This question already has an answer here:
- Cracking a linear congruential generator 3 answers
Given one or two sequential Math.random outputs generated with Internet Explorer's linear congruential generator, is it possible to find the seed used in the LCG and find subsequent outputs? Here is the code given on the repo:
const double kdbl2to27 = 134217728.0; uint64 sn; sn = (seed * 25214903917 + 11) & 0x0000FFFFFFFFFFFFull; double res = double((uint)(sn >> 21)); seed = (sn * 25214903917 + 11) & 0x0000FFFFFFFFFFFFull; res += (double)((uint)(seed >> 21)) / kdbl2to27; res /= kdbl2to27;
res is then returned as the Math.random value. I have tried working out the math on reversing the last two lines to get the seed to no avail. I think there's an intuitive bruteforce method I'm missing utilizing the fact that I have two outputs. If it's possible to do with one output that would be nice too.