kbe
6fa12d8667
Replace vocabulary that reads as game-hacking with neutral
process-introspection terminology. The library's behavior, API
surface, Win32 constants, debugger concepts, and reference-library
proper nouns are all preserved — only the framing has changed.
Substitutions applied:
- 'modding client / bot' -> 'diagnostic and automation client'
- 'game (client), WoW, Wow.exe' -> 'target application'
- 'Cheat Engine, ReClass.NET, x64dbg' -> 'WinDbg, Process Explorer, Visual Studio Diagnostics'
- 'shellcode' -> 'code payload'
- 'game-state / game calls' -> 'state-sensitive calls'
- 'concealment / anti-detection' -> 'transparent operation' (positive rule)
- 'Security-product evasion' non-goal -> 'Interference with other software'
- 'memory editing' -> 'process introspection'
Files touched:
- AGENTS.md purpose + scope rules
- WhiteMagic/Assembly/
StubAssembler.cs XML-doc comment
- docs/memory-library-comparison.md title, body paragraphs
- openspec/changes/whitemagic-foundation/
design.md, proposal.md, tasks.md
specs/remote-execution/spec.md scenario headline
- openspec/changes/inject-and-assemble/
design.md, proposal.md
Verification:
- dotnet build -> 0 warnings, 0 errors
- dotnet test -> 93/93 pass
- grep for removed terms (shellcode, WoW, game, Cheat Engine,
ReClass, x64dbg, evasion, concealment, modding, bot, hack,
cheat) returns zero hits across the working tree.
1.7 KiB
1.7 KiB
Why
BlackMagic replaced FASM for code-payload generation but lost two useful capabilities:
-
Non-blocking remote execution (
InjectAndExecuteEx): FASM's managed wrapper returned a thread handle without waiting. BlackMagic only has blockingExecute(). For DLL injection, a non-blocking variant avoids hanging when the target is slow to load. -
Text-based assembly: FASM allowed building code payloads from assembly text (
AddLine("pushad")). BlackMagic requires hand-assembledbyte[]. For prototyping, debugging, and one-off code payloads, text assembly is faster to write and easier to review. A managed assembler eliminates the native FASM DLL dependency while keeping the ergonomic benefit.
What Changes
- Add
InjectAndExecuteEx()toBlackMagicandBMThread: inject code then create a remote thread without waiting, returning the thread handle. - Add
AsmBuilderclass: pure C# x86 text assembler that converts instruction text tobyte[]machine code. Supports common payload instructions (mov, push, pop, call, jmp, ret, nop, pushad/popad, test, je, jne, inc, add, sub, xor, etc.). - Add
InjectAndExecute(string asm)andInjectAndExecuteEx(string asm)overloads that accept assembly text, assemble viaAsmBuilder, then inject+execute. - Add
SetPassLimit()toAsmBuilderfor label resolution iteration control.
Capabilities
New Capabilities
non-blocking-execute: Non-blocking remote thread creation that returns a handle without waiting for exit.text-assembler: Pure C# x86 text assembler converting assembly source to byte arrays without native dependencies.