redengineapi

Overview

This page is derived entirely from a leaked source code and contains all decompiled Lua data: the 272 native wrappers, 180 functions, 13 menu categories with all 114 widgets, 80 keycodes, 76 weapons, the complete config schema, the dynamic-trigger and AC tables, plus the full source with a viewer. Every L1234 reference jumps to the source line.

The script is from a leaked source menu: a FiveM client-side cheat menu run as a standalone Lua file through an executor. Primary colour FM.Tertiary = {255, 205, 0, 255}, menu 923x583 px, default config "fm_default".

File layout

Threads

How this document was built

• Every table is parsed from the source; numbers come from the extractor, not from an estimate.
• Behaviour descriptions are derived from the code; interpretations are explicitly marked as such.
• The Findings section lists the bugs present in the code, with line numbers.
• The source viewer at the bottom contains all 9,025 lines; search also works inside it.

redENGINE executor API

This is the core of the executor integration. The script uses four globals that FiveM or Lua do not provide: _Executor, _Executor_Strings, HandleConfig and banner_dui. It also needs three globals that the executor or the environment already provides (aE, v_str, layout).

All executor-dependent logic sits behind if _Executor ~= "redENGINE" then return end. On other executors the menu still works, but without config files, without dynamic triggers and without the LoadResourceFile wrapper.

1. _Executor

A string holding the executor id. The script compares literally against "redENGINE" and "None"; any other value counts as "not redENGINE".

2. _Executor_Strings

A table _Executor_Strings[executor_id] -> display name. Read-only, never written. Used in three places: the "custom configs" notice (L326), the boot notification (L9007) and the "dynamic triggers" notice (L9015).

3. HandleConfig(action, filename, data?)

The only persistent storage the script uses: a simple file API with three actions. The script checks the return value itself against six known error/success strings (known_returns, L212-219) instead of receiving a status code.

HandleConfig(action, filename, data?)

  action    "save" | "load" | "delete"
  filename  relative path, the script appends ".json" itself
  data      only on "save": the full file contents as a string
  return    on load: the contents as a string, or one of the six known strings

Every call site in the file:

4. banner_dui

function FM:LoadDui()
    local runtime_txd = CreateRuntimeTxd("fm")
    --local banner_dui = CreateDui("https://asriel.dev/fm/watermark.gif", 300, 300)
    local b_dui = GetDuiHandle(banner_dui)
    CreateRuntimeTextureFromDuiHandle(runtime_txd, "menu_bg", b_dui)
end

The script uses the global banner_dui (L8957) rather than creating it: its own CreateDui call is commented out on L8956. The handle is turned into the runtime texture "menu_bg" inside the transaction "fm", which FM.Config.Player.UseBackgroundImage uses as the menu background. FM:LoadDui() runs as the final step of the boot thread (L9020), so a missing handle breaks the rest of that thread.

5. LoadResourceFile wrapper

LoadResourceFile = {
    hash = 0xEB01A,
    args = "args[1], args[2]",
    func = function(args)
        if _Executor ~= "redENGINE" then return end
        return dict.Citizen.IN(0xEB01A, LoadResourceFile(args[1], args[2]))
    end
}

This is not a FiveM native but a wrapper added by the script. The body calls the global LoadResourceFile and pushes the result through the Citizen trampoline 0xEB01A: Citizen.IN(hash, LoadResourceFile(a, b)). Without _Executor == "redENGINE" the wrapper returns nil, which makes _replaced (L8715) stop on if not contents ... then return end. That is why dynamic triggers are executor-bound.

6. What the executor must provide at minimum

7. Executor gate per feature

rE.Bypasses

A local table (L3-70) that combines two mechanisms: intercepting every server event and hiding certain natives. This is NOT part of the redENGINE API; it is the script's own anti-anticheat logic. rE exists only inside this thread and disappears afterwards.

CheckEvent(event)

function rE.Bypasses:CheckEvent(event)
    for k, v in pairs(rE.Bypasses.Events) do
        if event:lower():find(v:lower(), 1, true) then
            return true
        end
    end
    return false
end

Substring match (plain find) of the 27 blocked event names:

CheckArgs(args)

function rE.Bypasses:CheckArgs(args)
    for k, v in pairs(args) do
        if type(v) == "string" then
            for z, x in pairs(rE.Bypasses.Args) do
                if x[1]:lower():find(v:lower(), 1, true) then
                    return true
                end
            end
        end
    end
    return false
end

scans every string argument of the unpacked msgpack payload against 32 known AC messages:

Mechanism 1: TriggerServerEventInternal

function TriggerServerEventInternal(event, payload, length)
    if rE.Bypasses:CheckEvent(event) then return end
    local unpacked_payload = msgpack.unpack(payload)
    if rE.Bypasses:CheckArgs(unpacked_payload) then return end
    return Citizen.InvokeNative(0x7FDD1128, event, payload, length)
end

• Every server event is intercepted; non-blocking events go through the original native 0x7FDD1128 with the unchanged payload.
• msgpack.unpack runs for every event, even if the event name already passed - that is the expensive side of this hook.
• A payload containing an AC string is dropped entirely; the event never reaches the server.

Mechanism 2: the _G thread

CreateThread(function()
    for k, v in ipairs(rE.Bypasses.global) do
        if k == "TriggerClientEventInt" or k == "HandleConfig" then
            table.remove(rE.Bypasses.global, v)
        end
    end
    while true do
        _G = rE.Bypasses.global
        Wait(0)
    end
end)

Global native stubs (L117)

function IsExplosionInSphere(...)return false end
function NetworkIsInSpectatorMode()return false end
function ShutdownAndLoadMostRecentSave()return true end
function ActivateRockstarEditor()return end
function ForceSocialClubUpdate()return end
function fuckmedaddy()return end

Six natives are replaced by stubs at global scope. Four of them have a non-trivial return (false for explosion/spectator detection, true for save loading) so AC logic sees "nothing wrong". fuckmedaddy is never used.

Configuration

The config schema is a literal Lua table in FM.Config (L152-198, nested inside local FM on L145) and is copied into FM.DefaultConfig (L321) at startup. current_config is the active config name and starts as "fm_default" (L221); the UI changes it on L5385 (load) and resets it on L5443 (delete).

Full schema (51 fields)

ConfigClass

Seven methods on FM.ConfigClass (L324-444). Every mutating method starts with the redENGINE guard; Load shows a notification instead.

Files used

Identifier and statistics

FM.Identifier = FM.Base64:Encode("Name=" .. <player name> .. ":Seed=" .. math.random(5, 5^3) .. ":Build=" .. FM.Version)

FM:DoStatistics()  -- L8974, never called
    url = "https://fm.asriel.dev/statistics.gif?identifier=" .. FM:URIEncode(FM.Identifier)
         .. "&information=" .. FM:URIEncode(json.encode({name, build, server}))
    CreateDui(url, 50, 50) -> Wait(10000) -> DestroyDui

The identifier is only built when the executor is redENGINE (L262). FM:DoStatistics is defined but never called, so in practice only the identifier is stored.

Wrapped natives

The table _natives (L524-1982) holds 272 wrappers in three flavours: native (hash + explicit arglist), native+unpack (hash + an unpack = function() ... that returns the Citizen return values), and lua (its own Lua implementation).

FM:GetFunction(name) - L1996

local _bad, _empty = {}, function() end

local bad = function(...)
    if not _bad[dict.tostring(...)] then
        FM:Print("[NATIVE] Invalid GetFunction call: ^1" .. dict.tostring(...) .. "^7")
        _bad[dict.tostring(...)] = true
    end
    return _empty
end

function FM:GetFunction(name)
    if not _natives[name] then return bad(name) end
    if _natives[name].func then
        return _natives[name].func
    elseif _natives[name].hash then
        _natives[name].func = function(...)
            local args = {...}   local data = _natives[name]   local hash = data.hash
            if data.unpack then
                if data.return_as then return data.return_as(dict.Citizen.IN(hash, data.unpack(args))) end
                return dict.Citizen.IN(hash, data.unpack(args))
            else
                if data.return_as then return data.return_as(dict.Citizen.IN(hash, table.unpack(args))) end
                return dict.Citizen.IN(hash, table.unpack(args))
            end
        end
        return _natives[name].func
    end
end

• Missing name: instead of nil the stub _empty is returned and [NATIVE] Invalid GetFunction call: <name> is logged once per name. So the call does nothing, instead of falling back to the global native.
• Lazy wrapper: the hash wrapper is set into _natives[name].func on the first GetFunction and reused afterwards; hash and return_as are read from the table on every call.
• three return paths: unpack(args) (Citizen marshalling), table.unpack(args) (plain pass-through) and an optional return_as( Citizen.IN(...) ) cast.
• dict.Citizen.IN is an alias for Citizen.InvokeNative (L141).
• Citizen accessors per datatype: ResultAsInteger, ResultAsFloat, ResultAsString, ResultAsObject, ResultAsVector and PointerValueInt / PointerValueFloat / PointerValueVector / PointerValueIntInitialized.
• Hash-to-string conversions happen in the wrapper itself (GetHashKey if the first parameter is a string), e.g. RequestModel.
• The boundary mechanism (getBoundaryFunc L452, boundaryIdx L446, result in runWithBoundaryEnd L472) is only used by TriggerEvent (L525) to wrap msgpack.pack in a Citizen boundary.

Full table (272 wrappers)

Natives missing from the table

Five names are requested through FM:GetFunction but do not exist in _natives. FM:GetFunction returns the _empty stub for them (L1985/L1993), so these features do nothing and log [NATIVE] Invalid GetFunction call once:

Unused wrappers

22 of the 272 wrappers are never used in the file (often leftover after a rename or a feature that got disabled).

UI: Painter and widgets

All drawing goes through FM.Painter: a set of functions that work with native dimensions (0.0-1.0 for positions, raw pixel widths) and give each widget its own return value so the menu logic can use if self.Painter:Button(...) then. There are 11 Painter functions.

Widget types in the categories

Categories and widgets

The 13 categories provide 114 widgets. Each FM:Category(x, y, w, h, scale) function calls self.Painter:CommonTab and then, per widget, the corresponding Painter function; the return pattern everywhere is if <widget> then ... end so a click directly activates the feature.

Feature internals

This section gathers what the code reveals about the mechanisms behind the widgets, so it is clear what a toggle actually does.

GetFunction missing entries

The five missing wrappers have practical consequences: these calls now go through _empty and do nothing.

Natives used directly (not via GetFunction)

Alongside the 272 wrapped natives, the script calls 29 natives directly as globals. Those have no return shim and no logging.

Config-bound fields

Half of the widgets are a thin write layer over FM.Config; the rest does direct native work. The table below links the main internals to their config field, so it is clear which values drive behaviour.

Bone list (13 items)

The same list is redefined as local aimbot_bones on L3980 (2 items) and is the order in which the menu index maps to a bone index.

Notifications and sounds