[Feature Request] Auto assembler like in Cheat Engine

[DotMatrixMoe]

I was wondering if there could be (or already is an) auto assembler in PINCE. I'd like to search big-endian floats in RPCS3 using scripts like this:

alloc(TypeName,256)
alloc(ByteSize,4)
alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(UsesFloat,4)

TypeName:
db 'Float Big Endian',0
ByteSize:
dd 4
UsesFloat:
db 01

ConvertRoutine:
[32-bit]
push ebp
mov ebp,esp
mov eax,[ebp+8] //place the address that contains the bytes into eax
mov eax,[eax]   //place the bytes into eax
bswap eax
pop ebp
ret 4
[/32-bit]

[64-bit]
//rcx=address of input
mov eax,[rcx] //eax now contains the bytes 'input' pointed to
bswap eax
ret
[/64-bit]

ConvertBackRoutine:
[32-bit]
push ebp
mov ebp,esp
//[ebp+8]=input
//[ebp+c]=address of output
push eax
push ebx
mov eax,[ebp+8] //load the value into eax
mov ebx,[ebp+c] //load the address into ebx
bswap eax
mov [ebx],eax //write the value into the address
pop ebx
pop eax

pop ebp
ret 8
[/32-bit]

[64-bit]
//ecx=input
//rdx=address of output
bswap ecx
mov [rdx],ecx //place the integer the 4 bytes pointed to by rdx
ret
[/64-bit]

[korcankaraokcu]

It's in the roadmap. Scripting and assembler are already available but they are not integrated into GUI yet. Libpince engine is the scripting support and it actually is the next step in the roadmap so this feature will be most likely implemented within next year. I'll update this issue once it's complete. Here's the roadmap if you are interested

Edit: To clarify, you can already inject single-line asm by right clicking on the disassemble window but not trampoline code, that's what I meant when I said "not integrated into GUI yet"

[DotMatrixMoe]

How would I use the scripting and assembler without GUI? I'm willing to read the documentation in libpince to do it manually in the meantime.

[korcankaraokcu]

Open a console in pince root folder and activate the python env, then launch python with root privs like PINCE.sh does. So, in short:

. .venv/PINCE/bin/activate
sudo -E --preserve-env=PATH PYTHONDONTWRITEBYTECODE=1 python3

This will let you use the libs required by pince, they are installed locally. To attach to your process, you can use this code snippet:

from libpince import debugcore, utils
pid = utils.search_processes("process name")[0][0]
debugcore.attach(pid)
debugcore.interrupt_inferior()

This basically searches for your process and returns the first match, then attaches and stops it. To continue the process, you can use debugcore.continue_inferior

You can use utils.assemble to generate assembly code and debugcore.modify_instruction to modify the instruction with the code you generated. You can either read their documentation or refer to the reference widget that can be found in memory window->help

[MasterCATZ]

speaking of cheat engine any plans to have a way to import cheat engine tables ?

[brkzlr]

speaking of cheat engine any plans to have a way to import cheat engine tables ?

No, there won't be such a thing as it doesn't make sense. Memory layout between Windows and Linux are different so the table would still need to be modified for it to work.

[brkzlr]

Now with v0.4.5 you can use libpince functions inside a window called Libpince Engine to do scripting in the GUI itself while attached to a program.

Right now this is a very early beta feature and we will keep iterating on it, maybe even add CE style syntax parsing in the future, but as long as you're willing to do quite a bit of manual work it is possible to accomplish code caves and similar stuff here.

You can check the below screenshots for an example implementation of a codecave for Assault Cube.

As you can see, the manual work mentioned above means actually grabbing 5+ bytes of instructions to replace with a jmp instruction, making sure to properly pad with NOPs until the next unaffected instruction, and making sure that the instruction you want to keep are assembled in the newly allocated memory address and so on...

It's not an ideal workflow but the possibility is there. We'll keep this issue open for now until we decide how we want the scripting to look and proper implementation is done.