Watch Raven Anticheat detect and ban a cheater using a Lua executor on a live FiveM server in real-time.
What follows describes the subject of this recording and how the detection behind it works. It is a summary, not a timestamped transcript.
A live server with players on it, not an empty test box. A cheater loads a Lua executor, the detection fires, and the ban lands.
Executors are usually the first thing a server meets, because they are the cheapest way in. They run attacker code inside the game client’s own Lua state, which means anything a legitimate resource can call, the executor can call as well: spawn a vehicle, move a player, fire an event the server trusts.
That is why this cannot be a server-side-only check. A server watching for effects sees the executor after it has already done something. The client-side layer is what sees it arrive.