Memory Viewer

The Memory Viewer is where PINCE turns into a debugger. This is where you look at code, registers, raw memory, the stack, breakpoints, watchpoints and code patches.

You can open it from the main window with Memory View or from an address/table result with context actions like Browse this memory region and Disassemble this address.

Layout

The window has four main areas:

• Disassembly: CPU instructions. Use this for breakpoints, stepping, patching code, NOPing instructions, tracing and bookmarks
• Registers: current CPU register values like RAX, RBX, RIP, RSP, EAX, EIP, flags and segment registers depending on target architecture
• Hex View: raw memory bytes and ASCII text. Use this for inspecting data, editing bytes, adding addresses to the table and setting watchpoints
• Stack / Stacktrace: call stack and raw stack memory. Use this for return addresses, stack values and pointers passed through calls

Most panes update when the process is stopped. Some tracking tools set breakpoints/watchpoints and then continue automatically while collecting data.

Common Workflows

Jump to an Address

Use Go to expression from the disassembly or hex view, usually Ctrl+G.

You can enter normal addresses, module expressions and GDB expressions, for example:

0x7ffff7dd0000
libgame.so+0x1234
$rip

See GDB Expressions for more examples.

Find Code That Touches a Value

Start from the address table. Right click a value and use:

• Find out what writes to this address
• Find out what reads this address
• Find out what accesses this address

This opens a tracking window and lets the game run while PINCE records which instructions touch the value.

More details: Search Opcodes & Watchpoints

Patch or NOP Code

In the disassembly view, right click an instruction and use:

• Edit instruction
• Replace instruction with NOPs

PINCE saves the original bytes the first time an address is patched, so you can restore them later with View -> Restore Instructions.

More details: Modifying Game Code

Keep Track of Important Code

Use bookmarks for code locations you want to come back to. In the disassembly view, right click an instruction and use Bookmark this address or open View -> Bookmarks.

Note that shortcuts are context-sensitive. Ctrl+B in the address table means Browse this memory region, but Ctrl+B in the disassembly view is used for bookmarks.

More details: Bookmarks

Inspect Raw Memory

Use the hex view when you want bytes, strings or nearby memory rather than assembly.

Useful actions:

• Edit: edit selected bytes or ASCII text
• Add this address to address list: add selected memory to the address table
• Disassemble this address: show the selected address in the disassembly view
• Set Watchpoint: stop when selected memory is read or written

Hex edits are written to the target when you confirm the edit dialog. Treat it like real memory editing, not just a viewer.

Set Breakpoints and Watchpoints

Use F5 in the disassembly view to toggle a breakpoint on the selected instruction.

Use Set Watchpoint in the hex view for memory watchpoints:

• Write Only: stop when memory is written
• Read Only: stop when memory is read
• Both: stop on read or write

Hardware watchpoints are limited, so don't set huge watch ranges unless you need them. See Search Opcodes & Watchpoints for the limits and tracked watchpoint behavior.

Debug Controls

The toolbar and Debug menu expose the usual debugger controls:

• Run: continue the target
• Break: stop the target and update the debugger view
• Step (F7): execute one instruction
• Step Over (F8): execute one instruction, but don't step into calls
• Execute Till Return (Shift+F8): run until the current function returns
• Toggle Breakpoint (F5): set or remove a breakpoint at the selected instruction
• Set Address (Shift+F4): change the instruction pointer, usually RIP or EIP
• Toggle Attach: detach or attach the debugger side

Be careful with Set Address. It changes where the process executes next. Jumping to nonsense usually means a crash.

Registers

The register pane shows the current CPU state. Register values matter because many instructions only make sense once you know what the registers contain.

For example:

mov eax, [rbx+0x14]

means nothing useful until you know rbx. If rbx points to a player object, [rbx+0x14] might be health, ammo or some other field.

You can edit registers by double clicking them while the process is stopped. PINCE accepts expressions there too, like 0, $rax+4 or libgame.so+0x1234.

Use Show Float Registers if you need floating point / vector register state.

Stack

The stack area has two views:

• Stacktrace: return addresses and frame addresses for the current call stack
• Full Stack: raw stack addresses, values and what those values point to

Use stacktrace when you want to know how execution got here. Use full stack when you want to inspect arguments, local pointers or return addresses manually.

From full stack, useful actions include:

• Disassemble 'value' pointer address: treat the selected value as code
• Show 'value' pointer in HexView: treat the selected value as data
• Toggle stack from BP/SP register: switch between base pointer and stack pointer based views

View Menu

Useful entries in View:

• Bookmarks: manage bookmarked disassembly addresses
• StackTrace Info: standalone stack trace window
• Breakpoints: list breakpoints and watchpoints, edit conditions, enable/disable or delete them
• Functions: functions found by code dissection
• GDB Log File: open the GDB log, if logging is enabled
• Memory Regions: mapped memory ranges with permissions
• Restore Instructions: restore saved original bytes for NOPed or edited instructions
• Referenced Strings: strings and values referenced by code after code dissection
• Referenced Calls: calls found after code dissection

Tools Menu

Useful entries in Tools:

• Inject .so file: Linux shared object injection. See Library Injection
• Inject DLL file: WINE/Proton DLL injection. See Library Injection
• Call Function: call a function in the target through GDB
• Search Instructions: search disassembly text. See Search Opcodes & Watchpoints
• Dissect Code: analyze code references, functions, strings, calls and jumps
• Dissect Mono/IL2CPP: inspect managed runtimes. See Mono/IL2CPP Dissector
• Structures: create and view memory structures. See Structures
• Libpince Engine: script repeatable patches and tools. See Libpince Engine

Settings That Affect It

In Settings -> Memory View, you can change:

• Whether Memory Viewer comes to front when the process stops
• Instructions shown per disassembly scroll
• Bytes shown per hex view scroll

These mostly affect navigation and display, not debugger behavior.