How to find backdoored addons on a Garry's Mod server

A stranger gives themselves superadmin on your Garry's Mod server, and the cause is almost always an addon with backdoor code that the game never checks. RCON Hub fixes it: its GMod Manager pack checks every Workshop item and folder addon for backdoor code outside the game, and shows you the file and line of each finding.

Why backdoors end up on Garry's Mod servers

Garry's Mod runs whatever Lua your addons ship. The game never looks at what that code does.

Leaked and re-uploaded addons are the usual source. Someone takes a paid addon, adds a few lines, and uploads it again. Those lines make the uploader superadmin, or run code they send later from the internet.

The manual check looks like this:

• Unpack every .gma and open every Lua file.
• Search for RunString, CompileString and http.Fetch.
• Look for hardcoded SteamIDs next to group changes.
• Do it all again whenever an addon updates.

A big server has hundreds of Lua files. Nobody keeps that up.

What the game and other tools leave out

• The game never checks addon code. Garry's Mod loads it as is, and a plain RCON tool can't see inside an addon. GMod Manager scans every downloaded Workshop item and folder addon, inside .gma files too.
• Searching by hand misses things. A text search finds RunString everywhere and can't tell why. GMod Manager looks for the tricks backdoors use, like network code run as code or a SteamID made admin, and rates each finding high, medium or low.
• In-game scanners cost server time. A scanner addon runs inside the server you're trying to protect. GMod Manager's check runs outside the game, on your PC, with no server time.
• Updates can turn an addon bad. A clean addon can pick up backdoor code in a later update. GMod Manager checks again after every start, but only items that changed since their last check.
• False alarms on paid addons. Some addons fetch and run code on purpose, as copy protection. GMod Manager only warns: nothing is blocked or deleted, and you decide. The official ULX, ULib and DarkRP items show their findings as expected.

How RCON Hub fixes it

GMod Manager runs the check from its Workshop page. Each item gets a badge, from no backdoor signs to looks like a backdoor. Click the badge to see every finding with its level, file and line, plus the code it found. Anything rated high or medium also goes to the news and your admin Discord, so you hear about it before players join.

Step-by-step setup

1. Install RCON Hub. Download it from rconhub.gg and run the installer. It's free for Windows 10 and 11.
2. Add the Garry's Mod game pack. Open RCON Hub. On Your games, click Add game, pick Garry's Mod and click Install.
3. Set up your server. Open the Garry's Mod card. Click Install it for me to download the dedicated server with SteamCMD (about 6.5 GB). Already have one? Paste the folder that holds srcds.exe and click Use it.
4. List your addons. Open the Workshop page. In Add a mod, paste a Workshop item or collection link and add it to the server.
5. Start the server once. On the Server page, click Start server. The server downloads its Workshop items, and GMod Manager checks them after the start.
6. Run a check any time. Back on the Workshop page, click Check for backdoors under Items.
7. Read the findings. Click an item's badge. Each finding shows high, medium or low, what it is, and the file and line. Open that file and decide for yourself.
8. Remove what you don't trust. Click Remove next to the item. The server stops loading it from the next start.
9. Keep it from changing. Under Updates, tick Keep these versions (no updates at start), so an addon can't pick up new code overnight.

Folder addons in addons/ are checked too. Anything rated high or medium shows up in the news.

The check runs on servers on this PC, where GMod Manager can read the downloaded files.

Is it safe?

Yes.

• It runs locally. RCON Hub and GMod Manager run on your own Windows PC. GMod Manager never opens the RCON port in your firewall or on your router.
• No injection. RCON Hub never touches the game client or your players' games. There's nothing for VAC to flag, so it won't get anyone banned.
• Nothing gets deleted. The backdoor check only reads files and warns. You decide what stays.
• Your secrets stay put. The Game Server Login Token is stored encrypted, and the RCON password never goes on the command line.

It's beta software. Back up your server's settings and data before you change things.

Find the backdoor before it finds you

Your addons should do what they say and nothing more. Download RCON Hub, add the Garry's Mod pack, and check every addon before players join.

Download RCON Hub 0.3.13 More guides