# Welcome to Storm Scanner

This documentation serves to help answer any questions you may have with Storm and its features.

{% hint style="warning" %}
Please read through our documentation before making a support ticket!
{% endhint %}

## Overview

> Storm Scanner is an exceptional tool for reviewing devices in the FiveM community. With its in-depth analysis and swift support, you can easily identify any users with cheats or unwanted software on their devices. Whether you're a server admin or a player, Storm Scanner ensures a fair and secure gaming environment. Upgrade your community's integrity today!

## Get Started

We've put together some helpful guides for you to get setup with our product quickly and easily.

{% content-ref url="/pages/18CoJ0uSMapCe87tZhJP" %}
[Getting set up](/fundamentals/getting-set-up)
{% endcontent-ref %}

{% content-ref url="/pages/KlHGcpyqi8uGZFATVZpK" %}
[Custom Webhook](/fundamentals/getting-set-up/custom-webhook)
{% endcontent-ref %}

{% content-ref url="/pages/jL8zQSkYeYWJ7jP26CCG" %}
[Scan Toggles](/fundamentals/getting-set-up/scan-toggles)
{% endcontent-ref %}


# Getting set up


# Generating PINS and Downloading the Scanner

A quick explanation on the different ways to generate and view results with PINs.

Our scanner download is located at <https://stormss.cc/download> .


# Generating and Viewing on the Dashboard

* Go to <https://stormss.cc/login> .
* Navigate to the "Pins" section after logging in.
* From there, select the "Generate" tab.
* Select the game you want to generate.
* Download the scanner at <https://stormss.cc/download> and input the PIN.
* Once the scan is complete, click the "View Results" button.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FOoMFGrdD7iYSW6bszGdX%2Fimage.png?alt=media&amp;token=28f15ad8-6559-41f4-8d0e-5dfe8cc80377" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2F5lWFQCnKw3lXuT6XMVx0%2Fimage.png?alt=media&amp;token=25ee4c1c-a22a-4802-a660-efe26cd55f96" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FxvXbKxvQhRT0TTRCa0yr%2Fimage.png?alt=media&amp;token=448e0323-071d-4ba0-b422-47a610dde245" alt=""><figcaption></figcaption></figure>


# Generating and Viewing on Discord

{% hint style="danger" %}
Running commands outside the bot channel could result in a timeout.
{% endhint %}

* Navigate to the official Storm Discord server.
* Go to the #bots channel.
* From there, run the `/gen` command and the version you want. Your PIN will be outputted.&#x20;
* Download the scanner at <https://stormss.cc/download> and input the PIN.
* Once the scan is complete, run the `/results` command with the PIN and the results link will output in an embed. You will need to log in to view them.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2F9R80LSYlHzlRXPkhd8dx%2Fimage.png?alt=media&amp;token=1b80146d-d9ff-4a09-bd94-9e58ed5707a3" alt=""><figcaption><p>An example of what a successful PIN generation looks like.</p></figcaption></figure>

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FjJ6kKQ1JRQJsbg8HGdDE%2Fimage.png?alt=media&amp;token=f4d04948-17eb-45d3-bb74-ad34dde2e180" alt=""><figcaption><p>What the results look like afterwards.</p></figcaption></figure>


# Toggling Public and Private Scans

A quick explanation on public and private scan toggles

{% hint style="warning" %}
Making your scans public allows any user with your PIN or scan link to view your results. Be careful when sharing result links for this reason.
{% endhint %}

* To locate the scan toggle, look for the "Privacy" category in the Pin List where your past PINs are.
* When the toggle button is purple, your scan is currently private and only visible to you.
* When the toggle button is grey, your scan is currently public and visible to all users with the PIN or scan link.
* Scans can be toggled at any time.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FoRDj57jC97TkzYLbkjU3%2Fimage.png?alt=media&amp;token=25ddd590-590a-4602-97bd-6888ee0ec456" alt=""><figcaption><p>A private scan</p></figcaption></figure>

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2F5LD7M9j7F427YyksDv58%2Fimage.png?alt=media&amp;token=73aa99cc-b128-4401-a775-0ceb067cd878" alt=""><figcaption><p>A public scan</p></figcaption></figure>


# Custom Webhook

A quick explanation on how to upload results to your own webhook.

{% hint style="info" %}
**This is an optional feature used for forwarding your scan results to a discord webhook.**
{% endhint %}

## Steps

* Go to <https://stormss.cc/login> .
* Navigate to the "Pins" tab after logging in.
* Click "Settings" .
* Paste your discord webhook in the "WEBHOOK HERE" field and press "set" .

{% hint style="info" %}
Webhook not working? Our discord bot is required to be in your server. It can be invited [here.](https://stormss.cc/invite)
{% endhint %}

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FYjMnRDZ7UXC0VcIs7uZv%2Fimage.png?alt=media&amp;token=5a25d4a5-9102-4afb-be4f-5415c5fc3d28" alt=""><figcaption></figcaption></figure>


# Scan Toggles

A quick explanation to how Storm Scanner PIN toggles work.

{% hint style="warning" %}
**Enabling and disabling toggles can result in different performance impacts.**
{% endhint %}

<details>

<summary>File Scanner</summary>

This toggle allows you to optionally scan a user's file system or not. Recommended to keep **Enabled.**

</details>

<details>

<summary>Journal Scanner</summary>

This toggle allows you to optionally scan a user's [USN Journal ](https://en.wikipedia.org/wiki/USN_Journal)or not. Recommended to leep **Enabled.**

</details>

<details>

<summary>Discord Checker</summary>

This toggle allows you to optionally scan a user's discord server history or not. This toggle has no affect on performance.

</details>

<details>

<summary>Browser Checker</summary>

This toggle checks for suspicious links a user has visited recently. Recommended to keep **Enabled.**

</details>

<details>

<summary>IP Analysis</summary>

This toggle performs essential checks for VPN, country, and proxy detection based on the user's IP address. This module does not store the user's IP address, only their country and VPN/proxy statuses are recorded. This toggle has no affect on performance.

</details>


# Custom Strings

A quick explanation on how to use custom strings in Storm.

{% hint style="info" %}
**This is an optional feature that allows you to add your own custom detections to Storm.**
{% endhint %}

## Navigation Steps

* Go to <https://stormss.cc/login> .
* Navigate to the "Strings" section after logging in.


# Adding and Removing Processes

{% hint style="danger" %}
This step is required to add custom strings.
{% endhint %}

* Under "Custom Processes" , click "Process Names" and type your process (e.g. explorer.exe). You can add as many as you want. Click the "Add" button after completing.
* The process should pop up. Click the trash can to delete your process.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FXEHoY3RcKYCFH34Snw8H%2Fimage.png?alt=media&amp;token=6f1120af-c597-47d6-ae48-3ed56d2cacfb" alt=""><figcaption><p>Clicking the "add" button adds a process. Clicking the trash can deletes it.</p></figcaption></figure>

{% hint style="warning" %}
Adding processes improperly will show "Process not found" in the scan results.
{% endhint %}


# Adding Custom Strings

{% hint style="warning" %}
Adding large quantities of strings to Storm can cause the scanner to be slower than usual.
{% endhint %}

* Under "Custom Strings" , click the "Process" drop down and select the process your string is for.
* In "Client Name" and "String" , enter what you want the detection name to be and the string for it.&#x20;
* In the "Severity" drop down, choose if you want the detection to display as a cheat, a warning, or as a log. Click the "Set" button after completing.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FJJEEExxZYE2hvDCWyCMU%2Fimage%20(4).png?alt=media&amp;token=6a7731d3-f61a-456a-b604-0506d2ae83d3" alt=""><figcaption><p>An example of a custom detection.</p></figcaption></figure>


# Extracting your Own Strings

{% hint style="info" %}
This allows you to extract strings from files so you can implement them into your custom strings.
{% endhint %}

* Under "String Extractor" , click "Choose File" and select your file. Click "Set" after uploading. The results will pop up after a few seconds.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FjW6BHpIxf2wGWKQMqQFM%2Fimage.png?alt=media&amp;token=7da19191-7829-4390-9eb1-fec31fe62fb6" alt=""><figcaption><p>An example output for the string extractor.</p></figcaption></figure>


# Searching and Removing Custom Strings

{% hint style="danger" %}
Deleting your strings is an irreversible action! We recommend you save your strings elsewhere in the case that you decide to remove them or an issue arises.
{% endhint %}

* Under "Strings List" , type in "Search Strings" your keywords. Anything that matches those search terms will display in the results. If there are no results to be found, the results will be empty.
* To delete the string, click the trash can.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FwvLWsZ8TglGXARIDMOua%2Fimage.png?alt=media&amp;token=4e8f8b8b-24da-4c9a-b254-bf566c9d82dc" alt=""><figcaption><p>An example search term.</p></figcaption></figure>


# Custom Yara

A quick explanation on how to use custom YARA rules in Storm.

{% hint style="danger" %}
This is a feature for advanced users only. Please do not use this if you don't understand what you're doing!
{% endhint %}

## Navigation Steps

* Go to <https://stormss.cc/login> .
* Navigate to the "Strings" section after logging in.
* From there select the "Editor" tab.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2F3DNUwQ29BT2X8XdKgOM3%2Fimage.png?alt=media&amp;token=813a4760-a908-49f7-bfec-3223d49436ad" alt=""><figcaption></figcaption></figure>


# Information on Rules

Some basic information on YARA rule type.

{% hint style="info" %}
Storm's custom YARA scanner reads the detection info from the ***meta*** section of the YARA rule. Below is the only information required to successfully create a rule.
{% endhint %}

* Under your ***meta*** section, you must include a ***rule\_name*** and ***type.*** Everything else you add is optional and does not affect the scanning of the rule.

```git
meta:
	    rule_name = "Example Cheat" // Name of cheat
	    type = "Detect" // Warning or Detect
	    author = "Saxony" // Optional data that can be added
```


# Basic Rule Examples

Examples of YARA rules being created/used. Not all examples are provided. Only the basics are and further research may be required on your own.

{% hint style="danger" %}
Do not add YARA imports to your rules. They are by default implemented into Storm.
{% endhint %}

<details>

<summary>Basic String Based Rule</summary>

Checks if the specific string(s) below are found in the file's PE data.

<pre class="language-clike"><code class="lang-clike"><strong>rule example_detection_name { // Name of the detection
</strong>	meta:
	    rule_name = "Example Cheat" // name of the cheat
	    type = "Detect" // Warning or Detect
	strings: // Checks the pe data of a file
	    $string1 = "foobar" // String value
	condition:
	    $string1 // If text string is found, then flag
}
</code></pre>

In this example, ***foobar*** is the string being searched.

</details>

<details>

<summary>Basic Hex Based Rule</summary>

Checks if the specific hex value(s) below are found in the file's PE data.

```clike
rule example_detection_name { // Name of the detection
	meta:
	    rule_name = "Example Cheat" // name of the cheat
	    type = "Warning" // Warning or Detect
	strings: // Checks the pe data of a file
	    $hex_string = { 48 89 E5 55 48 83 EC 10 } // Hex value
	condition:
	    $hex_string // If hex string is found, then flag
}
```

In this example, the hex value ***48 89 E5 55 48 83 EC 10*** is the hex value being searched.

</details>

<details>

<summary>Basic String and Hex Based Rule</summary>

```clike
rule example_detection_name { // Name of the detection
	meta:
	    rule_name = "Example Cheat" // name of the cheat
	    type = "Detect" // Warning or Detect
	strings: // Checks the pe data of a file
	    $string1 = "foobar" // String value
	    $string2 = { 48 89 E5 55 48 83 EC 10 } // Hex value
	condition:
	    $string1 and $string2 // If both string and hex are found, flag
}
```

</details>

{% hint style="info" %}
Storm also supports other module rules such as recursive, boolean, tags, classification, ranges, binary data matching, and much more. Your imagination is your limit.
{% endhint %}


# Public Reference


# User Scan History

## Checking A Users Scan History

<mark style="color:green;">`POST`</mark> `https://stormss.cc/api/history/`

Gets The Previous Pins A User Has Been Scanned With

**Headers**

| Name         | Value              |
| ------------ | ------------------ |
| Content-Type | `application/json` |

**Query**

| Name         | Type   | Description     |
| ------------ | ------ | --------------- |
| `DISCORD_ID` | string | Discord User ID |

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
  "pins": [
    {
      "link": "https://stormss.cc/results/9989418",
      "pin": 9989418
    },
    {
      "link": "https://stormss.cc/results/3824628",
      "pin": 3824628
    },
    {
      "link": "https://stormss.cc/results/6225752",
      "pin": 6225752
    },
    {
      "link": "https://stormss.cc/results/5353718",
      "pin": 5353718
    },
    {
      "link": "https://stormss.cc/results/928973",
      "pin": 928973
    }
  ]
}
```

{% endtab %}

{% tab title="400" %}

```json
{
  "error": "Invalid request"
}
```

{% endtab %}
{% endtabs %}


# Results

## Checking A Users Scan History

<mark style="color:green;">`POST`</mark> `https://stormss.cc/api/results/`

Gets The Previous Pins A User Has Been Scanned With

**Headers**

| Name         | Value              |
| ------------ | ------------------ |
| Content-Type | `application/json` |

**Query**

| Name | Type   | Description |
| ---- | ------ | ----------- |
| PIN  | string | Scan PIN    |

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
  "PIN": "432432",
  "game": "FiveM",
  "results": {
    "accounts": [
      {
        "id": "76561199058407058",
        "name": "qimouzaixianbaonitou"
      },
      {
        "id": "76561199431229939",
        "name": "7r7q8ex11vin"
      }
    ],
    "detects": [
      "Unsigned File: main.exe",
      "Unsigned File: filesscannermain.exe",
      "Journal Deleted: 02:00:06, 23.05.2024",
      "Journal Deleted: 02:00:04, 23.05.2024",
      "Task Scheduler: 07:39:03, 24.05.2024",
      "Journal Deleted: 19:03:15, 01.05.2024",
      "Journal Deleted: 18:14:07, 01.05.2024",
      "Journal Deleted: 22:33:49, 29.04.2024",
      "Eulen",
      "Testo - cheat.exe",
      "Eulen - loader_prod.exe",
      "Generic Bypass (Transacted Hollowing) - main.cpp",
      "Macho Cheats - readme.txt",
      "Keyauth - $RS4F2JC.py",
      "Journal Deletion - $RS4F2JC.py",
    ],
    "logs": [
      "Generic A [Regedit] - OpenSavePidlMRU",
      "Memory Integrity Disabled",
      "Files With UniCode Characters",
      "Recycle-Bin Modified: 2d, 9m, 43s ago",
    ],
    "warnings": [
      "Unable To Find FiveM.APP!",
      "Discord: Tiago Executor",
      "Discord: Elude Bypass",
    ]
  }
}
```

{% endtab %}

{% tab title="400" %}

```json
{
  "error": "Invalid request"
}
```

{% endtab %}
{% endtabs %}


# Enterprise Reference


# Generate A Scan Pin

## Checking A Users Scan History

<mark style="color:green;">`POST`</mark> [`https://stormss.cc/api/enterprise/gen_pin/`](https://stormss.cc/api/enterprise/gen_pin/)

Generates A Scan Pin For Storm Enterprise

**Headers**

| Name         | Value              |
| ------------ | ------------------ |
| Content-Type | `application/json` |

**JSON**

| Name      | Type     | Description      |
| --------- | -------- | ---------------- |
| `api_key` | *string* | **API Key**      |
| `Version` | s*tring* | **Game Versio**n |

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
  "pin": "A1D3M1"
}
```

{% endtab %}

{% tab title="400" %}

```json
{
  "error": "Invalid request"
}
```

{% endtab %}
{% endtabs %}


# Remove Enterprise User

## Checking A Users Scan History

<mark style="color:green;">`POST`</mark> `https://stormss.cc/api/enterprise/remove_user/`

Remove A Enterprise User From Your Community

**Headers**

| Name         | Value              |
| ------------ | ------------------ |
| Content-Type | `application/json` |

**JSON**

| Name        | Type     | Description                       |
| ----------- | -------- | --------------------------------- |
| `member_id` | *string* | **Enterprise Members Discord ID** |
| `api_key`   | *string* | **API Key**                       |

**Response**

{% tabs %}
{% tab title="200" %}

```json
{
  "Success": true
}
```

{% endtab %}

{% tab title="400" %}

```json
{
  "error": "Invalid request"
}
```

{% endtab %}
{% endtabs %}


# False Detections

How to report false detections

1. Locate the false detection (if applicable).
2. Use Windows Key + R to open up windows run screen.
3. Paste in the location and see if it is related to cheating.
4. If not related to cheating create a ticket and paste a screenshot of the results and PIN.


# Error: Possible Bypass Attempt

This error occurs when something is blocking storm from contacting our main API. This sometimes is a bypass attempt but not always.

1. Go and download [Cloudflare Warp](https://one.one.one.one/) .
2. Set up and enable it.
3. Re-run Storm.
4. If the above steps did not work, try debug mode. Send the errors from debug mode in the ticket.


# Storm Not Scanning

The most common issue with Storm not scanning is an internal error.

1. Download The Debug Version \[ [Fivem](https://stormss.cc/api/Module-Fivem.exe) | [RageMP](https://stormss.cc/api/Module-RageMP.exe) ]
2. Open CMD as administrator and go to the path where is the File ^ Located (ex. | cd desktop)
3. Type in CMD: Module-FiveM.exe | Replace with your generated PIN
4. Hit enter and wait for results.

If the steps above did not work, re-try with the [1.1.1.1](https://one.one.one.one/) Cloudflare Proxy.


# Debug Mode

Everything you need to know about debug mode

{% content-ref url="/pages/5xeYcXlQwujR3IIMQwre" %}
[How To Use Debug Mode](/troubleshooting/debug-mode/how-to-use-debug-mode)
{% endcontent-ref %}

{% content-ref url="/pages/xEyZdaKAnoG6HP6JlPPU" %}
[Common Questions](/troubleshooting/debug-mode/common-questions)
{% endcontent-ref %}


# How To Use Debug Mode

### 🗂️ Understanding Files on Windows

Windows is a file-based operating system. `Module-FiveM.exe` is a file you download from the internet (specifically from **Storm's Website**), and it is typically saved in your **Downloads** folder.

#### 📁 File Path Example

If your username is `username`, the path would look like this:

```
C:\Users\username\Downloads\Module-FiveM.exe
```

* `C:` is the drive letter (usually the main drive).
* Then comes the `Users` folder.
* Followed by your user folder (e.g., `username`).
* Then the `Downloads` folder, where the file resides.
* Finally, the file itself: `Module-FiveM.exe`.

### 🖥️ CLI vs. GUI

Applications come in two types:

* **CLI (Command Line Interface)**: Uses the terminal (like Command Prompt).
* **GUI (Graphical User Interface)**: Uses visual windows and buttons.

> `Module-FiveM.exe` is a **CLI application**, meaning it must be run from **Command Prompt**.

***

### ▶️ How to Run a CLI Application

#### Step 1: Open Command Prompt as Administrator

1. Press `Windows Key`, search for **Command Prompt**.
2. Right-click and select **Run as administrator**.

#### Step 2: Navigate to the Folder

Use the `cd` command (which stands for *change directory*) to go to the folder where the file is located.

Examples:

* Desktop:&#x20;

  ```
  cd C:\Users\username\OneDrive\Desktop
  ```
* System32:&#x20;

  ```
  cd C:\Windows\System32
  ```
* Downloads:&#x20;

  ```
  cd C:\Users\username\Downloads
  ```

#### Step 3: Run the File with an Argument

Once you're in the correct folder, type:

```
Module-FiveM.exe <PIN>
```


# Common Questions

<details>

<summary>Im not sure where the file is. </summary>

1. Click the file once.
2. Right-click → **Properties**.
3. Look under **Location** — that’s the folder!

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FCaSTDPN8aDUp4wuNiURC%2Fidsadsadsamage.png?alt=media&amp;token=0f9ff305-9ec6-4127-8d0f-1fd37bca4760" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary>How do i find the file after downloading it?</summary>

**In your browser:**

1. Go to the **Downloads** section.
2. Click the **folder icon** next to the downloaded file. This opens the folder directly.

<figure><img src="https://1318288901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxRI2XTZksToXdmRrFCW%2Fuploads%2FhtgRUAH9VEcQmg3tyxul%2Fdsadsae.png?alt=media&amp;token=3054d2d1-4126-4d91-899f-213d613412d0" alt=""><figcaption></figcaption></figure>

</details>