v8-randomness-predictor

Using z3 to predict Math.random in v8

YouTube video

Watch the ✨ YouTube Video

Run Instructions

Get a few Random numbers from v8, run to following code in d8, nodejs or chrome.

Array.from(Array(5), Math.random)

Optionally you can set the random seed in nodejs so you'd get the same numbers as shown below.

/*
* Run nodejs with `--random_seed` flag like
* node --random_seed=1337
*/
Array.from(Array(5), Math.random)
// [0.9311600617849973, 0.3551442693830502, 0.7923158995678377, 0.787777942408997, 0.376372264303491]

Next we feed these random numbers into the python script (line 23).

sequence = [
  0.9311600617849973,
  0.3551442693830502,
  0.7923158995678377,
  0.787777942408997,
  0.376372264303491,
][::-1]

Run the script.

$ python3 main.py

# Outputs
# {'se_state1': 6942842836049070467, 'se_state0': 4268050313212552111}
# 0.23137147109312428

Resources

• Learn z3 by solving simple challenges
• There’s Math.random(), and then there’s Math.random()
• Further scramblings of Marsaglia’s xorshift generators
• (V8 Deep Dives) Random Thoughts on Math.random()
• Hacking the JavaScript Lottery