i'm sorry if this is in the wrong place, but i'm trying to find out how i could possibly make a pin generator. the pin in question is 20 digits, numbers and letters. it is for a pre-paid card. let's say i can get 2 or more of these pins (real ones) and then use those to find a pattern or what not. how exactly would i do this and how do people actually make pin generators?

LoL

20 digits. That's only 36^20 (13,367,494,538,843,734,067,838,845,976,576) permutations. Of course, not all are valid.

You'll probably need to gather a couple hundred PINs to start seeing a pattern.

I would start looking at extending the data set by applying a coordinate reconstruction strategy... That is to say you map "virtual" coordinates based on your samples.

So lets say your pin is GnpyiN2uTDzx1QvW05oU, we split it into groups of 5 and plot those 4 groups of 5 digits into a 4 dimensional space. You think it's gonna get hairy? You bet.

W1=Gnpyi, X1=N2uTD, Y1=zx1Qv Z1=W05oU

We'll call the W series your "time" value. Plot your thousands of PINs into this type of grid system (You might need to whip up an OpenGL visualization engine) and see if you notice any neato patterns. Yeah, you'll need to convert your letters/numbers into a number.

Chances are you won't see anything meaningful. So alter your plotting scheme. Again and again and again. Eventually, you'll find a pattern: http://www.doxpara.com/pics/index.php?album=phentropy/

We use this technique to discover that the Pseudo Random Number Generator used in most operating systems is horribly predictable. Actually, most sources of "random" data follow a pretty basic pattern.

http://www.scholarpedia.org/article/...Reconstruction http://en.wikipedia.org/wiki/Attractor

Basically, let's just say your task isn't easy. Hell, they might not even use a system vulnerable to this type of attack.

It might be extremely easy too, though. It could be sequential.

Good luck!

well the pre-paid card is for a free online game, allowing you to use "cash items" that you would normally buy, so i doubt they're going to be extremely precautious with the pin generation. it's not like i'm trying to steal windows vista. but i dunno if this is worth doing now, it sounds way beyond me. i can admit when i'm beat.

Kudos to you. That is one of the best responses I've ever seen in this forum.

use a proxy coz thell red flag ur ip after about 3-20 attemts

like how pre paid phone cards dont let u enter codes 4 ages if u fuck it up 2 many times

ok a little update. this is a completely different story now, but i didn't feel like making a new thread. i'm in possession of 6 pins, all are legit, EXCEPT they don't work on the website because they were never activated by the cashier. therein lies the problem. i'm wondering if anyone knows exactly what happens to the card information when it is scanned and "purchased", and if there's any way for me to send that info to the server myself.

i'm assuming the way it works is it sends the card's transaction number to the game's web server and records it as purchased. the store probably has their own permissions for sending data and are recognized as a seller of these cards, so the data goes in with no problem.

so, now the issue becomes more of hacking than number generating. anyone have any thoughts on this?



btw, thank you for whoever replied to my op, that was very informative.

bump...anybody?

OK.

Lets assume the system works like this>

The cards hold PRNG'd numbers. Each is, we assume, unique.

At this point, you buy it. The POS system at the shop takes some data from a bar code on the back of it or attached to it. If we assume that this is not a 2d barcord, then there can only be a specific number of bytes of data held in the barcode, certainly less than there are possible key values.

So, here is the first question: if you DON'T get the card authourised, then it doesn't work. However, the barcode can't hold as many values as the card is capable of.

This leaves a few options:

1) There is a sub-sequence in the card for example, the middle 12 character or something ) that is unique, and the rest of digits are just fillers

2) That some form of hash exists of the code on the card that CAN be held on the bar code

3) Something else is happening.

My money is on 3) because I think I'm missing something simple.

After that, once you have found the "key", you should be in a position for code up a sequence generator that allows you to pre-calculate more in the same sequence.

For example, there would probably be a sequence for £10 cards, £20 cards etc.

After that, you have the real work of actually writing the systerm and missing all the IV's, in this case a collision would be one that is already activeated at the POS AND has been used.

Rip

Number plane? Scatter plot?...

Uhhh, not quite. But that's the idea. Plot the numbers in a way and a pattern might result. Stephen Wolfram's "A New Kind of Science" covers it a bit concerning PRNGs, as does Michal Zalewski's "Silence on the Wire".

"Dissonant numbers: an analysis of pseudo-random sequences" by Jonathan E. Magen and Altan Orhon

http://lcamtuf.coredump.cx/newtcp/ has some more graphics relating to PRNG and TCP/IP Sequence Number analysis. Your pins are probably based on similar concepts.

Math is fun... lol