Skip to content

Latest commit

 

History

History
31 lines (22 loc) · 1.31 KB

README.md

File metadata and controls

31 lines (22 loc) · 1.31 KB

js-rng-state-recovery

Recovery of the internal Xorshift128+ state based on 64/128 consecutive outputs of Math.random() on V8 and SpiderMonkey via Linear Algebra

Usage

Requires Python 3.12+

usage: main.py [-h] [--js-engine JS_ENGINE] [--website WEBSITE] [--amount AMOUNT] [--json-path JSON_PATH]

options:
  -h, --help            show this help message and exit
  --js-engine JS_ENGINE
                        JavaScript engine (v8, spidermonkey)
  --website WEBSITE     Coin flip website (probable, google)
  --amount AMOUNT       Amount of coin flips to predict
  --json-path JSON_PATH
                        Path to json containing the Math.random() outputs

Open the JavaScript console and record 64 (V8) or 128 (SpiderMonkey) Math.random() outputs by running Array.from(Array(64), Math.random) or Array.from(Array(128), Math.random)

Right click, copy the object, and paste it into observations.json or some other specified json path prior to running the program

Examples

Predict 5 coin flips from the google-integrated coin flip on Google Chrome (V8)

python main.py --js-engine=v8 --website=google --amount=5

Predict 15 coin flips from Probable on FireFox (SpiderMonkey)

python main.py --js-engine=spidermonkey --website=probable --amount=15