[!WARNING]
You may be banned — Byfron can detect this. Use an alternate account while running Xeno. Refer to this repository to learn how it works and what it does.
I am not responsible for any bans.

Xeno

A runtime executor built for Roblox's web client.

Xeno performs execution by inserting unsigned bytecode into a core Roblox module script. This technique is widely used and offers improved stability and versatility compared with many other executors that rely on similar methods.

Note

If you incorporate parts of this project into your own work, follow the license terms and give proper attribution. Do not copy the entire source, claim it as your own, or redistribute/sell it without crediting Xeno and the original author.

Features

• Rapid script execution
• Works with multiple Roblox instances simultaneously
• Capable of running most scripts, including some protected (Lua Armor) scripts
• Very fast virtual filesystem with sync to the external process
• Minimal in-game performance impact and low CPU usage
• Helpful utilities like HttpSpy, resolving an instance's real address, cross-client global set/get, and instance spoofing

This repository was primarily a learning project for C++ and some C#. Expect rough edges and imperfect memory handling.
The XenoUI C# WPF app is a prototype, so its architecture and interface are deliberately simple.

Xeno has several security shortcomings because it was only used privately and never officially released.

Example custom functions

-- get real address
local address = Salad.get_real_address(game:GetService("ScriptContext"))
print("Script context address:", string.format("0x%x", address))

-- spoof instance
Salad.spoof_instance(game:GetService("CoreGui"), 0) -- set the address of coregui to 0
Salad.spoof_instance(game.Players.LocalPlayer, Instance.new("Part")) -- set the localplayers address to a part

-- http spy
Salad.HttpSpy() -- set http spy to true
Salad.HttpSpy(false) -- set httpspy to false

-- globals (shared across all clients, saved inside the executor)
-- similar to Instance:GetAttribute() but supports tables
-- global name, value
Salad.SetGlobal("__test", { -- can only set table, number, and string as a global
    ["test_text"] = "hello, world!"
})

local t = Salad.GetGlobal("__test") -- the table we just set
print(t.test_text) -- hello, world!

-- other
print(Salad.PID) -- current roblox process id
print(Salad.GUID) -- the guid it is using to communicate with the external

getgenv().game = workspace.Parent

This will remove HttpGet from game.
A modified version of Dex tailored for Xeno is included with the release.