[!WARNING]
You may be banned — Byfron can detect this. Use an alternate account while running Xeno. Refer to this repository to learn how it works and what it does.
I am not responsible for any bans.

Xeno

A runtime executor built for Roblox's web edition.

Xeno injects unsigned bytecode into a Roblox core module script to execute code. This well-known technique gives Xeno increased stability and flexibility compared to many other executors that rely on a similar approach.

Note

If you reuse portions of this project or incorporate any of its code, follow the license and credit the original author. Do not copy the entire source and claim it as your own, redistribute, or sell it without acknowledging Xeno and its creator.

Features

• Rapid script execution
• Works with multiple Roblox instances
• Able to run most scripts, including some protected (e.g., Lua Armor) scripts
• Very fast virtual filesystem with synchronization to the external process
• Minimal in-game performance impact and low CPU usage
• Utility helpers such as HttpSpy, retrieving an instance's actual address, cross-client global set/get, and instance spoofing

This project was mainly a learning project for C++ and some C#, so expect rough edges and imperfect memory handling.
The XenoUI C# WPF application was created as a prototype, so its architecture and UI are intentionally simple.

Xeno contains multiple security weaknesses because it has only been used privately and was not released publicly.

Example custom functions

-- get real address
local address = Salad.get_real_address(game:GetService("ScriptContext"))
print("Script context address:", string.format("0x%x", address))

-- spoof instance
Salad.spoof_instance(game:GetService("CoreGui"), 0) -- set the address of coregui to 0
Salad.spoof_instance(game.Players.LocalPlayer, Instance.new("Part")) -- set the localplayers address to a part

-- http spy
Salad.HttpSpy() -- set http spy to true
Salad.HttpSpy(false) -- set httpspy to false

-- globals (shared across all clients, saved inside the executor)
-- similar to Instance:GetAttribute() but supports tables
-- global name, value
Salad.SetGlobal("__test", { -- can only set table, number, and string as a global
    ["test_text"] = "hello, world!"
})

local t = Salad.GetGlobal("__test") -- the table we just set
print(t.test_text) -- hello, world!

-- other
print(Salad.PID) -- current roblox process id
print(Salad.GUID) -- the guid it is using to communicate with the external

getgenv().game = workspace.Parent

This will remove HttpGet from game.
A modified version of Dex tailored for Xeno is included with the release.