-=( ---------------------------------------------------------------------- )=- -=( Natural Selection Issue #1 ------------------- Analysis of Common RNGs )=- -=( ---------------------------------------------------------------------- )=- -=( 0 : Contents --------------------------------------------------------- )=- 1 : Introduction 2 : "95-th Harrier from DarkLand" by Techno Rat 3 : "Bolanzo" 4 : "Cab_drop" by Prizzy 5 : "Cargo", "Drol", "Hatred", and "Thunderpick" by Lord Julus 6 : "Chainsaw" by T-2000 7 : "Champagne" by LetahlMind, credited to Griyo 8 : "Crypto" by Prizzy 9 : "CTX Phage", "HPS", "Marburg", "Parvo", and "DHF" by Griyo 10: "29A#5.5_17" by Benny 11: "F0SF0R0" by N.B.K 12: "Fiasko" 13: "FLCSS" 14: "Girigat" by Mister Sandman 15: "Happy99" by Spanska 16: "Nazka" and "Tuereg" by The Mental Driller, and others by Billy 17: "Powerful" 18: "Prizzy" by Prizzy 19: "Sign of the Hammer" and "Undertaker" by Lord Julus 20: Unknown (perhaps Dropper by Bhunji) 21: "Unreal" by Qozah 22: "aid(s)" by mort 23: "Z0mbie" by Z0mbie 24: "Dream" by Prizzy 25: "Rammstein" by Lord Julus 26: "DarkMillenium" by Clau 27: "Sentinel" by Force 28: "RME-32" Engine -=( 1 : Introduction ----------------------------------------------------- )=- During my research for the previous article I went back and had a look at the 200+ sources to windows viruses I have to look at how random number generators were implemented before. I think that you, the readers, might be interested in the results and see how they measure up. If you happen to be one of the authors of one of the below, and you happen to not have scored that well, take heart in 2 ways: - There are only 35 different routines listed here from about 47 different sources. That puts you in the top 25% right away, right? - The tests were anything but scientific. The routines was only run once, the data file produced was quite small (10,000b), and it all happened on my PC, so variations in numbers produced from things like a date change or a different PC speed, were not factored into the statistics. Hey, it took me WAY too long to generate these as is, and I'm not about to spend a month of my life doing something some of you spent maybe 15 minutes on. So if you got a bad stat underservingly, I'm sorry but life is tough - so deal with it. Also, if you're not in here, then I probably don't have the source to your virus. All the sources used were ones previously published in magazines. In any case, the routines varied from great, to good, to down-right shitty. So, on to the routines! -=( 2 : "95-th Harrier from DarkLand" by Techno Rat ---------------------- )=- Entropy = 7.983913 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 221.21, and randomly would exceed this value 90.00 percent of the times. Arithmetic mean value of data bytes is 127.9086 (127.5 = random). Monte Carlo value for Pi is 3.126050420 (error 0.49 percent). Serial correlation coefficient is -0.001399 (totally uncorrelated = 0.0). Random: Push EDx ; Generate some random number Push ECx ; to EAx by border in EAx Push EAx ; (0..Border-1) Mov EAx,RandSeed ; Don't corrupt registers Mov ECx,8088405h ; [from TurboPascal v7.0] Mul ECx ; (Based on Congruent Inc EAx ; generating algorythm) Mov RandSeed,EAx Pop ECx Mul ECx Pop ECx Mov EAx,EDx Pop EDx Ret -=( 3 : "Bolanzo" -------------------------------------------------------- )=- Entropy = 7.979150 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 290.28, and randomly would exceed this value 10.00 percent of the times. Arithmetic mean value of data bytes is 127.6318 (127.5 = random). Monte Carlo value for Pi is 3.183673469 (error 1.34 percent). Serial correlation coefficient is -0.001099 (totally uncorrelated = 0.0). GetRandNb: mov eax,dword ptr [RandNb + X] mul dword ptr [RMul + X] div dword ptr [RDiv + X] mov eax,edx mov dword ptr [RandNb + X],eax ret RMul dd 07FFFFD9h RDiv dd 0FFFFFFFBh -=( 4 : "Cab_drop" by Prizzy --------------------------------------------- )=- Entropy = 3.316664 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 58 percent. Chi square distribution for 10000 samples is 270606.16, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 42.5273 (127.5 = random). Monte Carlo value for Pi is 4.000000000 (error 27.32 percent). Serial correlation coefficient is -0.176257 (totally uncorrelated = 0.0). __rnd_number: in al,40h ;very simple random mov ah,al ;generator intead this in al,41h ;use yours push ax rol eax,16 pop ax xor ax,0A72Fh ret -=( 5 : "Cargo", "Drol", "Hatred", and "Thunderpick" by Lord Julus ------- )=- Entropy = 7.983654 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 227.40, and randomly would exceed this value 75.00 percent of the times. Arithmetic mean value of data bytes is 126.9345 (127.5 = random). Monte Carlo value for Pi is 3.183673469 (error 1.34 percent). Serial correlation coefficient is 0.002391 (totally uncorrelated = 0.0). random32 proc near push ecx xor ecx, ecx mov eax, dword ptr [ebp+seed] mov cx, 33 rloop: add eax, eax jnc $+4 xor al, 197 loop rloop mov dword ptr [ebp+seed], eax pop ecx ret random32 endp seed dd 0BFF81234h -=( 6 : "Chainsaw" by T-2000 --------------------------------------------- )=- Entropy = 6.185658 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 22 percent. Chi square distribution for 10000 samples is 28605.31, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 129.6452 (127.5 = random). Monte Carlo value for Pi is 2.981992797 (error 5.08 percent). Serial correlation coefficient is 0.108172 (totally uncorrelated = 0.0). Random_EAX: PUSH EAX CALL GetTickCount ADD EAX, Random_Init JNP Xor_In_Init RCL EAX, 2 XCHG AL, AH ADD AL, 66h Xor_In_Init: NOT EAX PUSH 32 POP ECX CRC_Bit: SHR EAX, 1 JNC Loop_CRC_Bit XOR EAX, 0EDB88320h Loop_CRC_Bit: LOOP CRC_Bit POP ECX XOR EDX, EDX DIV ECX XCHG EDX, EAX INC EAX ; Can't be zero. ROL Random_Init, 1 ; Adjust random seed. RETN -=( 7 : "Champagne" by LetahlMind, credited to Griyo --------------------- )=- Entropy = 5.722619 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 28 percent. Chi square distribution for 10000 samples is 42180.84, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 123.9728 (127.5 = random). Monte Carlo value for Pi is 3.313325330 (error 5.47 percent). Serial correlation coefficient is 0.002069 (totally uncorrelated = 0.0). get_rnd32 proc push ecx push edx mov eax,dword ptr [ebp+rnd32_seed] mov ecx,eax imul eax,41C64E6Dh add eax,00003039h mov dword ptr [ebp+rnd32_seed],eax xor eax,ecx pop edx pop ecx ret get_rnd32 endp Entropy = 5.828195 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 27 percent. Chi square distribution for 10000 samples is 37180.80, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 125.9952 (127.5 = random). Monte Carlo value for Pi is 3.001200480 (error 4.47 percent). Serial correlation coefficient is 0.041824 (totally uncorrelated = 0.0). get_rnd32f proc push ecx push edx mov eax,dword ptr [ebp+rnd32_seedfast] mov ecx,eax imul eax,41C64E6Dh add eax,02F4D527h mov dword ptr [ebp+rnd32_seedfast],eax xor eax,ecx pop edx pop ecx ret get_rnd32f endp -=( 8 : "Crypto" by Prizzy ----------------------------------------------- )=- Entropy = 6.995293 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 12 percent. Chi square distribution for 10000 samples is 15256.19, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 125.2733 (127.5 = random). Monte Carlo value for Pi is 3.255702281 (error 3.63 percent). Serial correlation coefficient is -0.002544 (totally uncorrelated = 0.0). ppe_get_rnd32: push ebx ecx edx ;my special algorithm to mov eax,[ebp+poly_seed] ;calculate a random number mov ecx,41C64E6Dh ;for Win32 mul ecx xchg eax,ecx call [ebp+ddGetTickCount] mov ebx,eax db 0Fh, 31h ;RDTCS instruction - read xor eax,ebx xchg ecx,eax ;PCs ticks to EDX:EAX mul ecx add eax,00003039h mov [ebp+poly_seed],eax pop edx ecx ebx ret -=( 9 : "CTX Phage", "HPS", "Marburg", "Parvo", and "DHF" by Griyo ------- )=- Entropy = 7.999973 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 0.38, and randomly would exceed this value 99.99 percent of the times. Arithmetic mean value of data bytes is 127.4760 (127.5 = random). Monte Carlo value for Pi is 3.157262905 (error 0.50 percent). Serial correlation coefficient is 0.016660 (totally uncorrelated = 0.0). get_rnd32: push ecx push edx mov eax,dword ptr [ebp+rnd32_seed] mov ecx,41C64E6Dh mul ecx add eax,00003039h and eax,7FFFFFFFh mov dword ptr [ebp+rnd32_seed],eax pop edx pop ecx ret -=( 10: "29A#5.5_17" by Benny -------------------------------------------- )=- Entropy = 6.576315 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 17 percent. Chi square distribution for 10000 samples is 19513.98, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 123.0033 (127.5 = random). Monte Carlo value for Pi is 3.291716687 (error 4.78 percent). Serial correlation coefficient is -0.128785 (totally uncorrelated = 0.0). Random_EAX: PUSH ECX ; Save registers that get PUSH EDX ; changed. PUSH EAX ; Save Max_Val. CALL GetTickCount ; Get random value. MOV ECX, Random_Seed ; Get random seed. ADD EAX, ECX ; Adjust random value with ; random seed. ROL ECX, 1 ; Adjust random seed. ADD ECX, 666h MOV Random_Seed, ECX ; Perform CRC-32 on semi-random number ; to obtain a truely random number. PUSH 32 POP ECX CRC_Bit: SHR EAX, 1 ; Bit is set? JNC Loop_CRC_Bit XOR EAX, 0EDB88320h Loop_CRC_Bit: LOOP CRC_Bit ; Do all 32 bits. POP ECX ; ECX = Max_Val. XOR EDX, EDX ; Divide truely random value DIV ECX ; by Max_Val. XCHG EDX, EAX ; Remainder is the ; random-in-range number. OR EAX, EAX ; Test for zero. POP EDX POP ECX RETN -=( 11: "F0SF0R0" by N.B.K ----------------------------------------------- )=- Entropy = 7.999973 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 0.38, and randomly would exceed this value 99.99 percent of the times. Arithmetic mean value of data bytes is 127.4808 (127.5 = random). Monte Carlo value for Pi is 3.188475390 (error 1.49 percent). Serial correlation coefficient is 0.016589 (totally uncorrelated = 0.0). rnd proc pushad mov eax,dword ptr [ebp+seed] mov ecx, 41C64E6Dh mul ecx add eax, 00003039h and eax, 7FFFFFFFh mov dword ptr [ebp+seed],eax mov dr0,eax popad mov eax,dr0 ret seed dd 'FUCK' rnd endp -=( 12: "Fiasko" by mort ------------------------------------------------- )=- Entropy = 5.797739 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 27 percent. Chi square distribution for 10000 samples is 41074.15, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 30.9206 (127.5 = random). Monte Carlo value for Pi is 4.000000000 (error 27.32 percent). Serial correlation coefficient is 0.020574 (totally uncorrelated = 0.0). @random: push ecx pushf in eax,040h and eax,03fh mov ecx,eax inc ecx xor ch,bh @delay: loop @delay popf jc @hops and eax,07 @hops: pop ecx ret -=( 13: "FLCSS" ---------------------------------------------------------- )=- Entropy = 7.982929 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 236.42, and randomly would exceed this value 75.00 percent of the times. Arithmetic mean value of data bytes is 127.7182 (127.5 = random). Monte Carlo value for Pi is 3.135654262 (error 0.19 percent). Serial correlation coefficient is 0.146776 (totally uncorrelated = 0.0). GetRand PROC NEAR push ecx push edx mov eax,[Rand @] xor edx,edx mov ecx,7FFFFFFF mul ecx inc eax mov ecx,0FFFFFFFBh div ecx mov eax,edx mov [Rand @],eax pop edx pop ecx ret GetRand ENDP -=( 14: "Girigat" by Mister Sandman -------------------------------------- )=- Entropy = 5.722561 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 28 percent. Chi square distribution for 10000 samples is 42188.77, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 123.9664 (127.5 = random). Monte Carlo value for Pi is 3.313325330 (error 5.47 percent). Serial correlation coefficient is 0.002559 (totally uncorrelated = 0.0). get_random: push ecx edx mov eax,dword ptr [ebp+random_seed] mov ecx,eax imul eax,41c64e6dh add eax,3039h mov dword ptr [ebp+random_seed],eax xor eax,ecx pop edx ecx ret -=( 15: "Happy99" by Spanska --------------------------------------------- )=- Entropy = 6.999987 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 12 percent. Chi square distribution for 10000 samples is 10000.36, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 128.4872 (127.5 = random). Monte Carlo value for Pi is 3.123649460 (error 0.57 percent). Serial correlation coefficient is 0.021893 (totally uncorrelated = 0.0). random: mov eax, 214013h imul seed sub edx, edx add eax, 2531011h mov seed, eax ret -=( 16: "Nazka" and "Tuereg" by The Mental Driller, and others by Billy -- )=- Entropy = 7.979183 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 286.08, and randomly would exceed this value 10.00 percent of the times. Arithmetic mean value of data bytes is 126.3669 (127.5 = random). Monte Carlo value for Pi is 3.157262905 (error 0.50 percent). Serial correlation coefficient is 0.000334 (totally uncorrelated = 0.0). random proc push ecx mov eax,dword ptr [ebp+rnd_seed1] dec dword ptr [ebp+rnd_seed1] xor eax,dword ptr [ebp+rnd_seed2] mov ecx,eax rol dword ptr [ebp+rnd_seed1],cl add dword ptr [ebp+rnd_seed2],eax adc eax,dword ptr [ebp+rnd_seed2] add eax,ecx ror eax,cl not eax sub eax,3 xor dword ptr [ebp+rnd_seed2],eax xor eax,dword ptr [ebp+rnd_seed3] rol dword ptr [ebp+rnd_seed3],1 sub dword ptr [ebp+rnd_seed3],ecx sbb dword ptr [ebp+rnd_seed3],4 inc dword ptr [ebp+rnd_seed2] pop ecx ret random endp -=( 17: "Powerful" ------------------------------------------------------- )=- Entropy = 7.999973 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 0.38, and randomly would exceed this value 99.99 percent of the times. Arithmetic mean value of data bytes is 127.5048 (127.5 = random). Monte Carlo value for Pi is 3.001200480 (error 4.47 percent). Serial correlation coefficient is 0.050657 (totally uncorrelated = 0.0). random_any_edx: mov edx,0fffffffeh random_edx: push eax ebx edx call init_rnd_proc cell_for_rnd_number dd 0100h init_rnd_proc: pop ebx imul eax,dword ptr [ebx],4dh inc eax mov dword ptr [ebx],eax pop ebx inc ebx xor edx,edx or ebx,ebx jz quit_from_rnd div ebx ;EDX:EAX / EBX -> EAX:EDX quit_from_rnd: pop ebx eax retn -=( 18: "Prizzy" by Prizzy ----------------------------------------------- )=- Entropy = 7.983739 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 221.06, and randomly would exceed this value 90.00 percent of the times. Arithmetic mean value of data bytes is 126.7564 (127.5 = random). Monte Carlo value for Pi is 3.176470588 (error 1.11 percent). Serial correlation coefficient is -0.005314 (totally uncorrelated = 0.0). ppe_get_rnd32: push ebx mov ebx,dword ptr [ebp+rnd_last-virus_start] in al,40h xor bl,al in al,41h add bh,al rol ebx,13 in al,41h xor bl,al in al,42h sub bh,al rol ebx,11 xor ebx,eax xor ebx,ecx xor ebx,edx xor ebx,esp xor ebx,esi xor ebx,edi xor ebx,ebp mov dword ptr [ebp+rnd_last-virus_start],ebx mov eax,ebx pop ebx ret -=( 19: "Sign of the Hammer" and "Undertaker" by Lord Julus -------------- )=- Entropy = 7.895734 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 1 percent. Chi square distribution for 10000 samples is 1450.52, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 127.2381 (127.5 = random). Monte Carlo value for Pi is 3.034813926 (error 3.40 percent). Serial correlation coefficient is -0.214502 (totally uncorrelated = 0.0). random32 proc near call random16 shl eax, 10h random16: push ebx xor bx, 0F00Dh in al, 40h xor bl, al in al, 42h add bh, al in al, 41h sub bl, al in al, 41h xor bh, al in al, 42h add bl, al in al, 40h sub bh, al xchg bx, ax pop ebx ret random32 endp -=( 20: Unknown (perhaps Dropper by Bhunji) ------------------------------ )=- Entropy = 7.979564 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 295.60, and randomly would exceed this value 5.00 percent of the times. Arithmetic mean value of data bytes is 127.6108 (127.5 = random). Monte Carlo value for Pi is 3.116446579 (error 0.80 percent). Serial correlation coefficient is 0.171004 (totally uncorrelated = 0.0). Random proc RndMax:dword local time:SYSTEMTIME push ebx push edx mov eax,RndMax inc eax mov ebx,eax lea eax,time invoke GetLocalTime, eax mov ax,time.wMilliseconds shl eax,16 mov ax,time.wSecond rol ax,8 or ax,time.wMinute rol ax,16 or ax,time.wHour add eax,RandomNumber rol eax,cl add eax,14 xor ecx,46 ror eax,cl add RandomNumber,eax cmp ebx,0 jz NoMod xor edx,edx div ebx xchg eax,edx NoMod: pop edx pop ebx ret Random endp -=( 21: "Unreal" by Qozah ------------------------------------------------ )=- Entropy = 7.940431 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 841.24, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 128.9338 (127.5 = random). Monte Carlo value for Pi is 3.063625450 (error 2.48 percent). Serial correlation coefficient is 0.026059 (totally uncorrelated = 0.0). GetRandomNumber: push ecx mov ax,word ptr ds:[Miliseconds+ebp] xor ax,1264h RndVal equ $-2 mov cx,ax add ax,word ptr ds:[Second+ebp] xor ax,word ptr ds:[Miliseconds+ebp] rol ax,1 add cx,ax xor word ptr ds:[RndVal+ebp],ax ror ax,7d add ax,cx add ax,word ptr ds:[Miliseconds+ebp] rol ax,4d xor cx,ax sub ax,word ptr ds:[RndVal+ebp] ror ax,3d add word ptr ds:[RndVal+ebp],ax mov word ptr ds:[Miliseconds+ebp],ax add ax,cx rol ax,11d pop ecx ret -=( 22: "aid(s)" by mort ------------------------------------------------- )=- Entropy = 7.693583 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 3 percent. Chi square distribution for 10000 samples is 3972.22, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 136.7535 (127.5 = random). Monte Carlo value for Pi is 3.034813926 (error 3.40 percent). Serial correlation coefficient is -0.017482 (totally uncorrelated = 0.0). @gr: mov eax,[_seed] rol eax,3 xor eax,[_seed] adc [_seed],eax mov ebx,eax sbb eax,[_seed] and eax,0fffffffh @grl: cmp eax,[esp + 4] jl @grDone sub eax,[esp + 4] xor [_seed],eax jmp @grl @grDone: ret 4 -=( 23: "Z0mbie" by Z0mbie ----------------------------------------------- )=- Entropy = 7.977857 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 307.48, and randomly would exceed this value 2.50 percent of the times. Arithmetic mean value of data bytes is 127.9662 (127.5 = random). Monte Carlo value for Pi is 3.080432173 (error 1.95 percent). Serial correlation coefficient is -0.408597 (totally uncorrelated = 0.0). random: call random16bit shl eax, 16 random16bit:push ebx mov bx, 1234h rndword equ word ptr $-2 in al, 40h xor bl, al in al, 40h add bh, al in al, 41h sub bl, al in al, 41h xor bh, al in al, 42h add bl, al in al, 42h sub bh, al mov rndword[ebp], bx xchg bx, ax pop ebx test al, 1 ret -=( 24: "Dream" by Prizzy ------------------------------------------------ )=- Entropy = 7.981948 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 245.73, and randomly would exceed this value 50.00 percent of the times. Arithmetic mean value of data bytes is 128.0532 (127.5 = random). Monte Carlo value for Pi is 3.130852341 (error 0.34 percent). Serial correlation coefficient is -0.003105 (totally uncorrelated = 0.0). random: mov eax,0BFF71234h push ecx 33 pop ecx @@r: add eax,eax jnc $+4 xor al,197 loop @@r mov [ebp+random+1-poly_engine],eax pop ecx ret -=( 25: "Rammstein" by Lord Julus ---------------------------------------- )=- Entropy = 3.783164 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 52 percent. Chi square distribution for 10000 samples is 258066.00, and randomly would exceed this value 0.01 percent of the times. Arithmetic mean value of data bytes is 49.1364 (127.5 = random). Monte Carlo value for Pi is 3.997599040 (error 27.25 percent). Serial correlation coefficient is 0.270153 (totally uncorrelated = 0.0). random32 proc ;this is a random nr push edx ;generator. It's a call [ebp+_GetTickCount] ;modified version of rcl eax, 2 ;some random gen I found add eax, 12345678h ;someday and it had random_seed = dword ptr $-4 ;some flaws I fixed... adc eax, esp ; xor eax, ecx ; xor [ebp+random_seed], eax ; add eax, [esp-8] ; rcl eax, 1 ; pop edx ; ret ; random32 endp ; -=( 26: "DarkMillenium" by Clau ------------------------------------------ )=- Entropy = 7.984645 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 213.89, and randomly would exceed this value 95.00 percent of the times. Arithmetic mean value of data bytes is 127.6328 (127.5 = random). Monte Carlo value for Pi is 3.243697479 (error 3.25 percent). Serial correlation coefficient is 0.211992 (totally uncorrelated = 0.0). get_rnd proc push bx xor bx, ax xor bx, cx xor bx, dx xor bx, sp xor bx, bp xor bx, si xor bx, di in al, 40h xor bl, al in al, 40h add bh, al in al, 41h sub bl, al in al, 41h xor bh, al in al, 42h add bl, al in al, 42h sub bh, al xchg bx, ax pop bx ret get_rnd endp -=( 27: "Sentinel" by Force ---------------------------------------------- )=- Entropy = 7.985640 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 196.84, and randomly would exceed this value 99.50 percent of the times. Arithmetic mean value of data bytes is 127.8283 (127.5 = random). Monte Carlo value for Pi is 3.104441777 (error 1.18 percent). Serial correlation coefficient is 0.003077 (totally uncorrelated = 0.0). GET_RANDOM_NUMBER proc push eax ebx lea eax, [ebp + AGetTickCount] call GETAPI lea ebx, [ebp + random_number] ; EBX = pointer to random_number mul dword ptr [ebx] ; Multiply previous miliseconds with sbb edx,eax ; Add low-order word of 32-bit random cmc ; Complement carry flag adc [ebx],edx ; Store 32-bit random number pop ebx eax ret GET_RANDOM_NUMBER endp -=( 28: "RME-32" Engine -------------------------------------------------- )=- Entropy = 7.999973 bits per byte. Optimum compression would reduce the size of this 10000 byte file by 0 percent. Chi square distribution for 10000 samples is 0.38, and randomly would exceed this value 99.99 percent of the times. Arithmetic mean value of data bytes is 127.4712 (127.5 = random). Monte Carlo value for Pi is 3.157262905 (error 0.50 percent). Serial correlation coefficient is 0.031546 (totally uncorrelated = 0.0). @@random: mov eax, randseed ; standard PASCAL's algorithm imul eax, 214013 add eax, 2531011 mov randseed, eax retn -=( ---------------------------------------------------------------------- )=- -=( Natural Selection Issue #1 --------------- (c) 2002 Feathered Serpents )=- -=( ---------------------------------------------------------------------- )=-