Backdoor Scanner
Checks Lua and JS for code that downloads and runs payloads, reads your server secrets or hands out admin.
Start here
Run Backdoor Scanner on a copy of your source files
PulseConvert → FiveM tools → Backdoor Scanner
Open the workflow: PulseConvert → FiveM tools → Backdoor Scanner. If the tool is locked, check its access notice instead of assuming it is available to your account.
Prepare the exact kind of input listed for this feature: Input: A resource zip or your whole resources folder. Keep an unchanged backup and ensure you have permission to reuse the assets.
Open the tool page and provide the requested source files and any displayed options. Check that the detected file types match the input requirement; do not replace unrelated files just to make an upload succeed.
Review the resulting files or job details. Expected outcome: Expected output: A risk verdict with every flagged line and the hosts it talks to. Read every flagged path and host before removing code: heuristic findings are leads for review, not proof of malicious behavior.
Compare the result with your original in a local editor. For resources that load in FiveM, start with an isolated test server; inspect the first client/server console error and test the asset in game before installing it for players.
Practical example
Checks Lua and JS for code that downloads and runs payloads, reads your server secrets or hands out admin. Keep the original file beside the result so you can compare what changed.
Before you begin
- Input: A resource zip or your whole resources folder.
- Access it through PulseConvert's tool directory.
- The registry labels this as a local/browser-side tool; check its page for any exceptions.
Overview of the setup
Prepare the input
Work on a copy of your originals. Gather: A resource zip or your whole resources folder. Check that any source asset can legally be reused.
Run Backdoor Scanner
Open Backdoor Scanner in PulseConvert and supply the requested input or settings. Read every flagged path and host before removing code: heuristic findings are leads for review, not proof of malicious behavior.
Review the result
Expected result: A risk verdict with every flagged line and the hosts it talks to. Read reported warnings, inspect the generated files and try the output in a separate test server or appropriate editor before production use.
Features explained
What each feature does and what to check before publishing or installing the result.
Purpose
Checks Lua and JS for code that downloads and runs payloads, reads your server secrets or hands out admin.
Input and preparation
Bring A resource zip or your whole resources folder. Keep an unchanged copy for comparison and rollback.
Result and verification
Expected output: A risk verdict with every flagged line and the hosts it talks to. Read every flagged path and host before removing code: heuristic findings are leads for review, not proof of malicious behavior.
If it still does not work
- If the tool rejects the input, compare your file extension and the files inside the archive to the input requirement above. Source files inside nested folders may need extra review.
- If the tool reports success but the result does not function, do not assume the file is compatible: inspect warnings, actual output names and their references, manifest files, and version compatibility.
- This is marked beta/untested. A downloadable file does not establish correct FiveM behavior.
Troubleshooting and safety checks
- Unsupported format or missing files? Verify the input matches the exact type described above and that the archive isn't only a screenshot/readme.
- Output exists but fails in FiveM? Check the resource folder, generated manifest, file references, first client/server console error and version compatibility.