Memory Viewer

The Memory Viewer is PINCE's main tool for inspecting and modifying a process's memory at the assembly level. It shows you the raw disassembly, hex dump, CPU registers and stack, letting you see exactly what the program is doing in real time.

How to Access It

You can open the Memory Viewer in several ways:

• Click the Memory View button in the main window
• Right click on any address in the address table or scan results and select Browse this memory region (Ctrl+B) or Disassemble this address (Ctrl+D)

Layout

The Memory Viewer is split into four main panes:

• Disassembly Pane (top-left): Shows the program's assembly instructions. This is where you'll spend most of your time when reverse engineering. Each line shows an address, the opcodes, the assembly instruction and comments. You can scroll through the entire program's code, set breakpoints and step through instructions one at a time.
• Registers Pane (top-right): Shows the current values of all CPU registers (EAX, EBX, ECX, EDX, ESI, EDI, ESP, EBP, EIP and flags). These values update in real time as you step through code or when the program hits a breakpoint. The register values are essential for understanding what the current instruction is doing.
• Hex Dump Pane (bottom-left): Displays raw memory bytes in hexadecimal format. This is useful for viewing data structures, strings or any non-code memory. You can edit bytes directly here and the changes are written to the process memory immediately.
• Stack Pane (bottom-right): Displays the program's stack, which is where local variables, function parameters and return addresses are stored. The stack grows downward in memory and you can see the values pushed and popped as functions are called and return.

Disassembly Pane

The disassembly pane shows four columns:

• Address: The memory address of the instruction
• Opcodes: The raw machine code bytes (in hex)
• Instruction: The assembly instruction in human-readable format
• Comment: User-defined comments and annotations for instructions

You can right click on any instruction to access a context menu with these options:

• Go to expression (Ctrl+G): Opens a dialog where you can enter an address, symbol name or GDB expression to jump to. This is useful for quickly navigating to specific functions or memory locations without scrolling.
• Back: Returns to the previously viewed address in the disassembly pane. This works like a browser's back button, letting you retrace your navigation steps through the code.
• Show this address in HexView (Ctrl+H): Jumps the hex dump pane to show the memory at this instruction's address. This lets you see the raw bytes of the instruction or data it references.
• Follow (Space): If the current instruction references another memory address (like a jump instruction or a data reference), this jumps to that target address. For example, if you're looking at jmp 0x401000, pressing Space takes you to 0x401000.
• Examine Referrers (Ctrl+E): Shows a list of all instructions in the program that jump to or call this address. This is essential for finding all the places where a function is called or where execution flows to a specific location.
• Bookmark this address (Ctrl+B): Adds this address to your bookmarks list for quick navigation later. Bookmarks are saved with your session and let you quickly jump back to important locations.
• Delete this bookmark: Removes a bookmark from this address. This option only appears if the address is already bookmarked.
• Change comment: Edits the comment text for a bookmarked address. Comments help you remember what each important location does, like "health check" or "damage calculation".
• Go to bookmarked address: Opens a submenu showing all your bookmarked addresses. Selecting one jumps directly to that location in the disassembly pane.
• Toggle Breakpoint (F5): Sets a breakpoint on this instruction. When the program runs and reaches this address, it will pause execution so you can inspect registers, memory and step through the code. Press F5 again on the same instruction to remove the breakpoint.
• Add/Change condition for breakpoint: Adds a condition to an existing breakpoint so it only triggers when certain criteria are met. For example, you might set a breakpoint to only pause when EAX equals a specific value, letting the program run normally at other times.
• Edit instruction: Opens a dialog to modify the assembly instruction at this address. The new instruction is written directly to the process memory. This is how you change program behavior, like replacing a conditional jump with an unconditional one.
• Replace instruction with NOPs: Replaces the current instruction with NOP (no-operation) instructions. This effectively disables the instruction without breaking the code structure. Useful for removing checks or disabling functionality.
• Find out which addresses this instruction accesses: Finds what memory addresses this instruction accesses. This sets up a tracking breakpoint on the instruction itself to see which addresses it reads from or writes to when it executes.
• Break and trace instructions (Ctrl+T): Opens a dialog to start recording execution flow. PINCE will log each instruction as it executes, letting you see the exact path the program took. This is useful for understanding complex code paths or finding where a specific value gets modified.
• Dissect this region (Ctrl+D): Analyzes the memory region around this address to identify code patterns, function boundaries and call graphs. This helps you understand the structure of the code and find related functions.
• Refresh (R): Reloads the disassembly view from the process memory. Use this if the display seems out of sync or after making changes to verify they took effect.
• Copy to Clipboard: Opens a submenu with options to copy different parts of the selected instruction:
  • Copy Address: Copies just the memory address
  • Copy Bytes: Copies the raw machine code bytes
  • Copy Instruction: Copies the assembly instruction text
  • Copy Comment: Copies the comment text
  • Copy All: Copies all columns (address, bytes, instruction, comment) separated by tabs

Hex Dump Pane

The hex dump pane shows memory in a traditional hex editor layout with addresses on the left, hex bytes in the middle and ASCII representation on the right. You can right click to access:

• Edit: Opens a dialog showing the selected bytes in both hex and ASCII format. You can modify the values directly and the changes are written to the process memory immediately when you confirm. This is how you change data values, strings or any other non-code memory.
• Go to expression (Ctrl+G): Opens a dialog where you can enter an address or expression to jump to. This lets you quickly navigate to specific memory locations without scrolling.
• Disassemble this address (Ctrl+D): Switches the disassembly pane to show the code at this address. This is useful when you're looking at data in the hex view and want to see what code is nearby or what code references this data.
• Add this address to address list (Ctrl+A): Adds the selected address to the main address table in the main window. You'll be prompted to enter a description and select the value type. This lets you monitor and modify this memory location from the main interface.
• Copy (Ctrl+C): Copies the selected bytes to the clipboard. If you're selecting from the hex side, it copies the hex values. If you're selecting from the ASCII side, it copies the text representation.
• Refresh (R): Reloads the hex view from the process memory. Use this to see the latest values after the program has modified memory or after you've made changes elsewhere.
• Set Watchpoint: Opens a submenu to set a watchpoint on the selected address range. Watchpoints pause the program when the memory is accessed:
  • Write Only: Pauses when the program writes to this memory location
  • Read Only: Pauses when the program reads from this memory location
  • Both: Pauses when the program reads from or writes to this memory location
• Add/Change condition for breakpoint: If a watchpoint is already set on this address, this lets you add a condition so it only triggers when certain criteria are met.
• Delete Breakpoint: Removes an existing watchpoint from the selected address range, allowing the program to access that memory without pausing.

Registers Pane

The registers pane displays all CPU registers and their current values. This is crucial for understanding what the current instruction is doing. For example, if you see mov eax, [ebx+4], you need to know what's in EBX to understand what memory address is being accessed. The registers update automatically as you step through code or hit breakpoints.

Stack Pane

The stack pane shows the program's stack memory. By default, it starts in stack trace mode showing the function call history. You can toggle between two views using the context menu.

Stack Trace View (default): Shows the call stack with two columns:

• Return Address: The address where execution will return after the function completes
• Frame Address: The stack frame pointer for each function call

Full Stack View: Shows the actual stack memory with three columns:

• Address: The stack pointer address (where on the stack)
• Value: The actual value stored at that stack location
• Points to: If the value looks like a pointer, this shows what it points to (either an address or a string)

The context menu changes depending on which view is active.

Stack Trace View context menu:

• Full Stack: Switches to the full stack view showing actual stack memory. This lets you see all the values on the stack, not just the function call history.
• Copy to Clipboard: Opens a submenu:
  • Copy Return Address: Copies the return address
  • Copy Frame Address: Copies the frame address
• Refresh (R): Reloads the stack view from the process memory.

Full Stack View context menu:

• Stacktrace: Switches back to the stack trace view showing function call history. This shows you which functions called which other functions to get to the current point in execution.
• Toggle stack from BP/SP register: Toggles between showing the stack starting from the Stack Pointer (SP) or the Base Pointer (BP). SP shows the current top of the stack, while BP shows the stack frame of the current function. Different situations call for different views.
• Copy to Clipboard: Opens a submenu:
  • Copy Address: Copies the stack pointer address
  • Copy Value: Copies the value stored at that stack location
  • Copy Points to: Copies what the value points to
• Refresh (R): Reloads the stack view from the process memory.
• Disassemble 'value' pointer address (Ctrl+D): Takes the value from the selected stack entry and shows it in the disassembly pane. This is useful when a stack value looks like a code address and you want to see what instruction is at that location.
• Show 'value' pointer in HexView (Ctrl+H): Takes the value from the selected stack entry and shows it in the hex dump pane. This is useful when a stack value looks like a data address and you want to see what data is stored there.

Debug Controls

The Memory Viewer includes a full debugger with controls in the toolbar and Debug menu:

• Run: Continues running the program. It executes normally until it hits a breakpoint or you manually break.
• Break: Pauses execution. When broken, you can inspect memory, step through code and modify values.
• Step (F7): Executes exactly one instruction and then pauses. This is the most granular way to watch the program execute, letting you see every single operation. If the instruction is a function call, Step will enter that function and pause at its first instruction.
• Step Over (F8): Executes the next instruction, but if it's a function call, it runs the entire function and pauses after it returns. This lets you skip over functions you don't care about while still stepping through the code you're interested in.
• Execute Till Return (Shift+F8): Runs the program until the current function returns to its caller. This is useful when you've stepped into a function and want to quickly get back out without stepping through every instruction.
• Set Address (Shift+F4): Changes the instruction pointer (EIP/RIP) to a new address. This effectively jumps program execution to a different location. Use with caution as jumping to arbitrary addresses can crash the program.
• Toggle Breakpoint (F5): Sets or removes a breakpoint on the currently selected instruction in the disassembly pane. This is a quick way to manage breakpoints without using the right-click menu.
• Toggle Attach: Toggles whether PINCE is attached to the process. When detached, the program runs normally without any debugging. When attached, you can use all the debugging features. Some games detect debugging, so detaching can help avoid detection.

File Menu

The File menu has one item:

• Load Trace: Loads a previously saved trace file and opens the trace window.

View Menu

The View menu lets you access various information windows:

• Bookmarks: Opens the bookmarks window showing all your bookmarked addresses with their comments. This lets you manage your bookmarks, add new ones, edit comments and quickly jump to any bookmarked location.
• StackTrace Info: Shows detailed stack trace information including return addresses and frame addresses for each function call in the call stack. This helps you understand the exact path the program took to reach the current execution point.
• Breakpoints: Opens the breakpoints window showing all breakpoints and watchpoints you've set. From here you can enable/disable breakpoints, edit conditions, delete breakpoints and see how many times each breakpoint has been hit.
• Functions: Opens the functions window showing all functions discovered in the program. This is populated by dissecting code and helps you navigate between different functions.
• GDB Log File: Opens the GDB log file in a text viewer. This shows all the GDB commands PINCE has executed and their responses. Useful for debugging PINCE itself or understanding what's happening under the hood.
• Memory Regions: Shows all memory regions of the process with their addresses, sizes and permissions (read/write/execute). This helps you understand the program's memory layout and find specific regions like code, data, heap or stack.
• Restore Instructions: Restores all modified instructions to their original values. When you edit instructions or replace them with NOPs, PINCE saves the originals. This option reverts all your changes at once, useful if you've made mistakes or want to start over.
• Referenced Strings: Shows all strings that are referenced in the code. This helps you find where text is used in the program, useful for localization, finding UI elements or understanding what messages the program displays.
• Referenced Calls: Shows all function calls referenced in the code. This gives you a list of all the functions that are called, helping you understand the program's structure and find specific functionality.

Tools Menu

The Tools menu provides advanced analysis and modification features:

• Inject .so file: Injects a shared library (.so file) into the running process. The library's initialization code will execute in the context of the target process. This works on native Linux games and also on WINE/Proton games. Useful for adding custom functionality, hooking functions or modifying behavior.
• Inject DLL file: Injects a Windows DLL into the running process. This only works on WINE/Proton games, not native Linux games. The DLL's DllMain function will be called with DLL_PROCESS_ATTACH. Useful for injecting mods, cheats or custom code into Windows games running on Linux.
• Call Function: Calls a function in the target process with specified parameters. You provide the function address and arguments and PINCE will execute the function in the context of the target process and return the result. Useful for testing functions, triggering specific behavior or calling game functions directly.
• Search Instructions: Searches for specific instruction patterns in the program's code. You can use wildcards and patterns to find instructions that match certain criteria. This is useful for finding specific code patterns, like all places where a register is compared to a value or all calls to a certain type of function.
• Dissect Code: Analyzes the program's code to find all functions, function calls, jumps and code flow. This builds a map of the program's structure and populates the Functions window. Essential for understanding large codebases and finding related code.
• Dissect Mono/IL2CPP: Opens the Mono/IL2CPP dissector for games built with Unity or other .NET frameworks. This lets you browse and search .NET classes, methods and fields, making it much easier to find and modify game logic in managed code.
• Structures: Opens the structures window where you can define and view data structures. You can create custom structure definitions that overlay on memory, letting you see complex data like objects, arrays or game state in a readable format instead of raw bytes.
• Libpince Engine: Opens the Libpince Engine window for advanced scripting and automation. This provides a Python API to control PINCE programmatically, letting you write scripts to automate complex tasks, create custom tools or build sophisticated cheats.