How the Backdoor Scanner Works

The Backdoor Scanner is one of the most asked-about features on the panel. This post explains what it does, how it works, and how to read the results.

What it scans

The scanner parses the Lua in your addon files and checks it against a set of known malicious patterns. These include:

• Remote code execution: RunString(), CompileString(), BroadcastLua(), SendLua(). These functions execute arbitrary Lua code. In a backdoor, they are combined with HTTP requests to fetch and run code from an external server.
• OS access: os.execute(), io.popen(), FFI access. These let Lua code run system commands on the host machine. Legitimate addons almost never use these.
• Obfuscation: Base64 blobs, string.char sequences, hex escape chains, string.reverse patterns. Backdoors hide their payloads by encoding them so they are not readable in plain text.
• Environment manipulation: getfenv(), setfenv(), debug.getregistry(). These modify the Lua runtime environment to bypass sandboxing or tamper with other addons.
• Compound patterns: http.Fetch + RunString, net.Receive + RunString, timer.Create + CompileString. These multi-function patterns are the signature of a working backdoor.

Severity levels

• Critical (red): Direct code execution vectors. Investigate immediately.
• High (orange): Obfuscated strings or environment manipulation. Likely malicious if found in an addon you did not write.
• Medium (yellow): HTTP requests, file writes, console commands. Sometimes legitimate, but worth reviewing.
• Likely Safe: Findings inside well-known trusted addons like ULX, DarkRP, or PAC3. These are reviewed patterns that are not malicious.

What to do with the results

Not every finding is a confirmed backdoor. Legitimate addons use http.Fetch for update checks and RunString in sandbox features. The scanner gives you the file path, the line number, and the surrounding code context. Read it. If the code is fetching from an unknown URL and executing the response, remove that addon. If it is a known admin tool doing something expected, dismiss the finding.

When in doubt, remove the addon and find an alternative from a trusted source. The GMod community has a long history of leaked and cracked addons containing hidden payloads. If you did not pay for it or download it from the official source, scan it.

The Backdoor Scanner is included in every GMod hosting plan on Zeros Host. Start a 24-hour free trial at zerosrp.co.uk/register.