Retrieve last generated random value of rand()

README.md

POC: rand latest generated value

DISCLAIMER

Because I'm lazy, this does not work if state->fptr == state->state (the fix is simple).

poc.c

#include <stdlib.h>
#include <stdint.h>
#include <stdio.h>

#define OFFSET_RAND_IN_LIBC 0x3f840
#define OFFSET_UNSAFE_STATE_IN_LIBC 0x1ba5c0

int	main(void) {
	srand(42);

	void *libc_base = (void*)rand - OFFSET_RAND_IN_LIBC;
	struct random_data *state = libc_base + OFFSET_UNSAFE_STATE_IN_LIBC;

	int value = rand();

	printf("extracted value legit = %d\n", value);

	int dark_magic_value = (unsigned)*(state->fptr - 1) >> 1;

	printf("extracted value dark magic = %d\n", dark_magic_value);
}