search

altf4 / untwister

Seed recovery tool for PRNGs
GNU General Public License v3.0
367 stars 42 forks source link

Support for typical php mt_rand default seeds: #24

Open altf4 opened 9 years ago

altf4 commented 9 years ago

PHP apps that implicitly seed their mt_rand do so according to the algorithm here:

http://lxr.php.net/xref/PHP_5_4/ext/standard/php_rand.h#46

#define GENERATE_SEED() (((long) (time(0) * getpid())) ^ ((long) (1000000.0 * php_combined_lcg(TSRMLS_C))))

There's not a whole lot of entropy in the unix timestamp of the server start plus PID. This would make breaking PHP apps that use implicit seeding a lot easier.

altf4 commented 9 years ago

On my Linux system, pid_max is 32768:

cat /proc/sys/kernel/pid_max
32768

We might be able to safely include all possible PIDs, or maybe just some on the lower end. 32k isn't that many.

time(0) can be limited to a reasonably likely window, too. Maybe just the last year or so.