rename ROP.call_chain() -> ROP.call_chain_ptr()
improve FormatStr.write4()