ForAllSecure targetted Shellphish running CROMU_00095 in round 21.

---

Type 1 POV

eip:0x9472502d - edx:0x9b7649a3

---

Execution control corruption via return (return to: 0xbaaaae88).

Tracing data from eip: 0x8053be0 tracing source of memory: 0xbaaaae88 (value: 0x9472502d)

0x8053a8b : receive syscall (return)
0x8053be0: ret // address: 0xbaaaae88 value: 0x9472502d

---

Negotiated general register: edx:0x9b7649a3

Tracing data from eip: 0x8053be0 tracing source of register: edx (value: 0x9b7649a3)

0x8053a8b : receive syscall (return)
0x8053bdd : pop edx
0x8053be0: ret // address: edx value: 0x9b7649a3