Eco Executor - Made for pentesting and debugging

Resources Community Resources
, , , ,
41

I installed it successfully, but the executor UI does not open. Instead, only the error message appears
Btw, only the plugin UI opens normally

42

Can you give all error message related to the executor ui, because I can’t find the errors (works fine for me)

1 Like
43

Hello,
I found a serious bug in your Eco Executor (eAPI), inside the add_global({"gethwid"}, func).

Problematic line (3190):

local data = service.HttpService:JSONEncode({
	CPU_START = math.round(tick() - os.clock()),
	TIMEZONE = os.date("%Z"),
	IS_DST = os.date("*t").isdst,
	ACCELEROMETER_ENABLED = user_input_service.AccelerometerEnabled,
	TOUCHSCREEN_ENABLED = user_input_service.TouchEnabled
})

Issue
os.date("%Z") can return non-UTF8 strings depending on system locale, for example:
Mitteleurop�ische Sommerzeit (ANSI / Windows-1252)

This breaks HttpService:JSONEncode because it requires valid UTF-8 strings.

Fix

local raw = os.date("%Z")
TIMEZONE = raw and raw:gsub("[^\32-\126]", "?") or "UNKNOWN"

Also the cursor desyncs really fast and doesnt align with the line numbers:

image
image731×388 37.6 KB

btw how are you missing out of the bug, you can cleary see that the error begins at your eAPI (even the lines are shown) and all the users here say that it doesnt open.

Improvements you should (must) made:

  • Why is there a saved RBXLX file inside the SaveInstance module? It takes up unnecessary space (~1.05 MB).

  • In line 295 inside the core, you are Saving AutoFiles and not Eco_Executor_AutoFiles so data will disapear.

  • I would suggest to make a theme based coloring and not hardcoded color theme: Color3.fromRGB(30,30,30), this makes your code cleaner and easier to change for updates.

  • You can update some Modules that use Hashing and Compression and Base64, with Roblox new Encoding Service: EncodingService | Documentation - Roblox Creator Hub

  • Add a proper check for DataStoreEnabled so it doesnt error if its disabled.

  • Also for what is the IS Remote? Roblox Plugins can do Http Calls directly. and Server Sided, we got the console for it.

2 Likes
44

Thanks for telling me the problems, I will try to resolve it. (maybe because I finally started working again after months and I pretty much forgot almost everything)

1 Like
45

is there a reason for the deletion of the github repo? also i got a small question, why do you needed getfenv(), or setfenv()?

47

My account suddenly got flagged for no reason, idk why that happen. For the getfenv and setfenv, I don’t really remember what I use that for, I will checked later (currently Im making the 0.0.7 version one but need to wait for my account restored)

2 Likes
48

i made some logos so i can expand my skills in photopea. you can use them if you want xD

normalIcon
normalIcon4028×4028 217 KB

logolightv2
logolightv29320×4028 627 KB

logonormalv2
logonormalv29320×4028 750 KB

logodarkv2
logodarkv29320×4028 650 KB

also i am working on a custom luaVM that runs ontop of the default, it temporaly stores the source of every script that runs inside the client context and when deletes them , and when feeds the sources that it saved to the custom luaVM so that namecall and so on are properly emulated, sadly its not an easy task to do. its quite hard to emulate roblox’s luauVM , its open source but that doesnt help xD

Screenshot 2026-08-05 202849
Screenshot 2026-08-05 202849723×431 61 KB

it supports custom highlights built ins and so on, also error linting, with scroll bar linting autocompletion using the best (worse) AST CST i made.

actually i am bored currently because there is nothing todo

1 Like
49

didn’t expect you made some logos (some of them are solid so maybe ill use it, thx)
I’m impressed that you could make the scroll bar has some linting.

1 Like
50

I am working on a proper luau VM that sits ontop of the standard luau VM and runs the whole client context, the problem is, your implementations are clever but also missleading. An example is the namecall implementation, it will only work for certain data types (C userdata) not for custom metatables. Also you cant do getscriptbytecode. hookmetamethod would also work with every metamethod, (__index, __newindex, __namecall, __sub, __mul, __div, __mod, __lt, __le and so on). You can control the gc (garbage collector) and make these work: getgc(), getreg() / getregistry(), getconnections(), getgcinfo() / gcinfo(), intance related garbage collector apis like getnilinstances requires an object manager the same for gethiddenproperty.

Think of it like this:
Roblox Luau VM (host runtime)
v
Your Luau VM (guest runtime)
v
Scripts executed inside your VM
(and you linter will also benefit from it)

1 Like
51

can you upload the file on some other website like google drive or whatever

1 Like