mt

mt生成

对我来说这是比较复杂的算法，我参考了harry，lazzaro，badmonkey，justgo12等大佬的博客也没搞懂，下面记录我能理解的部分。

在讨论之前，引入MT19937-32的生成python代码：（此代码在 [0,2^32-1] 生成的伪随机数基本大致相同）

def _int32(x):
    return int(0xFFFFFFFF & x)
 
class MT19937:
    # 根据seed初始化624的state
    def __init__(self, seed):
        self.mt = [0] * 624
        self.mt[0] = seed
        self.mti = 0
        for i in range(1, 624):
            self.mt[i] = _int32(1812433253 * (self.mt[i - 1] ^ self.mt[i - 1] >> 30) + i)
 
    # 提取伪随机数
    def extract_number(self):
        if self.mti == 0:
            self.twist()
        y = self.mt[self.mti]
        y = y ^ y >> 11
        y = y ^ y << 7 & 2636928640
        y = y ^ y << 15 & 4022730752
        y = y ^ y >> 18
        self.mti = (self.mti + 1) % 624
        return _int32(y)
 
    # 对状态进行旋转
    def twist(self):
        for i in range(0, 624):
            y = _int32((self.mt[i] & 0x80000000) + (self.mt[(i + 1) % 624] & 0x7fffffff))
            self.mt[i] = (y >> 1) ^ self.mt[(i + 397) % 624]
 
            if y % 2 != 0:
                self.mt[i] = self.mt[i] ^ 0x9908b0df

接下来，我们观察上面MT19937的代码，我们可以发现代码分为四个部分：
一、_int32(x)模块

返回一个32位的二进制代码。

二、**init**(self, seed):

首先，我们必须要知道seed在代码中是种子，意思是基于已知的seed生成624个state块（伪随机数通过对不同的state块进行变换求得），我们先将state的第一个数值定为seed，代码中的623个循环便是通过state间的变换求出求出剩下的state块。

三、extract_number(self)

MT19937算法通过此模块来得到不同的伪随机数。首先，我们先进行判断，如果此时self.mti指向第一个state，我们运行__init__(self, seed):得到623个state值，如果不是，则直接进入下面的伪随机数生成过程：用通过seed求得的state值进行代码中的变换求得并返回我们所需的伪随机数。

四、twist(self):

如果只有上面的块，那么只能求得624个不同的伪随机数，但是MT19937-32却可以求出2^32-1个不同的伪随机数便是因为这个模块。旋转模块基于上一次循环中我们已经使用过的624个state值，一一对应，通过原代码中的：

y = _int32(([self.mt](http://self.mt/)[i] & 0x80000000) + ([self.mt](http://self.mt/)[(i + 1) % 624] & 0x7fffffff))
[self.mt](http://self.mt/)[i] = (y >> 1) ^ [self.mt](http://self.mt/)[(i + 397) % 624]

if y % 2 != 0:
[self.mt](http://self.mt/)[i] = [self.mt](http://self.mt/)[i] ^ 0x9908b0df

求得新的624个与上一次循环中不同的state值，并进入新的循环中。

这是2023nkctf的real_MT

import random
import signal

def guess_number_1():
    randoms = []
    for _ in range(208):
        randoms.append(random.getrandbits(96))

    print("randoms = "+str(randoms))
    number = str(random.getrandbits(96))
    guess = str(input("Guess after number:"))
    if guess != number:
        print("Wrong Number! Guess again.")
        exit(0)

def guess_number_2():
    number = str(random.getrandbits(96))
    randoms = []
    for _ in range(627):
        randoms.append(random.getrandbits(32))

    print("randoms = "+str(randoms))
    guess = str(input("Guess pre number:"))
    if guess != number:
        print("Wrong Number! Guess again.")
        exit(0)

def guess_number_3():

    def _int32(x):
        return int(0xFFFFFFFF & x)  
    def init(seed):
        mt = [0] * 624
        mt[0] = seed
        for i in range(1, 624):
            mt[i] = _int32(1812433253 * (mt[i - 1] ^ mt[i - 1] >> 30) + i)
        return mt[-1]
    number = random.getrandbits(32)
    print("last number = "+ str(init(number)))
    guess = int(str(input("Guess seed number:")))
    if guess != number:
        print("Wrong Number! Guess again.")
        exit(0)

def guess_number_4():
    def extract_number(y):
        y = y ^ y >> 11
        y = y ^ y << 7 & 2636928640
        y = y ^ y << 15 & 4022730752
        y = y ^ y >> 18
        return y&0xffffffff

    number = random.getrandbits(32)
    print("extract number = "+ str(extract_number(number)))
    guess = int(str(input("Guess be extracted number:")))
    if guess != number:
        print("Wrong Number! Guess again.")
        exit(0)
    

print("Welcome to the Mersenne Twister basic challenge. Please try to solve 20 challenges in 60 seconds.")
signal.alarm(60)

for i in range(20):
    print("Round: "+str(i+1))
    random.choice([guess_number_1,guess_number_2,guess_number_3,guess_number_4])()
    print("Good job!")

flag = open('/flag').read()
print("Congratulations on passing the challenge. This is your flag: " + str(flag))

guess1部分（预测）

解法1

输出208个96位数，让预测下一位，下面给出两种代码

第一种在la神的博客里提到过github的ExtendMT19937Predictor 直接调用

只要修改randoms的元素即可

from extend_mt19937_predictor import ExtendMT19937Predictor

randoms = [55015607074857799292945552290, 49368042755482977011736956173, 40475374240531115107595906636, 52147615048581670023735755450, 13432490767545507105189747763, 24440678017972777884814646255, 32822903152999092153407655597, 8563483583446603233686286354, 75732019275746461853540401495, 36842332206659125653150736486, 76786413054424156228987909265, 78728868918063155711331208027, 68111503649325447384558973315, 50046539350414059782746722603, 33122956341131312047186478550, 47134379833914353599100802574, 14506941828436962820850816482, 16254006011206386851511190777, 53774746810651233261166083709, 57317412206054586514985875280, 43011044274622942766585189176, 21510983328491776879720475647, 68805188235988349436606490157, 68293687378252177576750854213, 64020092712881170155616652147, 58788852915482172394398327520, 20534731592145885333097885636, 71497885157511490073528334436, 50079126675284942137464435871, 16433905363688130336892639414, 10833644831894048938957163773, 61837597918870726435017132850, 50007378472767284514600652443, 13242758280359098364681702807, 48040447462883040840110279722, 48653833299736009023667402599, 61877052829753339768672826777, 55104138447302791542841950167, 59956782054709979669719351421, 33622933736356173639796248572, 70720508316358691710097244967, 26438465850133558815351580879, 12121649600344247919530245458, 59429702128155774929559418436, 8461855977540480946850517835, 35371049050859796434557316156, 74900517442122255478113670139, 56015804116725775644082181473, 54019918704797178896937181953, 46449490759360975867530830160, 21716938523285444592131111037, 4075915261354769937217394891, 71101712150556394609286976122, 77514446308635805069858161218, 30443551680738939325710619401, 51330659874633330020137362887, 16870162608087608659692436972, 36332661698483296611490764287, 38912147134106871206560383319, 66798268847122499800706103042, 241691625661529797405764102, 9680620382995429570437419894, 54281462677774536994926184946, 49156921844074280073449443668, 47003617901112210542122896375, 20630134319865926707841141605, 38539127713936043329828502512, 37765649689660950654295018296, 27519165366018178520157118526, 47311700897513991864703815914, 14844131572803548743566512704, 72315716735652440986087523229, 46411344686639197025534075618, 13959184897278020398348948659, 2079854302954576073339089565, 39428786840574943257095970633, 33458396202396229906230251418, 69814672396568547483000493475, 28451062576030293943028542769, 3150653107998963723272095718, 20792548261825482531270352147, 69131192563757378564191442243, 73581103283131546986544846269, 32168289412017414311931877308, 55734763237596421172118618970, 37808961718727478136990696303, 22904874676153031620664377715, 9794575345156074603503087671, 22456694023771898844190118878, 49901970266243771395136385496, 63113371794658901555756959046, 68738124366682093927457951250, 23306235486349427954282639191, 43594485853233707551383467628, 50747180681744235554964992870, 49862479356739272497472347214, 38434690316151369964072773399, 71467050353277898958372067109, 55346669078871118497310884600, 46017420217054938248863989011, 75363033386622698885356870859, 10369764848153462639554152052, 75890142526899080264345852084, 9535759402085584783757952808, 43522044721852245514275493334, 12464589274296723227328792626, 78676543113595295732206638118, 60116759495604753189426160756, 69969854635185954403204801589, 15244509737688480815229679004, 36868877814286665666603704724, 25296352719228197917967642599, 27714369660917369969714529637, 7673110772037676634707790378, 66678444104365177982652169620, 46842636677378560041798283187, 10144943294980146082555306558, 28284306659807251586984133000, 33490472759408013029651749585, 77977414783931140205233073617, 69530485613806297267022583522, 76520003652664840680181807019, 46932273878708136776868709933, 55587849334378587663972698777, 288744469797385122841458086, 41277555669463912046072519012, 4464200409916053651301885032, 40054592246599648525169317693, 19475356311294822865721674381, 78967801470334524961687238739, 75822644069771873149506932458, 43938875242093048649223251016, 38961281929520042194905361090, 21610082723530059512385550253, 57418757224608120261793422587, 72515591359993311229453026924, 53301906528555214119355718384, 62399938403321209620318734938, 29562948809863356281824237526, 64690511731475499536620402074, 61422219087048013104282624678, 20023299367896362817857259034, 1531978217124909227300934212, 8362602216400318325888882470, 75999045381397120509496119808, 24819648371744754442222408890, 75932237139374495603284677727, 11591629473858684168400446684, 75483926784518263475169289687, 55768847294454228602227998151, 35105596201056028460562538709, 48075470868361149890782793466, 68011918805791011054681166147, 71379711286148023971490418355, 5119093941579935754141497093, 53547827525583375748301266038, 8537501347007365109158293206, 49644668676789081527660032954, 22515713345276622847996100404, 55307392324473859445909519983, 10994480124121534718832780851, 65533932078012255426667262659, 43392581419477495155490691253, 6149858215235626580350564774, 11427015895083257860925651246, 1213227811506969183950341669, 35938550903795041826608209051, 73091816395793401072374399076, 12197443447940928492569868668, 25301621853357018223709312786, 5689796934241659738266713001, 2613230292238434599188292344, 42124474617992669523056747325, 35194954579809956401055788693, 50290306214852192605264941404, 11584578367073737286597097637, 23330546567461178065917588032, 31343688234160714794757165377, 63918823993048504659024692114, 27365510636493497037417818163, 30638666912149387553328229778, 54531935194478667388418879230, 41072843969336419779445369322, 60930376536086388437175835196, 55947262970830901337865668896, 44515932960074495211895851717, 14252286294934938035868124826, 35800368864810336116694682268, 70076466250975352052336380744, 3518883683220809834826882516, 21235446402566298534375767444, 35231908696746966244552935642, 14398535620050895095986981975, 19103988715582383425140328987, 14062642498531815460021440383, 77110266168617581807736354811, 54409146707444728728561076439, 64253672045037421891482500882, 36181743183047944158650802993, 26890907171354385267615627636, 45223610791479728329076327440, 16690474955515435722262505229, 2814228033061481589868246822, 77863107456708086832326043708, 1351886029839065156773853534, 65968244564445520569592572140, 35354808513582870523085136830, 52007148783750186143061130576]

def Predictor(list):
    predictor = ExtendMT19937Predictor()
    for i in range(len(randoms)):
        predictor.setrandbits(list[i], 96)
    return predictor.predict_getrandbits(96)
result = Predictor(randoms)
print(result)

解法2

第二种是Wbuildings师傅的周报里

Wbuildings师傅测试了32位和96位在相同seed下的生成关系，写出以下代码

from random import Random

def invert_right(m,l,val=''):
    length = 32
    mx = 0xffffffff
    if val == '':
        val = mx
    i,res = 0,0
    while i*l<length:
        mask = (mx<<(length-l)&mx)>>i*l
        tmp = m & mask
        m = m^tmp>>l&val
        res += tmp
        i += 1
    return res

def invert_left(m,l,val):
    length = 32
    mx = 0xffffffff
    i,res = 0,0
    while i*l < length:
        mask = (mx>>(length-l)&mx)<<i*l
        tmp = m & mask
        m ^= tmp<<l&val
        res |= tmp
        i += 1
    return res

def invert_temper(m):
    m = invert_right(m,18)
    m = invert_left(m,15,4022730752)
    m = invert_left(m,7,2636928640)
    m = invert_right(m,11)
    return m

def clone_mt(record):
    state = [invert_temper(i) for i in record]
    gen = Random()
    gen.setstate((3,tuple(state+[0]),None))
    return gen

randoms = [55015607074857799292945552290, 49368042755482977011736956173, 40475374240531115107595906636, 52147615048581670023735755450, 13432490767545507105189747763, 24440678017972777884814646255, 32822903152999092153407655597, 8563483583446603233686286354, 75732019275746461853540401495, 36842332206659125653150736486, 76786413054424156228987909265, 78728868918063155711331208027, 68111503649325447384558973315, 50046539350414059782746722603, 33122956341131312047186478550, 47134379833914353599100802574, 14506941828436962820850816482, 16254006011206386851511190777, 53774746810651233261166083709, 57317412206054586514985875280, 43011044274622942766585189176, 21510983328491776879720475647, 68805188235988349436606490157, 68293687378252177576750854213, 64020092712881170155616652147, 58788852915482172394398327520, 20534731592145885333097885636, 71497885157511490073528334436, 50079126675284942137464435871, 16433905363688130336892639414, 10833644831894048938957163773, 61837597918870726435017132850, 50007378472767284514600652443, 13242758280359098364681702807, 48040447462883040840110279722, 48653833299736009023667402599, 61877052829753339768672826777, 55104138447302791542841950167, 59956782054709979669719351421, 33622933736356173639796248572, 70720508316358691710097244967, 26438465850133558815351580879, 12121649600344247919530245458, 59429702128155774929559418436, 8461855977540480946850517835, 35371049050859796434557316156, 74900517442122255478113670139, 56015804116725775644082181473, 54019918704797178896937181953, 46449490759360975867530830160, 21716938523285444592131111037, 4075915261354769937217394891, 71101712150556394609286976122, 77514446308635805069858161218, 30443551680738939325710619401, 51330659874633330020137362887, 16870162608087608659692436972, 36332661698483296611490764287, 38912147134106871206560383319, 66798268847122499800706103042, 241691625661529797405764102, 9680620382995429570437419894, 54281462677774536994926184946, 49156921844074280073449443668, 47003617901112210542122896375, 20630134319865926707841141605, 38539127713936043329828502512, 37765649689660950654295018296, 27519165366018178520157118526, 47311700897513991864703815914, 14844131572803548743566512704, 72315716735652440986087523229, 46411344686639197025534075618, 13959184897278020398348948659, 2079854302954576073339089565, 39428786840574943257095970633, 33458396202396229906230251418, 69814672396568547483000493475, 28451062576030293943028542769, 3150653107998963723272095718, 20792548261825482531270352147, 69131192563757378564191442243, 73581103283131546986544846269, 32168289412017414311931877308, 55734763237596421172118618970, 37808961718727478136990696303, 22904874676153031620664377715, 9794575345156074603503087671, 22456694023771898844190118878, 49901970266243771395136385496, 63113371794658901555756959046, 68738124366682093927457951250, 23306235486349427954282639191, 43594485853233707551383467628, 50747180681744235554964992870, 49862479356739272497472347214, 38434690316151369964072773399, 71467050353277898958372067109, 55346669078871118497310884600, 46017420217054938248863989011, 75363033386622698885356870859, 10369764848153462639554152052, 75890142526899080264345852084, 9535759402085584783757952808, 43522044721852245514275493334, 12464589274296723227328792626, 78676543113595295732206638118, 60116759495604753189426160756, 69969854635185954403204801589, 15244509737688480815229679004, 36868877814286665666603704724, 25296352719228197917967642599, 27714369660917369969714529637, 7673110772037676634707790378, 66678444104365177982652169620, 46842636677378560041798283187, 10144943294980146082555306558, 28284306659807251586984133000, 33490472759408013029651749585, 77977414783931140205233073617, 69530485613806297267022583522, 76520003652664840680181807019, 46932273878708136776868709933, 55587849334378587663972698777, 288744469797385122841458086, 41277555669463912046072519012, 4464200409916053651301885032, 40054592246599648525169317693, 19475356311294822865721674381, 78967801470334524961687238739, 75822644069771873149506932458, 43938875242093048649223251016, 38961281929520042194905361090, 21610082723530059512385550253, 57418757224608120261793422587, 72515591359993311229453026924, 53301906528555214119355718384, 62399938403321209620318734938, 29562948809863356281824237526, 64690511731475499536620402074, 61422219087048013104282624678, 20023299367896362817857259034, 1531978217124909227300934212, 8362602216400318325888882470, 75999045381397120509496119808, 24819648371744754442222408890, 75932237139374495603284677727, 11591629473858684168400446684, 75483926784518263475169289687, 55768847294454228602227998151, 35105596201056028460562538709, 48075470868361149890782793466, 68011918805791011054681166147, 71379711286148023971490418355, 5119093941579935754141497093, 53547827525583375748301266038, 8537501347007365109158293206, 49644668676789081527660032954, 22515713345276622847996100404, 55307392324473859445909519983, 10994480124121534718832780851, 65533932078012255426667262659, 43392581419477495155490691253, 6149858215235626580350564774, 11427015895083257860925651246, 1213227811506969183950341669, 35938550903795041826608209051, 73091816395793401072374399076, 12197443447940928492569868668, 25301621853357018223709312786, 5689796934241659738266713001, 2613230292238434599188292344, 42124474617992669523056747325, 35194954579809956401055788693, 50290306214852192605264941404, 11584578367073737286597097637, 23330546567461178065917588032, 31343688234160714794757165377, 63918823993048504659024692114, 27365510636493497037417818163, 30638666912149387553328229778, 54531935194478667388418879230, 41072843969336419779445369322, 60930376536086388437175835196, 55947262970830901337865668896, 44515932960074495211895851717, 14252286294934938035868124826, 35800368864810336116694682268, 70076466250975352052336380744, 3518883683220809834826882516, 21235446402566298534375767444, 35231908696746966244552935642, 14398535620050895095986981975, 19103988715582383425140328987, 14062642498531815460021440383, 77110266168617581807736354811, 54409146707444728728561076439, 64253672045037421891482500882, 36181743183047944158650802993, 26890907171354385267615627636, 45223610791479728329076327440, 16690474955515435722262505229, 2814228033061481589868246822, 77863107456708086832326043708, 1351886029839065156773853534, 65968244564445520569592572140, 35354808513582870523085136830, 52007148783750186143061130576]

c = []
for i in randoms:
    a = hex(i)[2:]
    c.append(int(a[len(a) // 3 * 2:], 16))
    c.append(int(a[len(a)//3:len(a)//3*2],16))
    c.append(int(a[:len(a) // 3], 16))

g = clone_mt(c)
for i in range(208):
    g.getrandbits(96)

after = g.getrandbits(96)
print(after)
# 73177359307009435987099712513

guess2部分（回溯）

这部分先出一个96位再出627个32位，反向回溯627个32位，再回溯前一个96位

from extend_mt19937_predictor import ExtendMT19937Predictor

randoms = [3131844436, 1710395493, 2040128529, 484345499, 2462793287, 3676280954, 1262783325, 2668249231, 1577554939, 1094686367, 3249775482, 2535455373, 1580873401, 3668020441, 600047797, 2368372766, 4131413888, 3881611699, 1654375267, 1363668945, 789513452, 3762247007, 953812596, 1506373208, 3472069184, 2545441793, 2826549707, 575091032, 1773264197, 192501172, 721152596, 2765035108, 1254008657, 2817100002, 3970642288, 1818378227, 1140978336, 3485195271, 386023852, 3403435021, 1144997183, 3945241205, 1211988218, 3434015373, 2046254427, 620893433, 3293410181, 3112865039, 1171882312, 1264231357, 2966804259, 43998805, 3637672398, 2681960565, 2709103871, 1456705725, 1660473171, 3820308210, 916345361, 66696421, 1234084934, 2260115865, 4103495816, 1445850634, 1688161812, 3904081009, 2933234077, 3523756803, 490871410, 2644412567, 648761244, 3530982511, 1024884722, 383286216, 2204575995, 3268537218, 2908281468, 749867101, 1077132488, 3270723079, 3585247012, 1269156557, 3096777547, 1366205746, 2642565074, 1356154486, 2371705450, 3277675427, 1949359019, 3911342223, 2302199881, 1787074024, 1176483441, 3382524643, 1726938894, 3732701826, 3873136097, 648865101, 1373666656, 1977863320, 2275109604, 1452217785, 2796416538, 4169530804, 903377449, 1230239737, 1392065473, 3204364427, 334317583, 2956184008, 2411445068, 41487849, 721765697, 1443541315, 2093099003, 893095099, 4074956390, 3098600401, 314246690, 1836298915, 651584091, 1915188462, 2767672465, 2165385064, 1519266519, 4022389379, 1728592657, 4225918363, 1086688090, 2667629859, 2236562855, 397758955, 3266197863, 1547047859, 1769483950, 1054690627, 3821081636, 4243049300, 2113976324, 3465256288, 3394237832, 1447852828, 3375689141, 3469852507, 108642640, 1417582614, 2226381889, 1108355161, 1107879584, 994843797, 3134161877, 1827259162, 2541380730, 1414991982, 66563096, 17558729, 2523246427, 2306870077, 4229357864, 1794849582, 342768726, 2537134735, 3992316097, 2390770768, 58919292, 3299454886, 47094719, 192273779, 576620652, 2653473543, 732566086, 3494470827, 375184426, 3046525929, 1917007196, 437621599, 226187925, 279460746, 2504991047, 2720647095, 1726214839, 2662580336, 310633501, 4201239133, 1411404284, 2797124852, 1009997203, 1619452767, 542751538, 2044343202, 634443864, 779388116, 1029257449, 214975482, 3625137656, 70328808, 3310617589, 1031353996, 3450854594, 679561624, 2983441457, 2349421851, 2795342193, 1652530355, 677860488, 1518458320, 3142116487, 1973355550, 3385226917, 823024989, 2787730966, 2961286907, 1903136206, 875506150, 4174650755, 3561996691, 1002531559, 4128921823, 1282902829, 1020680621, 3136992997, 1708678754, 1181634294, 3235211337, 660397562, 3060688465, 3934130449, 608548952, 1854108908, 4127434065, 1301263785, 980156946, 1702117699, 3806397832, 4159471046, 2458928134, 3866388551, 3053272844, 2378284756, 2054070916, 3825976364, 2336292623, 122801644, 3993151514, 4096144143, 3814616160, 3994433936, 3462289286, 4243017170, 3426172061, 2583801103, 212067227, 3534029236, 36875405, 4045543218, 187217458, 557973024, 444948938, 4077939216, 3268643877, 2993470198, 1493479975, 2130068040, 2299545462, 830879239, 1365763854, 478049374, 2074554524, 1821969699, 3959885144, 3646002934, 2672029263, 2753142311, 2688990434, 1863524787, 1040793750, 3125785761, 3638172148, 3540865755, 3757848958, 1414800242, 2928259859, 1861735245, 4235431182, 2862287091, 3428851640, 486857161, 1352945718, 3486730778, 883640701, 1296225663, 3655133993, 3830695918, 4200683490, 1115097527, 530632520, 2536734545, 3330209702, 692913861, 4173632848, 4182050947, 4099357993, 1992990649, 2689587606, 1397545631, 4049403842, 4198228871, 3313893404, 1356111161, 2718318666, 358872243, 1175402713, 1456360316, 1921597330, 1812196593, 1076515795, 2119895733, 3900210292, 3619512492, 2837094060, 167935, 2181313587, 2341488060, 2373964485, 952568298, 1842854296, 4045471217, 1939489272, 1473031514, 3060284468, 2661841551, 3031889599, 2907382437, 4286947591, 3584889180, 3005106221, 2727316663, 3931261841, 3490523908, 3780389181, 3743857672, 765390813, 1987225828, 2723892340, 1163275304, 3062347486, 2349224851, 787739531, 378052259, 2055505948, 3607986110, 3432516938, 1221088847, 3101819143, 3556683912, 4073221057, 577365487, 1860652081, 711563646, 1039004198, 2112807179, 809098012, 2811893098, 766665936, 2107894153, 3205397082, 1062442066, 3003811473, 2495630660, 681813468, 1247402813, 3015978207, 1908481948, 402536178, 1017534355, 3137699610, 1243214519, 2002971476, 2751738083, 4202633831, 2149611209, 2901851985, 3441366308, 1306405097, 1436920351, 3206822252, 3135875087, 3112772405, 2155012041, 4166786019, 2388412286, 3743595466, 1504277877, 2570252102, 1525324343, 3988357159, 2041485802, 3706379242, 1567644399, 3629389711, 3521760489, 2606285630, 2378614660, 2278092070, 3134112923, 1103492149, 2544530864, 1658255844, 1898801584, 904222527, 2957105662, 3389876719, 2456986124, 2695204025, 646113342, 4091650903, 2199478453, 3706005283, 612268437, 2484284336, 2662191700, 1940190622, 233733292, 4012212083, 2500822436, 541451268, 643453712, 3232122867, 3584484460, 648833258, 1768628917, 3984796041, 1411122343, 2111633947, 4054603898, 3486423013, 1936378246, 2642145436, 3750457204, 4014965456, 1555132787, 1596915262, 3543904379, 221214936, 3568886655, 509377956, 2735720233, 2280845785, 2244193115, 2491466696, 2899402863, 3409575433, 4090467960, 2298184706, 3445239101, 3543853500, 3002886346, 1957091440, 2232700177, 1214082317, 3253617000, 612662508, 1967176113, 1477788048, 2598998495, 3732580449, 3526698478, 3205961233, 1596289512, 3563960905, 701926946, 2091717748, 497084240, 1431153592, 2121887464, 2717201053, 1708163770, 2288780659, 695843074, 1804583145, 3549082991, 2132631780, 1404284920, 1812914597, 3786808737, 1238178729, 144709682, 2720425065, 2567630528, 3687426833, 921498776, 3846928815, 3992245405, 1523301292, 2975368564, 2794392842, 3915184151, 2374520221, 3570983257, 576777516, 434172278, 3432585614, 2488328901, 3502901745, 2189466832, 3258959396, 3652453078, 2646058339, 1487691505, 3489122606, 2095120777, 3444908045, 2169560914, 1142429299, 3290048052, 2989735964, 3394182052, 629348441, 3819996826, 45644271, 490572833, 497254234, 454033500, 4139957703, 1469582655, 1871913285, 3541204007, 1168363870, 887995922, 2876697335, 183207833, 3610125137, 3750324442, 1492867425, 3047407108, 3149823622, 3473939398, 3602043139, 823675959, 844582032, 3998968330, 2393470080, 2512238135, 67167808, 1611487897, 2830420861, 4112505264, 1473571356, 2312858766, 871689440, 556193926, 1001003215, 1273007741, 762017629, 2038148387, 4279168802, 2408310663, 2054122309, 42020314, 1396677628, 3773376680, 1932770810, 2471957404, 2226052083, 2029396226, 3765862340, 1050629836, 3182006232, 2413024927, 4016684643, 2024438409, 4090205995, 3597880762, 2506376035, 3927261145, 4205690402, 2307681663, 3274838512, 3523789777, 359904705, 1651827754, 3293539170, 3181510821, 1493999036, 1649777650, 4154519231, 1329665122, 90822454, 999884567, 141607911, 3884251899, 2825791367, 1739573277, 3234181642, 933041054, 186550284, 4092869914, 1043976374, 413839654, 4146441955, 2162431794, 1528203403, 3113434991, 1963838396, 1914312708, 2228058801, 1066392891, 3709434263, 3444101460, 822257454, 528906696, 2815319529, 1900590565, 1548596297, 2176062412, 2101521651, 4151077085, 2146296787, 837380469, 3104944571, 3846825052, 369339, 247134846, 3774886839, 2721198553, 3033768060, 4071240934]

def prenumber(list):
    predictor = ExtendMT19937Predictor()
    for i in range(627):
        predictor.setrandbits(list[i], 32)
    for i in range(627):
        predictor.backtrack_getrandbits(32)
    x = predictor.backtrack_getrandbits(96)
    return x
pre = prenumber(randoms)
print(pre)

guess3部分（求seed）

from gmpy2 import invert

def _int32(x):
    return int(0xFFFFFFFF & x)

def invert_right(res,shift):
    tmp = res
    for i in range(32//shift):
        res = tmp^res>>shift
    return _int32(res)

def recoverseed(last):
    n = 1<<32
    inv = invert(1812433253,n)
    for i in range(623,0,-1):
        last = ((last-i)*inv)%n
        last = invert_right(last,30)
    return last
seed = 578972588
print(recoverseed(seed))

guess4部分（求extract）

def inverse_right(res, shift, bits=32):
    tmp = res
    for i in range(bits // shift):
        tmp = res ^ tmp >> shift
    return tmp

# left shift with mask inverse
def inverse_left_mask(res, shift, mask, bits=32):
    tmp = res
    for i in range(bits // shift):
        tmp = res ^ tmp << shift & mask
    return tmp

def recoverextract(y):
    y = inverse_right(y,18)
    y = inverse_left_mask(y,15,4022730752)
    y = inverse_left_mask(y,7,2636928640)
    y = inverse_right(y,11)
    return y&0xffffffff

extract = 1531729985
print(recoverextract(extract))