Cheat Research & Detection

Reference guide for identifying and tracking known cheat providers, detection methods, and suspicious file patterns.

---

Known Cheat Providers

Cheat	Category	Platform	Known Files
SkriptGG	PvP	FiveM, RageMP, AltV	Various
RedEngine	Executor	FiveM	settings.cock
EulenCheats	Executor	FiveM	Unknown
tzProject	PvP	FiveM	svchost.exe, packages.json
hydrogenAC	PvP	AltV	Various
0xCheats	PvP	RageMP, AltV	Various

---

Detection Methods

System-Wide File Scans

Scan for Suspicious Executables

:: Check for .exe, .jar, .dll files in user directory
dir /b /s C:\Users\*.jar
dir /b /s C:\Users\*.dll
dir /b /s C:\Users\*.exe

:: Combined scan
dir /b /s C:\Users\*.jar & dir /b /s C:\Users\*.dll & dir /b /s C:\Users\*.exe

What to look for: - Unusual executable names (svchost.exe in wrong location) - DLLs in AppData folders - JAR files in user directories - Recently modified files

FiveM-Specific Locations

:: Check FiveM cache for suspicious configs
FiveM\FiveM.app\data\cache\subprocess
:: Look for: config.json, settings files, unknown configs

Suspicious indicators: - Injector configurations - Modified game files - External DLL references - Unauthorized resource listings

Crash Dumps Directory

:: Check for crash logs that may indicate injection attempts
C:\Users\%username%\AppData\Local\CrashDumps

What indicates cheating: - Dumps from cheat injection processes - Multiple crash dumps with suspicious process names - Recent timestamp activity - Process names matching known cheats

Windows History & Artifacts

:: Check file access history
C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\History

:: Registry Run keys (common injection point)
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

:: Startup folder
C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

---

File Patterns to Monitor

Known Cheat File Signatures

RedEngine: - settings.cock - Configuration file - Associated DLLs in temp directories - Modified FiveM resource files

tzProject: - svchost.exe - Disguised process name - packages.json - Dependency/module list - Modified system executables

Generic Executor Indicators: - .lua files with obfuscated code in AppData - Modified system DLLs in non-standard locations - DLL injection proxy files - Renamed executables mimicking system processes

Code-Level Detection

Suspicious Lua Patterns:

-- Obfuscated functions
local a,b,c=loadstring or load
-- String manipulation to hide code

Suspicious Native Calls:

-- Disabling collision
SetEntityNoCollisionEntity()
-- God mode patterns
SetEntityInvincible()
-- Invisible rendering
SetEntityVisible(ped, false)

---

Anti-Cheat Implementation

Client-Side Detection Hooks

-- Monitor suspicious function loading
local originalLoadstring = loadstring or load
function _G.loadstring(code)
    -- Log and validate loaded code
    if isCheatCode(code) then
        TriggerServerEvent('cheat:detected', 'suspicious_loadstring')
        return nil
    end
    return originalLoadstring(code)
end

-- Monitor model loading
local originalRequestModel = RequestModel
function _G.RequestModel(model)
    if isBlacklistedModel(model) then
        TriggerServerEvent('cheat:detected', 'blacklisted_model', model)
        return
    end
    return originalRequestModel(model)
end

Server-Side Validation

-- Log all player resources
AddEventHandler('playerConnecting', function(name, reason, deferrals)
    local player = source
    -- Verify only whitelisted resources are running
    ValidatePlayerResources(player)
end)

-- Monitor suspicious network events
AddEventHandler('entityCreating', function(entity)
    local owner = NetworkGetEntityOwner(entity)
    if not HasPermission(owner, 'create_entities') then
        -- Log and potential kick
        BanPlayer(owner, 'Unauthorized entity creation')
        CancelEvent()
    end
end)

-- Check for injected code execution
AddEventHandler('playerSpawned', function()
    local player = source
    CheckPlayerEnvironment(player)
end)

---

Detection Triggers & Rate Limiting

Suspicious Activity Patterns

Activity	Threshold	Action
Model requests per second	>10	Log & investigate
Entity creation per second	>5	Warn & temporary restrict
Explosions per minute	>20	Kick & log
Position teleports (no vehicle)	>3 per 10s	Kick & investigate
Rapid weapon switching	>5 per second	Check inventory
Non-existent entity access	Any	Log & kick
Unauthorized NUI execution	Any	Kick & log

Implementation Example

local playerStats = {}

function TrackPlayerActivity(player)
    if not playerStats[player] then
        playerStats[player] = {
            lastPos = nil,
            modelRequests = 0,
            explosions = 0,
            lastCheck = GetGameTimer()
        }
    end

    local stats = playerStats[player]
    local now = GetGameTimer()

    -- Reset counters every second
    if now - stats.lastCheck > 1000 then
        stats.modelRequests = 0
        stats.explosions = 0
        stats.lastCheck = now
    end

    return stats
end

function CheckForCheatActivity(player)
    local stats = TrackPlayerActivity(player)

    if stats.modelRequests > 10 then
        BanPlayer(player, 'Excessive model loading')
    end

    if stats.explosions > 20 then
        BanPlayer(player, 'Explosion spam')
    end

    -- Check for impossible movement
    if ImpossibleMovement(player) then
        BanPlayer(player, 'Teleport detection')
    end
end

---

Resource Injection Prevention

fxmanifest.lua Protection

fx_version 'cerulean'
game 'gta5'

author 'Admin'
description 'Anti-Cheat Core'
version '1.0.0'

-- Only allow official resources
dependencies {
    '/server:latest',
}

-- Verify resource integrity
files {
    'data/whitelisted_resources.json'
}

-- Monitor resource loading
server_scripts {
    'server/resource_monitor.lua'
}

Verify Resource Cryptography

-- Verify resource file checksums
function VerifyResourceIntegrity(resourceName)
    local manifest = GetResourceMetadata(resourceName, 'version', 0)
    local hash = CalculateResourceHash(resourceName)

    if not IsHashWhitelisted(hash) then
        return false
    end
    return true
end

---

Memory Scanning

Check FiveM Process Memory

-- Detect injected DLLs
local function CheckLoadedDLLs()
    local suspiciousDLLs = {
        'cheatengine',
        'redengine',
        'frida',
        'x64dbg'
    }

    -- Use external memory reading tools
    -- This requires privileged access
end

---

Whitelist/Blacklist Management

Resource Whitelist

local WHITELISTED_RESOURCES = {
    'cv_framework',
    'cv_inventory',
    'cv_jobs',
    -- Add authorized resources
}

function IsResourceWhitelisted(resourceName)
    for i = 1, #WHITELISTED_RESOURCES do
        if WHITELISTED_RESOURCES[i] == resourceName then
            return true
        end
    end
    return false
end

-- Prevent unwhitelisted resources from starting
AddEventHandler('onResourceStart', function(resourceName)
    if GetResourceState(resourceName) == 'started' then
        if not IsResourceWhitelisted(resourceName) then
            StopResource(resourceName)
            TriggerEvent('cheat:detected', 'unauthorized_resource', resourceName)
        end
    end
end)

Model Blacklist

local BLACKLISTED_MODELS = {
    'chp1', -- Police uniforms modifications
    'player_zero', -- Suspicious models
}

function IsModelBlacklisted(modelHash)
    for i = 1, #BLACKLISTED_MODELS do
        local hash = GetHashKey(BLACKLISTED_MODELS[i])
        if hash == modelHash then
            return true
        end
    end
    return false
end

---

Incident Response

When Cheating is Detected

1. Immediate Actions:
2. Kick player immediately
3. Log incident with timestamp and player ID

4. Capture player data for investigation

5. Investigation:

6. Review player activity logs
7. Check loaded resources
8. Analyze suspicious network events

9. Interview server admins who witnessed activity

10. Punishment:

11. Ban player from server
12. Report to CFX services if applicable

13. Share information with other community servers

14. Prevention:

15. Update blacklists
16. Patch vulnerabilities used
17. Notify other admins

function ReportCheat(player, reason, evidence)
    local report = {
        player = GetPlayerName(player),
        steam = GetPlayerIdentifiers(player)[1],
        reason = reason,
        evidence = evidence,
        timestamp = os.date("%Y-%m-%d %H:%M:%S"),
        serverId = GetConvarInt('sv_licenseKeyToken', 0)
    }

    -- Log locally
    SaveLogData('cheats/' .. player .. '.log', json.encode(report))

    -- Alert admins
    TriggerEvent('cheat:alert', report)
end

---

Tools for Investigation

Windows Built-in: - Task Manager - Monitor running processes - Event Viewer - Check system logs - Registry Editor - Look for RunOnce/Run keys - Performance Monitor - Track suspicious DLL loading

Third-party: - Process Explorer - Advanced process monitoring - Autoruns - Startup program auditing - Winaero Tweaker - System modification detection - Everything Search - Fast file searching

FiveM-Specific: - Profiler (profiler view) - Detect code injection - Resource Monitor (resmon 1) - Monitor resources - Console Commands - Network debugging

---

Legal & Privacy Considerations

⚠️ Important: When implementing anti-cheat:

1. Inform Players: Disclose anti-cheat monitoring in server rules
2. Fair Enforcement: Ensure detection is accurate before banning
3. Appeals Process: Provide a way for false-positive victims to appeal
4. Data Protection: Only store data necessary for cheat detection
5. Community: Share findings responsibly with other server admins

---

Resources

• CFX.re Security Guidelines
• OWASP Cheat Sheet Series
• FiveM Forum - Security