Lua-FiveM-Malware-Guard

Lua FiveM Malware Guard: A powerful resources extension for FiveM servers owners to enhance server security by preventing unauthorized Lua functions, managing resource permissions, and receiving real-time alerts via Discord webhooks.

About

Lua FiveM Malware Guard is a security-focused resources extension for FiveM servers owners. It is designed to prevent the usage of Lua functions such as os.execute, os.getenv, io.popen etc., and sensitive FiveM native functions in resources, and it allows the server owner to assign permissions to each resource to specify which functions are allowed. The resource also includes a Discord webhook system for alerting administrators of trigger attempts, with three levels of alerts: normal, high, and very high.

Table of Contents

• Demo
• Features
• File Structure
• Usage Steps
• Configuration
• Testing
• ToDo List
• Functions Covered
• How to Contribute
• Contact
• License
• Disclaimer and Limitations

🔥 Demo

Discord Webhook Alerts.

🌠 Features

• Prevent the usage of sensitive Lua functions and sensitive FiveM native functions.
• Control resource-level permissions for specific functions.
• Discord webhook integration for real-time alerts.
• Three levels of alerts (normal, high, very high).
• Zero Dependencies.
• Compatibility with All Frameworks, Whether you're using ESX, QBCore, vRP, or any other framework.
• Cross-Platform Compatibility with both Windows and Linux.
• Anti-Debugging and Override System.
• Centralized config via convars — one config.lua controls webhooks, verbosity, function defaults, overrides, and whitelist for all resources.
• Folder-based whitelisting with nested folder support (e.g. [DRM]/[PAIDSCRIPTS]/resource).
• Per-resource and per-folder function control overrides — customize which functions are monitored or blocked for any resource or folder.
• Whitelisted resources with overrides — whitelist a resource but still monitor specific functions, with m3lm_list showing [WHITELISTED(-n)] markers.
• Windows PowerShell deployer script that automatically distributes m3lm_protection.lua to all applicable resources, including network drive support.

📁 File Structure

m3lm_guard/
├── config.lua                          ← webhooks, verbosity level, whitelist
├── fxmanifest.lua
├── server/
│   └── main.lua                        ← pushes config convars at startup
├── citizen_scripts/
│   ├── m3lm_protection.lua             ← distributed to each resource by the deployer
│   └── resource_init.lua               ← copy this to citizen/scripting/ on your server
├── Deploy-Protection.ps1               ← auto-deploys m3lm_protection.lua to all resources
└── Deploy-Protection.bat               ← double-click launcher for the deployer on Windows

m3lm_test/                              ← optional test resource (harmless)
├── fxmanifest.lua
└── server/
    └── test.lua                        ← run m3lm_runtest in console to verify guard

Note: protection.lua has been renamed to m3lm_protection.lua to avoid conflicts with other resources that ship their own protection.lua file.

🔨 Usage Steps

Deployer Preview

1. Locate citizen/scripting/resource_init.lua within your FiveM server build files and replace it with citizen_scripts/resource_init.lua from this project. This ensures m3lm_protection.lua is injected into every resource's manifest automatically.

2. Place the m3lm_guard resource folder into your server's resources/ directory.

3. Add ensure m3lm_guard to your server.cfg before all other resources so convars are set before anything else loads.

4. Open m3lm_guard/config.lua and configure your Discord webhook URLs, verbose level, and whitelist.

5. Run Deploy-Protection.bat (Windows) to automatically copy m3lm_protection.lua into every unwhitelisted resource folder. Re-run this whenever you add new resources or change the whitelist.

6. Reboot your server twice:

   • First boot: m3lm_guard starts and pushes config convars.
   • Second boot: all resources load with m3lm_protection.lua active and reading the correct config.

⚙ Configuration

All configuration lives in config.lua:

Config.Webhooks = {
    Normal   = 'YOUR_WEBHOOK_URL',   -- level 1 alerts
    High     = 'YOUR_WEBHOOK_URL',   -- level 2 alerts
    VeryHigh = 'YOUR_WEBHOOK_URL',   -- level 3 alerts
}

-- 0 = silent, 1 = blocks only (default), 2 = all calls
Config.VerboseLevel = 1

-- Global function defaults — true = allow, false = block
-- See config.lua for the full list and legend
Config.FunctionDefaults = {
    PerformHttpRequest  = true,
    os_execute          = true,
    os_getenv           = false,  -- blocked by default
    io_popen            = true,
    ExecuteCommand      = true,
}

-- Per-resource or per-folder function overrides
-- Merged on top of FunctionDefaults for normal resources
-- Only list the functions you want to change from the defaults
Config.Overrides = {
    ['my_shop']      = { PerformHttpRequest = false },         -- block HTTP for this resource
    ['[my-folder]']  = { ExecuteCommand = false },             -- block for whole folder
}

-- Whitelist — skip protection entirely
-- Supports nested folders e.g. ['[DRM]'] matches [DRM]/[PAIDSCRIPTS]/resource
Config.Whitelist = {
    ['[DRM]']             = true,   -- skip entire folder tree
    ['my_trusted_resource'] = true, -- skip a single resource
}

Whitelisted resources with overrides

A resource can be in both Whitelist and Overrides at the same time. It will be skipped for full protection but will still monitor only the explicitly listed functions — everything else is untouched:

Config.Whitelist = { ['[DRM]'] = true }
Config.Overrides = {
    ['[DRM]'] = {
        PerformHttpRequest = true,   -- monitor license checks
        os_execute         = false,  -- block — DRM should never need this
    },
}

These show as [WHITELISTED(-n)] in m3lm_list where n is the number of override functions.

Deployer Script

Deploy-Protection.bat reads the whitelist and overrides directly from config.lua. Run it whenever you:

• Add new resources
• Change config
• Update m3lm_protection.lua

The deployer runs in two passes:

1. Clean — removes all existing m3lm_protection.lua files
2. Deploy — copies m3lm_protection.lua into every applicable resource, including whitelisted resources that have overrides

🧪 Testing

A harmless test resource m3lm_test is included to verify that m3lm_protection.lua is working correctly in your server environment.

Setup

1. Place m3lm_test in your resources/ folder
2. Add ensure m3lm_test to server.cfg
3. Run Deploy-Protection.bat so m3lm_protection.lua gets copied into m3lm_test
4. Reboot your server

Running the test

Type the following in your server console:

m3lm_runtest

What it tests

Test	Expected Result
os.getenv	Blocked by guard
os.execute with dangerous command (rm -rf)	Blocked by guard
os.execute with bypass attempt (resource_init)	Blocked by guard
os.execute with safe command	Nil (FiveM engine sandbox)
io.popen with dangerous command (curl)	Blocked by guard
io.popen with safe command	Nil (FiveM engine sandbox)
SaveResourceFile	Allowed and logged
PerformHttpRequest	Allowed and logged (async)
ExecuteCommand	Allowed and logged

What to look for

Guard alerts from m3lm_protection.lua should appear interleaved with the test results:

[script:m3lm_test] [m3lm_guard:m3lm_test] os.getenv: BLOCKED: PATH
[script:m3lm_test] [m3lm_guard:m3lm_test] os.execute: BLOCKED: rm | rm -rf ...
[script:m3lm_test] [m3lm_guard:m3lm_test] io.popen: BLOCKED: curl | curl http://example.com

Note: m3lm_test is purely a diagnostic tool. It never executes any dangerous commands — dangerous strings are passed as arguments but the guard blocks them before any real execution occurs. Safe to run on a live server.

⚡ ToDo List

If you're interested in contributing to FiveM SecurityGuard, here are some tasks that need attention. Feel free to pick an item from the list, work on it, and submit a pull request. If you have new ideas or find issues not listed here, please open an issue to discuss them.

Core Functionality and Security Features

• Add more functions to enhance security coverage.
• Create Client Side functions security system, By using the TriggerServerEvent native to check.
• Explore the possibility of supporting other programming languages, such as JavaScript (JS) and C#.
• Implement additional security checks for the functions.
• Enhance the permission management system.
• Address any identified security vulnerabilities or bugs.
• Investigate and fix reported bugs or issues.

⚙ Functions Covered

Here is a list of functions covered by Lua FiveM Malware Guard with descriptions and links to relevant documentation:

Lua Functions

1. io.popen — Opens a pipe to execute a command and returns a file handle. Lua Documentation
2. os.execute — Executes an operating system command. Lua Documentation
3. os.clock — Returns an approximation of the amount in seconds of CPU time used by the program. Lua Documentation
4. os.getenv — Retrieves the value of an environment variable. Lua Documentation
5. os.remove — Removes a file or directory. Lua Documentation
6. os.rename — Renames a file or directory. Lua Documentation
7. io.read — Reads from a file. Lua Documentation
8. io.open — Opens a file or returns a new file handle. Lua Documentation
9. io.close — Closes the given file. Lua Documentation
10. io.input — Sets the default input file. Lua Documentation
11. io.write — Writes to the default output file. Lua Documentation
12. io.stdin — The standard input file. Lua Documentation
13. io.stdout — The standard output file. Lua Documentation
14. io.stderr — The standard error file. Lua Documentation
15. debug.getinfo — Retrieves information about a function. Lua Documentation
16. debug.getlocal — Gets information about a local variable. Lua Documentation
17. debug.getupvalue — Gets the value of an upvalue from a function. Lua Documentation
18. debug.sethook — Sets a new hook function for debugging. Lua Documentation

FiveM Functions

1. GetCurrentServerEndpoint — Returns the endpoint URL of the current server. FiveM Documentation
2. StartResource — Starts a specified resource. FiveM Documentation
3. StopResource — Stops a specified resource. FiveM Documentation
4. SetResourceKvpFloat — Sets a floating-point key-value pair for a resource. FiveM Documentation
5. SetResourceKvpFloatNoSync — Sets a floating-point KVP without synchronizing. FiveM Documentation
6. SetResourceKvpInt — Sets an integer key-value pair for a resource. FiveM Documentation
7. SetResourceKvpIntNoSync — Sets an integer KVP without synchronizing. FiveM Documentation
8. SetResourceKvpNoSync — Sets a KVP without synchronizing. FiveM Documentation
9. SetResourceKvp — Sets a key-value pair for a resource. FiveM Documentation
10. SetHttpHandler — Sets a custom HTTP handler for resource-specific HTTP requests. FiveM Documentation
11. SetMapName — Sets the map name for the server. FiveM Documentation
12. SetGameType — Sets the game type for the server. FiveM Documentation
13. SetConvar — Sets the value of a convar for the server. FiveM Documentation
14. GetConvar — Retrieves the value of a convar for the server. FiveM Documentation
15. SetConvarReplicated — Sets a convar and replicates it to all clients. FiveM Documentation
16. SetConvarServerInfo — Sets a convar as a server info convar. FiveM Documentation
17. SaveResourceFile — Saves a file within a resource. FiveM Documentation
18. GetGameName — Retrieves the name of the game on the server. FiveM Documentation
19. GetGameBuildNumber — Retrieves the build number of the game. FiveM Documentation
20. GetCurrentResourceName — Retrieves the name of the currently executing resource. FiveM Documentation
21. PerformHttpRequest — Performs an HTTP request from the server. FiveM Documentation
22. DeleteFunctionReference — Deletes a reference to a specific function. FiveM Documentation
23. DeleteResourceKvp — Deletes a key-value pair associated with a resource. FiveM Documentation
24. DeleteResourceKvpNoSync — Deletes a KVP without synchronizing. FiveM Documentation
25. DuplicateFunctionReference — Creates a duplicate reference to a function. FiveM Documentation
26. EnableEnhancedHostSupport — Enables enhanced host support for the server. FiveM Documentation
27. ExecuteCommand — Executes a console command on the server. FiveM Documentation
28. FlushResourceKvp — Flushes all key-value pairs for the current resource. FiveM Documentation
29. GetHashKey — Retrieves the hash value for a string. FiveM Documentation
30. GetHostId — Retrieves the host identifier of the server. FiveM Documentation
31. GetNumResources — Retrieves the number of loaded resources. FiveM Documentation
32. GetPasswordHash — Retrieves the hashed password of a player. FiveM Documentation
33. GetPlayerEndpoint — Retrieves the endpoint (IP and port) of a player. FiveM Documentation
34. GetPlayerIdentifier — Retrieves a player's identifier based on their server ID. FiveM Documentation
35. GetNumPlayerIdentifiers — Retrieves the number of identifiers for a player. FiveM Documentation
36. GetNumPlayerIndices — Retrieves the number of player indices on the server. FiveM Documentation
37. GetNumPlayerTokens — Retrieves the number of player tokens on the server. FiveM Documentation
38. GetNumResourceMetadata — Retrieves the number of metadata entries for a resource. FiveM Documentation
39. GetPlayerName — Retrieves the name of a player based on their server ID. FiveM Documentation
40. GetPlayerToken — Retrieves a player's token based on their server ID. FiveM Documentation
41. GetResourcePath — Retrieves the path of a resource on the server. FiveM Documentation
42. LoadPlayerCommerceData — Loads commerce data for a player. FiveM Documentation
43. LoadPlayerCommerceDataExt — Loads extended commerce data for a player. FiveM Documentation
44. LoadResourceFile — Loads a file from a resource and returns its contents as a string. FiveM Documentation
45. NetworkGetEntityFromNetworkId — Retrieves an entity based on its network ID. FiveM Documentation
46. NetworkGetEntityOwner — Retrieves the owner of a networked entity. FiveM Documentation
47. NetworkGetFirstEntityOwner — Retrieves the owner of the first networked entity found. FiveM Documentation
48. NetworkGetNetworkIdFromEntity — Retrieves the network ID of a networked entity. FiveM Documentation
49. NetworkGetVoiceProximityOverride — Retrieves the voice proximity override level for a player. FiveM Documentation
50. RegisterConsoleListener — Registers a console command listener callback function. FiveM Documentation
51. RegisterResourceAsset — Registers a file or directory as a resource asset. FiveM Documentation

❤ Contribute

Contributions to the Lua FiveM Malware Guard project are welcome! Follow these steps to contribute:

1. Fork the repository.
2. Create a new branch for your feature or bug fix.
3. Make your changes and test thoroughly.
4. Create a pull request with a clear description of your changes.

📞 Contact

• Open an Issue: If you encounter a technical issue or have a specific request related to the project.
• Compliance and Problem Reporting: For compliance-related matters or to report any problems contact via Email: info@m3lm.co.
• Discord Community: Join M3LM Games vibrant Discord community for chatting with fellow contributors, planning and showcasing your achievements, and inquiring.

License

MIT

Disclaimer and Limitations

• This project, Lua FiveM Malware Guard, is intended solely for educational and informational purposes. It is designed to provide a better understanding of potential security vulnerabilities within the FiveM platform and to help prevent the misuse of certain functions. The project's creators and contributors do not endorse or encourage any illegal or unethical activities, including but not limited to hacking, cheating, or any actions that violate the terms of service of the FiveM platform or the Laws.
• Users of this project are responsible for their own actions and are expected to adhere to all applicable laws and regulations. The project's creators and contributors are not responsible for any misuse, harm, or legal consequences resulting from the use of this project.
• It is essential to use this project responsibly and ethically, respecting the rules and policies of the FiveM platform and any relevant local, state, or federal laws. If you choose to use this project, you do so at your own risk, and the project's creators and contributors shall not be held liable for any actions or consequences arising from its use.
• By using this project, you acknowledge and agree to the terms of this disclaimer. If you do not agree with these terms, you should refrain from using or contributing to this project.