[!WARNING]
Running Xeno may result in a ban — Byfron can detect usage. Use an alternate account when launching Xeno. See this repository for details about how it operates and what it does.
I accept no responsibility for any bans.

Xeno

A runtime executor built for Roblox's web client.

Xeno injects unsigned bytecode into a Roblox core module script to enable script execution. This method offers improved stability and flexibility compared with many other executors that rely on similar injection techniques.

Notice

If you reuse or adapt code from this project, honor the license and give credit to the original author. Do not copy the entire codebase and claim it as your own, or redistribute/sell it without acknowledging Xeno and its creator.

Capabilities

• Rapid script execution
• Works across multiple Roblox instances
• Can run most scripts, including certain protected (Lua Armor) scripts
• High-performance virtual filesystem with synchronization to an external process
• Minimal in-game performance overhead and low CPU usage
• Handy utilities: HttpSpy, retrieving an instance's real memory address, cross-client global storage, and instance spoofing

This project served primarily as a learning exercise in C++ and C#. Expect some rough edges and imperfect memory handling.
The XenoUI C# WPF application is a prototype, so its architecture and UI are intentionally simple.

Xeno includes several security limitations because it has only been used privately and has not been publicly deployed.

Example custom functions

-- get real address
local address = Salad.get_real_address(game:GetService("ScriptContext"))
print("Script context address:", string.format("0x%x", address))

-- spoof instance
Salad.spoof_instance(game:GetService("CoreGui"), 0) -- set the address of CoreGui to 0
Salad.spoof_instance(game.Players.LocalPlayer, Instance.new("Part")) -- set the LocalPlayer's address to a new Part

-- http spy
Salad.HttpSpy() -- enable HTTP spy
Salad.HttpSpy(false) -- disable HTTP spy

-- globals (shared across all clients, stored by the executor)
-- similar to Instance:GetAttribute() but supports tables
-- global name, value
Salad.SetGlobal("__test", { -- can only store tables, numbers, and strings as globals
    ["test_text"] = "hello, world!"
})

local t = Salad.GetGlobal("__test") -- retrieve the table we set
print(t.test_text) -- hello, world!

-- other
print(Salad.PID) -- current Roblox process id
print(Salad.GUID) -- GUID used for communication with the external process

getgenv().game = workspace.Parent

Running the line above will remove HttpGet from game.
A modified build of Dex adapted for Xeno is bundled with this release.