d0nutptr / v8_rand_buster

v8_rand_buster

Breaks the following pattern in modern V8 javascript engine.

Math.floor(CONST * Math.random())

Credits to Douglas Goddard for the initial work and blog post that helped explain how to solve this problem initially.

Usage

Assuming you've watched the talk and understand the nuances of how this works, the following should serve as a simple explanation that can get you going with this tool.

Getting the seed

cat codes.txt | tac | python3 xs128p.py --multiple <MULTIPLE>

example codes.txt

12345
23451
34512
45123
51234
.
.
.

• codes.txt: an in-order list of codes you leaked from the Math.floor(Math.random() * CONST) invocations.
• tac: reverses the list (watch the talk for more details and how this might go wrong)
• : equivalent to CONST in the Math.floor(Math.random() * CONST) expression.

Getting the next secrets

Note: this gets the next outputs of the internal math.random calls after flooring. this will not get the next JS call to math.random. See the talk for more details

python3 xs128p.py --mutliple <MULTIPLE> --gen <SEEDS>,<NUMBER_OF_OUTPUTS>

• : Same as above ^
• : The seeds generated by the above step
• <NUMBER_OF_OUTPUTS>: the number of floor randoms you'd like generated. This should be greater than the number of codes you originally used to generate the seed if you want unknown values.

v8_rand_buster's Issues

can we solve this please?

i have a sequence of 20 increasing random numbers, is it possible to predict the next 10, if yes could you please write in comment what will be thos next 10, thank you so much, this is the sequence :
19996463086597
51408670348612
119666659114170
191206974700443
409118905032525
611140496167764
2058769515153876
4216495639600700
6763683971478124
9974455244496707
30045390491869460
44218742292676575
138245758910846492
199976667976342049
525070384258266191
1135041350219496382
1425787542618654982
3908372542507822062
8993229949524469768
17799667357578236628

Is It Possible?

Hello,
Is It possible solve Math.floor(100000 + Math.random() * 900000); format otps with your script?

I get the previous output not the next how can i fix it ?

z3 able to solve missing numbers?

Hi,

I loved the Youtube video - you explained it very well and it was all very interesting. Tried out the python script also and works great.

I was curious how "bust-able" do you think the states would be if we were to be missing between maybe 0-5 calls to Math.random() inbetween each submitted observed ints.

So for example imagine we had these ints:
176839 [available]
27228 [missing]
240473 [missing]
334066 [missing]
368492 [available]
202952 [missing]
292661 [missing]
57048 [available]
295167 [available]
128978 [missing]
187419 [available]
199066 [available]

And of course we'd be loading only the [available] ones into the script so whilst they are in order still we'd be missing a few calls here and there. Would Z3 be able to handle a case like that or does it only like it when you have every input in order?

I'd love to hear your thoughts :) Cheers