Exploring Randstorm for Puzzle Solving

Hey everyone, I’d like to share a project I’m working on, which is about using the Randstorm vulnerability to crack a puzzle. Here’s the link to my GitHub repo. https://github.com/Stilichov/Randstorm-for-puzzle So, back between 2010 and 2015, a lot of exchanges and sites were using BitcoinJS-lib v0.1.3 to generate Bitcoin wallets. The problem was that many browsers weren't utilizing window.crypto.random, meaning they were just pulling entropy from Math.random(). In 2015, the Bitcoin Challenge Transaction came around, and those wallets were generated with that math.random() approach. I’m still trying to figure out how to replicate those older, vulnerable math.random() functions that were in use back then. The project is a work in progress, and I’d love to hear your thoughts and suggestions on how to implement those old math.random() functions.

I have already tried all possible timestamps for 32 BTC Puzzle with this method from start_datetime = datetime(2010, 1, 1, 0, 0, 0) end_datetime = datetime(2015, 1, 15, 19, 7, 14) unfortunately, this puzzle was not created with that tool.  But you can try all other BTC addresses that have a positive balance using the same method. Good luck.

I am still working to implement math.random() as it was used in the older version of browsers. Chrome and Firefox had slightly different methods. Do you already have its implementation?

It's very similar to what you did on github. I don't know what I haven't tried in the last 5 years. Thousands of scripts and experiments. Even different random generators from here https://github.com/schmouk/PyRandLib Various variants for random seed. Can you imagine that i  tried UUID - uuid3() , uuid4() , uuid5()  as a random seed ? I even physically turned back time on the PC.

I was try this rng https://github.com/lemire/fastrand And  hi find privkey 2**32 axact ac 2**32 nymbers generated 2**10 exact at 2**10 generated numbers )))))

Anybody know any site that use BitcoinJS-lib in late 2011? Can you show examples?

I don't know about 2011 but here is one from 2013 - 2015 https://web.archive.org/web/20140210085752/https://coinpunk.com/

You can try all possible BTC addresses with this, but I had no luck. Everything has already been hacked that had flaws.