You're just missing a few pointer dereferences. The pack("j",...) does the int->ptr conversion. The first unpack does SvANY( $p ) to find $a. The next one doesSvANY( $a ) to find its xpv struct. The next and final unpack is dereffing the xpv_pv pointer to read the C string.

This is all *reading* addressable memory. Writing back to it is a completely different trick involving faking structs for B to convince perl that strings that you control are real perl structures. You can then fake up a perl string where the pointer goes to any arbitrary location.