* Send 255 blocks $-1, -2, ..., -255$ to make all ciphertext blocks  equal to $E(iv)$.* Receive $T = E(iv) (1+H)^{255}$.* For each of the 16 possible values of $E(iv)$, compute $h = T \cdot  E(iv)^{-1}$ and test if $h^{(2^{128}-1)/255} = 1$.* Assuming no false positives, only one value will pass the test --  output it and proceed to the next round.    * If we have multiple positives, just guess and hope we are lucky      to speed things up a bit.