local Players = game:GetService("Players")
local ReplicatedStorage = game:GetService("ReplicatedStorage")
local HttpService = game:GetService("HttpService")
local UserInputService = game:GetService("UserInputService")

-- Create ScreenGui
local screenGui = Instance.new("ScreenGui")
screenGui.Parent = Players.LocalPlayer:WaitForChild("PlayerGui")
screenGui.Name = "BackdoorScannerGui"

-- Create Draggable Frame
local frame = Instance.new("Frame")
frame.Size = UDim2.new(0, 400, 0, 300)
frame.Position = UDim2.new(0.5, -200, 0.5, -150)
frame.BackgroundColor3 = Color3.fromRGB(26, 26, 26)
frame.BorderSizePixel = 0
frame.Parent = screenGui

-- Make Frame Draggable
local dragging, dragInput, dragStart, startPos
frame.InputBegan:Connect(function(input)
    if input.UserInputType == Enum.UserInputType.MouseButton1 then
        dragging = true
        dragStart = input.Position
        startPos = frame.Position
        input.Changed:Connect(function()
            if input.UserInputState == Enum.UserInputState.End then
                dragging = false
            end
        end)
    end
end)
frame.InputChanged:Connect(function(input)
    if input.UserInputType == Enum.UserInputType.MouseMovement and dragging then
        local delta = input.Position - dragStart
        frame.Position = UDim2.new(startPos.X.Scale, startPos.X.Offset + delta.X, startPos.Y.Scale, startPos.Y.Offset + delta.Y)
    end
end)

-- Create ScrollingFrame for Output
local scrollFrame = Instance.new("ScrollingFrame")
scrollFrame.Size = UDim2.new(0.9, 0, 0, 180)
scrollFrame.Position = UDim2.new(0.05, 0, 0, 110)
scrollFrame.BackgroundTransparency = 1
scrollFrame.CanvasSize = UDim2.new(0, 0, 0, 0)
scrollFrame.ScrollBarThickness = 8
scrollFrame.Parent = frame

-- Title Label
local title = Instance.new("TextLabel")
title.Size = UDim2.new(1, 0, 0, 50)
title.Position = UDim2.new(0, 0, 0, 10)
title.BackgroundTransparency = 1
title.Text = "SUBWAY SCANNER: BACKDOOR & EXPLOIT HUNT"
title.TextColor3 = Color3.fromRGB(0, 255, 0)
title.Font = Enum.Font.Code
title.TextSize = 20
title.Parent = frame

-- Scan Button
local scanButton = Instance.new("TextButton")
scanButton.Size = UDim2.new(0.45, 0, 0, 40)
scanButton.Position = UDim2.new(0.05, 0, 0, 60)
scanButton.BackgroundColor3 = Color3.fromRGB(255, 68, 68)
scanButton.TextColor3 = Color3.fromRGB(255, 255, 255)
scanButton.Font = Enum.Font.Code
scanButton.TextSize = 16
scanButton.Text = "SCAN"
scanButton.Parent = frame

-- Clear Button
local clearButton = Instance.new("TextButton")
clearButton.Size = UDim2.new(0.45, 0, 0, 40)
clearButton.Position = UDim2.new(0.5, 0, 0, 60)
clearButton.BackgroundColor3 = Color3.fromRGB(255, 68, 68)
clearButton.TextColor3 = Color3.fromRGB(255, 255, 255)
clearButton.Font = Enum.Font.Code
clearButton.TextSize = 16
clearButton.Text = "CLEAR"
clearButton.Parent = frame

-- Admin Button (Hidden Initially)
local adminButton = Instance.new("TextButton")
adminButton.Size = UDim2.new(0.9, 0, 0, 40)
adminButton.Position = UDim2.new(0.05, 0, 0, 60 + 45) -- Below Scan/Clear
adminButton.BackgroundColor3 = Color3.fromRGB(0, 255, 0)
adminButton.TextColor3 = Color3.fromRGB(255, 255, 255)
adminButton.Font = Enum.Font.Code
adminButton.TextSize = 16
adminButton.Text = "GRANT ADMIN"
adminButton.Visible = false
adminButton.Parent = frame

-- Output Message List
local messages = {}
local messageHeight = 30
local detectedBackdoors = {} -- Store detected backdoor objects
local function addMessage(text, color, isKey)
    local label = Instance.new("TextLabel")
    label.Size = UDim2.new(1, -10, 0, messageHeight)
    label.Position = UDim2.new(0, 5, 0, #messages * messageHeight)
    label.BackgroundTransparency = 1
    label.Text = text
    label.TextColor3 = color or Color3.fromRGB(0, 255, 0)
    label.Font = Enum.Font.Code
    label.TextSize = 14
    label.TextWrapped = true
    label.TextXAlignment = Enum.TextXAlignment.Left
    label.Parent = scrollFrame

    -- Make key clickable to copy
    if isKey then
        label.InputBegan:Connect(function(input)
            if input.UserInputType == Enum.UserInputType.MouseButton1 then
                pcall(function()
                    setclipboard(text:match("YOUR KEY: (.+)"))
                    addMessage("KEY COPIED TO CLIPBOARD!", Color3.fromRGB(255, 255, 0))
                end)
            end
        end)
    end

    table.insert(messages, label)
    scrollFrame.CanvasSize = UDim2.new(0, 0, 0, #messages * messageHeight)
end

-- Clear Messages
local function clearMessages()
    for _, msg in ipairs(messages) do
        msg:Destroy()
    end
    messages = {}
    scrollFrame.CanvasSize = UDim2.new(0, 0, 0, 0)
    adminButton.Visible = false -- Hide admin button on clear
    detectedBackdoors = {} -- Clear detected backdoors
    addMessage("MESSAGES CLEARED, PASSENGER!", Color3.fromRGB(255, 255, 0))
end

-- Backdoor Access Function
local function attemptAdminAccess()
    for _, backdoor in ipairs(detectedBackdoors) do
        local obj, key = backdoor.obj, backdoor.key
        if obj:IsA("RemoteEvent") then
            -- Try common admin commands
            local adminCommands = {
                ":admin " .. Players.LocalPlayer.Name,
                "admin " .. Players.LocalPlayer.Name,
                "giveadmin " .. Players.LocalPlayer.Name,
                key .. " admin " .. Players.LocalPlayer.Name
            }
            for _, cmd in ipairs(adminCommands) do
                pcall(function()
                    obj:FireServer(cmd)
                    addMessage("ADMIN ATTEMPT: Fired RemoteEvent '" .. obj.Name .. "' with: " .. cmd, Color3.fromRGB(0, 255, 0))
                end)
            end
        elseif obj:IsA("RemoteFunction") then
            -- Try invoking with admin commands
            local adminCommands = {
                ":admin " .. Players.LocalPlayer.Name,
                "admin " .. Players.LocalPlayer.Name,
                "giveadmin " .. Players.LocalPlayer.Name,
                key .. " admin " .. Players.LocalPlayer.Name
            }
            for _, cmd in ipairs(adminCommands) do
                pcall(function()
                    obj:InvokeServer(cmd)
                    addMessage("ADMIN ATTEMPT: Invoked RemoteFunction '" .. obj.Name .. "' with: " .. cmd, Color3.fromRGB(0, 255, 0))
                end)
            end
        else
            addMessage("ADMIN ATTEMPT: Object '" .. obj.Name .. "' not exploitable for admin", Color3.fromRGB(255, 255, 0))
        end
    end
end

-- Enhanced Backdoor & Exploit Scanning Logic
local function scanForBackdoorsAndExploits()
    addMessage("INITIATING PRECISION SCAN...", Color3.fromRGB(255, 255, 0))
    local found = false
    detectedBackdoors = {}

    -- Services to scan (client-side only)
    local services = {
        ReplicatedStorage,
        game:GetService("Workspace")
    }

    -- Suspicious patterns for backdoors and exploits
    local suspiciousNames = {
        "backdoor", "bd", "exec", "execute", "cmd", "admin", "hack", "exploit", "inject"
    }
    local suspiciousPatterns = {
        "loadstring%(%s*function", -- Dynamic code injection
        "require%(%d+%)", -- Module loading by ID
        "HttpService%.HttpGet", -- HTTP GET requests
        "HttpService%.PostAsync", -- HTTP POST requests
        "FireServer%([^%)]+%)", -- RemoteEvent abuse
        "InvokeServer%([^%)]+%)", -- RemoteFunction abuse
        "getfenv%(.+%)", -- Environment manipulation
        "setfenv%(.+%)", -- Environment manipulation
        "syn%.", "krnl%.", "fluxus%.", "scriptware%." -- Exploit library signatures
    }
    local legitimateNames = {
        "leaderboard", "chat", "gameplay", "ui", "input", "event", "function" -- Common legit terms
    }

    -- Function to check if name is likely legitimate
    local function isLikelyLegitimate(name)
        for _, legitName in ipairs(legitimateNames) do
            if name:lower():find(legitName:lower()) then
                return true
            end
        end
        return false
    end

    -- Function to check script source for suspicious patterns
    local function checkScriptCode(script)
        if script:IsA("LocalScript") then
            local success, source = pcall(function()
                return script.Source
            end)
            if success and source then
                for _, pattern in ipairs(suspiciousPatterns) do
                    if source:lower():find(pattern:lower()) then
                        return true, pattern
                    end
                end
            end
        end
        return false, nil
    end

    -- Scan each service
    for _, service in ipairs(services) do
        for _, obj in ipairs(service:GetDescendants()) do
            local isSuspicious = false
            local reason = nil
            local key = nil

            -- Check for suspicious names, excluding likely legitimate ones
            for _, name in ipairs(suspiciousNames) do
                if obj.Name:lower():find(name:lower()) and not isLikelyLegitimate(obj.Name) then
                    isSuspicious = true
                    reason = "Suspicious Name: " .. obj.Name
                    break
                end
            end

            -- Check for RemoteEvents/RemoteFunctions with non-legit names
            if (obj:IsA("RemoteEvent") or obj:IsA("RemoteFunction")) and not isLikelyLegitimate(obj.Name) then
                isSuspicious = true
                reason = obj.ClassName .. ": " .. obj.Name
            end

            -- Check script source for exploit patterns
            local codeSuspicious, pattern = checkScriptCode(obj)
            if codeSuspicious then
                isSuspicious = true
                reason = "Suspicious Code Pattern: " .. pattern
            end

            -- Report findings and store backdoors
            if isSuspicious then
                found = true
                key = obj.Name .. "_" .. HttpService:GenerateGUID(false)
                table.insert(detectedBackdoors, {obj = obj, key = key})
                addMessage("DETECTED: " .. reason .. " in " .. service.Name, Color3.fromRGB(0, 255, 0))
                addMessage("YOUR KEY: " .. key, Color3.fromRGB(0, 255, 0), true)
            end
        end
    end

    -- Check for HttpService usage
    local httpEnabled = pcall(function()
        return HttpService.HttpEnabled
    end)
    if httpEnabled then
        found = true
        local key = "HttpService_" .. HttpService:GenerateGUID(false)
        table.insert(detectedBackdoors, {obj = {Name = "HttpService"}, key = key})
        addMessage("DETECTED: HttpService Enabled", Color3.fromRGB(0, 255, 0))
        addMessage("YOUR KEY: " .. key, Color3.fromRGB(0, 255, 0), true)
    end

    -- Check for exploit environment indicators
    local exploitIndicators = {"syn", "krnl", "fluxus", "scriptware"}
    for _, indicator in ipairs(exploitIndicators) do
        local success, _ = pcall(function()
            return _G[indicator] or getfenv()[indicator]
        end)
        if success then
            found = true
            local key = "ExploitEnv_" .. HttpService:GenerateGUID(false)
            table.insert(detectedBackdoors, {obj = {Name = "ExploitEnv_" .. indicator}, key = key})
            addMessage("DETECTED: Exploit Environment (" .. indicator .. ")", Color3.fromRGB(0, 255, 0))
            addMessage("YOUR KEY: " .. key, Color3.fromRGB(0, 255, 0), true)
        end
    end

    -- Show Admin Button if backdoors found
    adminButton.Visible = found

    if not found then
        addMessage("NO BACKDOORS OR EXPLOITS FOUND!", Color3.fromRGB(255, 0, 0))
    end
end

-- Button Connections
scanButton.MouseButton1Click:Connect(function()
    scanForBackdoorsAndExploits()
end)

clearButton.MouseButton1Click:Connect(function()
    clearMessages()
end)

adminButton.MouseButton1Click:Connect(function()
    attemptAdminAccess()
end)

-- Initial Message
addMessage("PRECISE SCANNER READY, PASSENGER!", Color3.fromRGB(0, 255, 0))