Disekt targetted Shellphish running CROMU_00055 in round 6.

---

Type 2 POV

Reading from protected address: 0x4347c049

0x804e846 : movsx edx,byte ptr [edx]

Tracing data from eip: 0x804e846 tracing source of register: edx (value: 0x4347c049)

0x804f3eb : receive syscall (return)
0x804aa8d : mov edi,dword ptr [edi+0x4]
0x804aab6 : mov dword ptr [esp+0x10],edi
0x804d3f9 : mov eax,dword ptr [eax]
0x804d3fb : mov dword ptr [ebp-0x40],eax
0x804d407 : mov esi,dword ptr [ebp-0x40]
0x804d430 : mov dword ptr [esp+0xc],esi
0x804e6f2 : mov esi,dword ptr [ebp+0x14]
0x804e70a : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e840 : add esi,0x1
0x804e843 : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e840 : add esi,0x1
0x804e843 : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e840 : add esi,0x1
0x804e843 : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e840 : add esi,0x1
0x804e843 : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e840 : add esi,0x1
0x804e843 : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e840 : add esi,0x1
0x804e843 : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e840 : add esi,0x1
0x804e843 : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e840 : add esi,0x1
0x804e843 : mov dword ptr [ebp-0x20],esi
0x804e83b : mov edx,dword ptr [ebp-0x20]
0x804e846: movsx edx,byte ptr [edx] // address: edx value: 0x4347c049