scanner-fivem

Userland x64 scanner that walks the virtual memory of every live FiveM game process and reports whether a target string is present. Built for detection research against known cheat frameworks. The signature currently ships hardcoded as eulencheats.com (XOR-obfuscated at rest with key 0xAA), so the tool operates as an "EULEN presence" detector out of the box. Swap the string in main.cpp to hunt for other artifacts.

All process memory access goes through direct syscalls (SysNtOpenProcess, SysNtQueryVirtualMemory, SysNtReadVirtualMemory, SysNtAllocateVirtualMemory), so kernel32 and ntdll API hooks in userland do not see the reads.

What It Does

1. Verifies administrator token, enables all privileges on the current process token.
2. XOR-decrypts the target signature at runtime.
3. Enumerates every running process via K32EnumProcesses.
4. Regex-matches each name against the FiveM launcher patterns:
   • FiveM_b(\d{4})_GameProcess.exe
   • FiveM_b(\d{4})_GTAProcess.exe
5. For every match, walks committed virtual memory regions using SysNtQueryVirtualMemory, copies each region into a local buffer with SysNtReadVirtualMemory, scans for the signature.
6. On hit, prints Result: EULEN IN ISTANCE.
7. On completion prints elapsed scan time in seconds.

Features

• No external dependencies at runtime.
• Direct syscall stubs (assembly, kernel_call-asm.x64.asm), no ntdll calls for the memory path.
• Runtime XOR-obfuscated signature so the target string is not visible in a static hex dump of the binary.
• Compatible with any Windows x64 build.
• Requires administrator privileges.
• Low CPU and RAM footprint.
• Single executable, easy to drop on any host.

Repository Layout

scanner-fivem/
├── scanner-fivem.sln                # Visual Studio solution
└── scanner/
    ├── scn.vcxproj                  # x64 EXE project
    ├── scn.vcxproj.filters
    ├── scn.vcxproj.user
    ├── main.cpp                     # entry point, regex targets, signature scan
    ├── krnl.c                       # syscall dispatch wrappers
    ├── krnl.h                       # Nt* prototypes, structs, PROCESSINFOCLASS
    ├── kernel_call-asm.x64.asm      # raw syscall stubs (MASM x64)
    ├── utility.hpp                  # admin check, token priv, enum helpers
    └── scn/

Requirements

• Visual Studio 2019 or newer, Desktop C++ workload.
• Windows 10/11 SDK.
• x64 target only.
• MASM enabled in the project (already configured in .vcxproj for the .asm file).
• Administrator on the host running the scanner.

Build

Visual Studio:

1. Open scanner-fivem.sln.
2. Set configuration to Release | x64.
3. Build the solution.
4. Output lands at scanner/x64/Release/scn.exe (or the configured intermediate path).

Command line (Developer Command Prompt for VS):

msbuild scanner-fivem.sln /p:Configuration=Release /p:Platform=x64

Usage

Run from an elevated shell:

scn.exe

The scanner enumerates FiveM game processes automatically. No arguments required. Wait for the run to finish. If the signature is found in any FiveM game process, the tool prints the result line. If nothing matches, the tool exits after reporting the elapsed time.

Example run:

[+] Admin OK
[+] Token privileges adjusted
[+] Target: <decrypted signature>
[+] Scanning FiveM_b3095_GameProcess.exe (PID 12345)
[+] Scanning FiveM_b3095_GTAProcess.exe  (PID 12346)
Result: EULEN IN ISTANCE
Elapsed: 4.72s

Configuration

To change the target signature or the process filter, edit scanner/main.cpp:

Change the signature

Locate the XOR-encrypted string literal (the array of wchar_t values combined with the 0xAA key) and either:

• Replace the ciphertext with a new set of XOR-encrypted bytes matching your target, keeping the same key, or
• Change the key and regenerate the ciphertext for the new target.

Rebuild after any edit.

Change the target process

The two regex patterns passed to the scan routine live at the top of main():

L"FiveM_b(\\d{4})_GameProcess\\.exe"
L"FiveM_b(\\d{4})_GTAProcess\\.exe"

Add, remove, or replace patterns to point the scanner at a different game or a different set of build IDs. Any valid std::wregex works.

How Detection Works Internally

• SysNtQueryVirtualMemory with MemoryBasicInformation walks the address space of the target PID.
• Regions marked MEM_COMMIT with a readable protection (PAGE_READONLY, PAGE_READWRITE, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE) are pulled into a local buffer allocated via SysNtAllocateVirtualMemory.
• SysNtReadVirtualMemory copies the region contents.
• A plain byte-scan looks for the decrypted signature.
• On a hit, the scanner short-circuits, closes the handle with SysNtClose, and reports.

Because the reads use raw syscall stubs, EDR hooks placed on NtReadVirtualMemory or wrapper ReadProcessMemory will not observe these calls unless they hook at the syscall boundary or below.

Limitations

• Signature match is a literal byte compare against the decrypted target. Anything doing runtime obfuscation of that string inside the injected cheat (encryption, packing, splitting) defeats the detection until the string is materialized in cleartext.
• No pattern support, only exact substring matches. Extend the scan routine if you want AOB masks.
• Single-signature per build. Rebuild for a different target, or extend main.cpp to iterate an array.
• Runs against live processes only. Not a memory-dump analyzer.
• Requires SeDebugPrivilege (obtained implicitly via AdjustTokenPrivilege) and admin.
• HVCI, protected processes, and PPL targets will not open. FiveM game/GTA processes are not protected under normal load, so this is not an issue in the default use case.

Legal

Same terms as upstream: the author is not responsible for any damage caused by malicious use.