Pré-Publication, Document De Travail Année : 2026

An Empirical Analysis of CryptGenRandom in Windows XP SP3 and Its Historical Relevance to Bitcoin 0.1.5

Melik Lemariey
  • Fonction : Auteur correspondant
  • PersonId : 1676336

Connectez-vous pour contacter l'auteur

Résumé

This technical report presents a trace-based empirical reconstruction of the CryptGenRandom execution path on Windows XP SP3. The study combines dynamic instrumentation under WinDbg, paired memory captures, controlled injections, and offline replay in Python. It focuses on the Windows-side path through CryptoAPI, the rsaenh provider, and kernel-side KSecDD routines. On the kernel side, the report validates the construction of a 0x258-byte pool, its segmentation into four 0x96-byte blocks, and its consumption by VeryLargeHashUpdate. For captured pools, the offline replay reproduces seedbase_after bit-for-bit. On the provider side, the report documents effective uses of MD4, SHA-1, RC4, a circular buffer, and IOCTL 0x390008. The final provider stage is experimentally closed: observed state20 and aux20 feed a final block replayed offline through SHA-1 compression and 160-bit additions, producing exactly out40. The first 0x20 bytes are then copied into the user buffer returned by CryptGenRandom. The OpenSSL and Bitcoin material is treated separately as historical application context and as an application-level consistency check. It is not the central claim of the report. The main remaining open component is the upstream provider-state mapping from seedbase_after and persistent rsaenh state to state20. The report does not claim a practical attack, key compromise, or complete entropy assessment. Its contribution is a reproducible decomposition of a historical Windows RNG implementation, with explicit separation between observed behavior, bit-exact replayed transformations, partially attributed structures, and open mechanisms.

Fichier principal
Vignette du fichier
AnEmpiricalAnalysisofCryptGenRandominWindowsXP-MelikLemariey.pdf (7.87 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-05611907 , version 1 (05-05-2026)

Licence

Identifiants

  • HAL Id : hal-05611907 , version 1

Citer

Melik Lemariey. An Empirical Analysis of CryptGenRandom in Windows XP SP3 and Its Historical Relevance to Bitcoin 0.1.5. 2026. ⟨hal-05611907⟩

Collections

0 Consultations
0 Téléchargements

Partager

  • More