR routines, machine-generated identifiers and high-entropy literals. Flagged as a reason to look, never as proof of malice on its own.
Obfuscation rules →fxmanifest.lua review
Every resource is discovered from its manifest, read without being executed, so each finding knows whether the file runs on the server or the client. Writes to another resource's manifest or to server.cfg are flagged.
fxmanifest.lua guide (Titan Software) →Why the report is worth reading
Three things that separate a finding you can act on from a list of keywords.
Remote execution tracing
Tells a benign PerformHttpRequest apart from request → decode → load(), and shows the chain with file and line.
Manifest-aware scanning
Reads fxmanifest.lua declaratively, so every finding knows whether the file runs on the server, the client, or never.
Actionable remediation
Proposes a patch with a diff and an impact statement. Nothing is applied until you accept it.
How the static analysis works
Five stages, none of which run the code they are reading.
- 01
Archive validation
Traversal, symlinks, ratio and entry count, before a byte is written.
- 02
Safe extraction
Streamed against hard byte budgets, so a ZIP bomb dies mid-flight.
- 03
Manifest discovery
Every resource found from its manifest, parsed and never executed.
- 04
AST and taint analysis
Tree-sitter syntax trees, then untrusted data followed to dangerous sinks.
- 05
Evidence generation
Findings with file, line, excerpt and the data-flow chain behind them.
Limits of static analysis
What it cannot do
- This is static analysis. A resource can still behave maliciously in ways no static analyser can observe.
- Escrow-protected .fxap files are encrypted and cannot be read. The report says so rather than staying silent.
- Obfuscation is flagged but is not proof of malice - though it does hide behaviour.
- Nested archives are reported and never unpacked.
A clean report is evidence, not a guarantee. Review anything that will run on your server.
FiveM backdoor scanner FAQ
What the scan does with your archive, who can read the result, and what it does not claim.
- Is uploaded code executed?
- No. Analysed code is read, hashed and parsed into a syntax tree. There is no eval, no load of an analysed file, no child process, no manifest evaluation, and no outbound request to any URL found inside the archive.
- Who can see my scan reports?
- Only the account that created them. Reports are private by default and cannot be opened by guessing a link or knowing an id. You can create a revocable read-only share link if you want to show one to somebody.
- Does a clean report mean the resource is safe?
- No. It means no rule matched. Static analysis proves the presence of a pattern, never its absence: a resource can be malicious in a way no rule covers yet. Read the report's stated limits and review anything that will run on your server.
- What languages does it analyse?
- Lua, JavaScript and TypeScript, parsed into real syntax trees. Native binaries and precompiled Lua bytecode are recorded as unreadable rather than analysed, which is itself reported.
- Why does it not flag every PerformHttpRequest or load() call?
- Because that would be noise. Plenty of legitimate resources make HTTP requests, and load() has real uses. A finding requires a data-flow path from untrusted input to a dangerous sink - the chain, not the individual call.
- Does it check fxmanifest.lua?
- Yes. The manifest is parsed declaratively - never executed - to find every resource in the archive and to know whether each file runs on the server, on the client, or not at all. A resource that writes to another resource's manifest at runtime is a finding of its own.
- Is FXScan free?
- There is a free plan with three scans a month, which is enough to check the resources you were about to install. Paid plans raise the scan allowance, upload size and report retention.
- How large an archive can it handle?
- Upload size, extracted size and file count are all capped by the deployment's configuration, and an archive that exceeds a limit is rejected rather than partially analysed.
Read more
How malicious FiveM resources are actually built, and the full rule catalogue.
Scanning resources is one part of running a safe server. For the rest, read Titan Software's FiveM server security guide. Checking a server rather than a resource? You can look up a FiveM server with CFXR.
Scan a resource before you install it
Three scans a month on the free plan. Upload a ZIP, read the findings, decide with the evidence in front of you.
Create a free account