ForAllSecure targetted Disekt running CROMU_00095 in round 23.

---

Type 1 POV

eip:0x87b4bb33 - ebp:0xa670737e

---

Execution control corruption via return (return to: 0xbaaaaefc).

Tracing data from eip: 0x8053c7c tracing source of memory: 0xbaaaaefc (value: 0xbaaaaeef)

0x8053c78 : receive syscall (return)
0x8053c7c: ret // address: 0xbaaaaefc value: 0xbaaaaeef

---

Execution of memory occurred that was not part of the initial text sections or an executably allocated page.

Tracing data from eip: 0xbaaaaeef tracing source of memory: 0xbaaaaeef (value: 0x70737ebd)

0x8053c78 : receive syscall (return)
0xbaaaaeef: mov ebp,0xa670737e // address: 0xbaaaaeef value: 0x70737ebd

---

Negotiated general register: ebp:0xa670737e

Tracing data from eip: 0xbaaaaef9 tracing source of register: ebp (value: 0xa670737e)

0xbaaaaeef : mov ebp,0xa670737e
0xbaaaaef9: jmp eax // address: ebp value: 0xa670737e