java-prng-predict/PredictJavaRandom.java at master · giuliocandre/java-prng-predict · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
/*
 * Java PRNG Cracker with finite range
 * This PoC is devised to predict pseudo-random number generated by Java's Random.nextInt(RANGE) function
 * RANGE must be an even number
 * To use this PoC, change the value of RANGE at line 52 and fill the array 'results' at line 55
 * The array 'results' shall contain the observed numbers generated from your PRNG.
 *
 */
import java.util.Random;

public class PredictJavaRandom {

    public static int RANGE;

    private static long bruteL18(int[] results) {
        for (int i=0; i<262144; i++) {
            //System.out.println("Testing seed: "+i);
            Random renzo = new Random(i);
            for (int j=0; j<results.length; j++) {
                int output = renzo.nextInt(RANGE);
                if (output % 2 != (results[j]%2))
                    break;
                if (j == results.length-1)
                    return i;

            }
        }
        return -1;
    }

    private static long bruteSeed(int[] results, long lowerBits) {
        long x=0;
        long seed=lowerBits;
        for (x=0;x<1073741824;x++) {
            seed = (x << 18) | lowerBits;
            Random test = new Random(seed);
            for (int j=0; j<results.length; j++) {
                int out = test.nextInt(RANGE);
                boolean check = (out == results[j]);
                if (!check) break;
                if (j == results.length - 1) return seed;
            }
        }
        return -1;
    }


    public static void main(String[] args) {
        // Modify these two

        //range of the PRNG
        RANGE = 62;

        // sequence of random observed numbers
        int[] results = {26, 1, 57, 6, 61, 40, 27, 31, 16, 59, 32, 22, 36, 52, 16, 17};

        long lowerBits = bruteL18(results);
        System.out.println("Lower 18 bits of initial seed:" + Long.toBinaryString(lowerBits) + " = " + lowerBits);
        long seed = bruteSeed(results, lowerBits);
        if (seed < 0) {
            System.out.println("Seed bruteforce failed! Try with more observations..");
            System.exit(0);
        }
        System.out.println("Total seed:" + Long.toBinaryString(seed) + " = " + seed);


        System.out.println("Generated numbers (observed ones + next 10):");

        Random rand = new Random(seed);
        for (int k=0;k<results.length+10;k++) {
            int out = rand.nextInt(RANGE);
            System.out.println("Result: "+out);
        }

    }
}