Use call by pointer to pointer return rop chain