Read the paper. They're using a known input ciphertext to help aid this recovery and get around the limitations you've noted. Recovery also takes an hour, byte by byte with different decryptions.