This is the 4th challenge in ‘Tolddler’s Bottle’ in pwnable.kr. The ‘rand()’ function is supposed to generate pseudo-random numbers when a seed is given. The thing with psuedo-random number generators (PRNG, such as rand()) is that they provide deterministic outputs for a given seed. Usually, ‘stdlib.h’ is required to properly declare rand(). The given code does not contain it - hence a compiler warning is raised.

Then how does rand() work? If the linker can correctly match it during the runtime, rand() runs. In fact since the implicit assumption of a function call matches rand() implementation (the output is int and the function call is rand(void)), it runs. However, in the process, the seed does not change. The results is the random value is the same each time (not random!). This value can be obtained as below.

The goal is to uncover the flag by using the correct key. In this case, \(\mathrm{key} \oplus \mathrm{random} = \mathtt{0xcafebabe}\) \(\mathrm{key} = \mathtt{0xcafebabe} \oplus \mathrm{random}\)

This is because, XOR operation’s identity property (XOR’ing the same variable is just unit). The returned value is 0xa175ffd9. We are supposed to provide a decimal as the input to the program. However, a caveat is that although the key is initially declared as an ‘unsigned int’, the ‘scanf’ reads the input as a ‘signed int’ (‘%d’). The decimal of the previous 0xa175ffd9 is 2708864985. This is larger than the max. positive for 32-bit signed integers. If we use an online tool like ‘rapidtables’(https://www.rapidtables.com/convert/number/hex-to-decimal.html), it shows the 2’s complement of an input value as well. In this case, the 2’s complement of 2708864985 is -1586102311. The ‘scanf’ function would store the value corresponding to the 2’s complement of -1586102311, if we give it as the input to the program. Also, this value is in range of the 32 bit signed ints. This reminds me of something one of my instructors said; “The bits do not have any inherent meaning, but the meaning we give them”. Giving this negative value as the input to the program will reveal the flag.