• Found it
    put code at addr, call at addr+1 for thumb code.

    var data = atob("AyFAGHBH");
    //var addr = process.memory().stackEndAddress-data.le­ngth;
    var addr = process.memory().stackEndAddress;
    for(var i=0;i<data.length;i++){
    poke8(addr+i,data.charCodeAt(i));
    console.log((addr+i).toString(16)+","+pe­ek8(addr+i).toString(16));
    }
    
    addr++;
    //var adder = E.nativeCall(1, "int(int)", atob("AyFAGHBH"));
    var adder= E.nativeCall(addr, "int(int)");
    
    console.log(adder(2));
    
    

    Outputs

    >echo(0);
    20009b3c,3
    20009b3d,21
    20009b3e,40
    20009b3f,18
    20009b40,70
    20009b41,47
    5
    =undefined
    > 
    
About