Disekt targetted ForAllSecure running CROMU_00055 in round 19.

---

Type 2 POV

Reading from protected address: 0x4347c04d

0x804fa4c : movsx edx,byte ptr [edx]

Tracing data from eip: 0x804fa4c tracing source of register: edx (value: 0x4347c04d)

0x80507fa : receive syscall (return)
0x804b02b : mov edi,dword ptr [edi+0x4]
0x804b054 : mov dword ptr [esp+0x10],edi
0x804e0cf : mov eax,dword ptr [eax]
0x804e0d1 : mov dword ptr [ebp-0x40],eax
0x804e0dd : mov esi,dword ptr [ebp-0x40]
0x804e106 : mov dword ptr [esp+0xc],esi
0x804f83e : mov esi,dword ptr [ebp+0x14]
0x804f856 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa43 : add esi,0x1
0x804fa49 : mov dword ptr [ebp-0x20],esi
0x804fa3e : mov edx,dword ptr [ebp-0x20]
0x804fa4c: movsx edx,byte ptr [edx] // address: edx value: 0x4347c04d