The random number generation expressions are evaluated using evalrng and used within expr in definerng. If multivariate object is returned by evalrng, then the rows are random samples and columns are distinct parameters (e.g., costs for each health state, elements of a transition probability matrix). Ring definition is - a circular band for holding, connecting, hanging, pulling, packing, or sealing. How to use ring in a sentence.
If you’ve ever played a computer game or a game on online casinos from the UK, you’ve surely come across the term – RNG. Well, what is RNG? RNG, or Random Number Generator, is a mathematical concept that is used for the generation of a number or a string of numbers that can’t be better predicted than by pure random chance.
RNG systems aren’t only used for gambling, instead, you can find them in any program that needs to generate random values very quickly. RNGs are used for the generation of statistics, computer simulations, cryptography, randomized design, and many other fields.
RNG and Its Definition
Random number generator (RNG) is used to determine the outcome of any gaming session. The mathematical algorithm predicts random numbers and symbols that will determine the result of the specific game. However, the RNG can’t give numbers that favor the outcome of the game.
Random number generators are a physical device or a piece of software that uses either physical phenomena or extensive calculations to provide users with random outcomes. RNG devices are fairly new when it comes to the techniques and methods people use for determining random numbers.
We can safely say that practices, such as coin flipping, card shuffling, and dice rolling, are also methods for Random Number Generation. However, since these methods are all physical, they are hard to replicate in a software driven RNG system, which is why physical RNG systems exist in fields where true randomness is required.
What Does RNG Mean?
RNG stands for Random Number Generator (or Generation, depending on the context). On the most basic level, there’s a difference between the hardware random-number generators (HRNG), or pseudo-random number generators (PRNG). HRNG is also called a true RNG, since it generates genuinely random numbers by using physical phenomena for each new turn. PRNG is called pseudo for a reason: if you have the primary RNG (also called “seed”), you can determine what the next number in the row will be.
What Is RNG in Gaming?
The importance of RNG in gaming is quite obvious – it helps us reach random values in order to progress through the game. Video game fans among our readers are already well-versed with this term. Whenever you play a video game, the engine behind it runs the RNG software. The purpose of the software, in this case, is to calculate your and your opponent’s stats after an encounter or to create a plausible but random event in the game world. Essentially, the RNG in gaming defines the value of your actions against another player or an NPC character.
For example, RNG is used in shooting games to determine the most probable “damage” caused to another character. The RNG is used because it would be way too demanding and expensive to render every single shot fired in real time. In another example, there are loads of games that feature “random encounters”. They can’t be programmed because of the memory limitations. Therefore, it’s much easier to set up an RNG system and render encounters when they're required.
The most notable system in online gaming, however, which uses RNGs, and which most people are familiar with, is the concept of “loot” or “loot drops”. Most modern online video games reward players through an RNG system that, after the player has achieved something or passed a level, gives the player a certain in-game item from a pool of possible rewards. This item is usually determined by the RNG system that’s integrated into the game, which helps to keep in-game encounters more interesting. Some people also ask the question: “What does bad RNG mean”? This is basically a gamer’s way of saying that they’re not happy with the rewards they’ve received, i.e. that “the RNG is against them”.
What Is RNG Manipulation?
We’ve already established that HRNG is a “true” RNG device, since every new number it makes is completely random. Therefore, manipulating HRNG is impossible. This leaves us with PRNG. Since PRNG determines the randomness of the next number by a certain mathematical function, it is possible to determine the next number in the row by knowing the said function and using the seed number.
To this day, the most notorious example of RNG manipulation is the rigging of the US Hot Lotto state lottery in 2010. The then-director of MUSL Eddie Raymond Tipton used his position to gain access to the RNG device that was used for lottery drawings. Tipton installed a “rootkit”, which is a small malware program, that could read the seed number and then program all numbers that came after the first one. Needless to say, Tipton was arrested and convicted for tampering with the device.
What Is an RNG Seed Number?
An RNG seed number is a number or vector that is used to initialize the random number generator. As noted before, seed numbers are only used in PRNG, since HRNG doesn’t need a starting position. Once a seed number has been chosen, the device resumes producing a set of random numbers that would follow it. Also, the PRNG often has a mathematical function that determines the next set of numbers.
What Is RNG in Gambling?
In order for any game to be fair, RNG has to produce a completely random set of values that are in no way connected. It is true that PRNG uses a certain mathematical function when determining the next value, but the said function is so complex it can’t be reproduced by a human being. Imagine playing a game of roulette and knowing where the ball will land last!
Is RNG the Same as a Lottery Number Generator?
Lottery draws are also based on randomness, but the randomness is achieved through mechanical means. Casino RNG is basically a software that runs in the background when you play games. In the case of the lottery, the physical properties of the lottery drum are the ones that determine the randomness of every next number drawn. Hence, the lottery is much more adequate in creating a perfectly random number unless it is a “digital lottery” that determines outcomes through RNG software.
The Difference Between RTP and RNG in Casino Games
More often than not, while looking for info on RNG on a casino website, you can find a term called RTP (return to player percentage). While both RNG and RTP show the fairness of a game, they differ substantially. RTPs show which percentage of the initial stake is returned to players. Ideally, every game would have a 100% RTP, but, in reality, that is not the case. Therefore, RTP for respectable slot games usually varies between 90% – 96%.
RNG Certificates
Reputable casinos always maintain their RNG software, meaning that they allow testing bodies to go over their RNG systems and provide proof of fairness. Even though there are a number of different agencies that deal in RNG testing, occasionally, a casino will have its own in-house developed RNG that is tested by their own staff. The most notable agencies that deal with RNG testing are iTechLabs and Gaming Labs International that service some of the most popular Las Vegas casinos.
You Can Check The RNG Certification Yourself
If you want to know whether your favorite casino has had their RNG tested, you can always check our reviews, as it is one of the most important things we regularly cover on any platform we test.
Alternatively, you can visit the casino on your own and see their page that deals with game fairness. If the casino doesn’t have one, that should be the first sign that something’s fishy. However, keep in mind that this info can be hard to find due to a poorly designed site, so check with the customer support to be 100% sure, or again, check an appropriate review.
F.A.Q.
1. What Is an Random Number Generator?
A Random Number Generator is a device that produces a number or a string of numbers that can’t be better predicted than by random chance.
2. What Types of RNGs Are There?
There are two types of RNGs: hard RNG and pseudo-RNG. The former makes real random sets of numbers, while the latter uses a seed number to determine the next one through a software solution.
3. Is It Any Different from RTP?
While RNG is a device or software, RTP represents a percentage of the initial stakes returned to a player as a reward.
4. What Is RNG in Gaming?
Apart from gambling, RNG has also found its place in video games. The RNG, in this case, is used to determine all the random and unprogrammed events, such as battles, loot contents, random encounters, and pretty much every other random event.
5.Can RNG Be Manipulated?
While HRNGs can never be manipulated or their results predicted, one can predict the numbers given by PRNG. All you need is a seed number and a program or a device that utilizes the same mathematical principles as the PRNG. However, today’s countermeasures make this practically impossible, especially in the field of online gambling.
6. What Is an RNG Seed Number?
A seed number (or vector) is a starting number in PRNGs which determines the next number in a set.
7. Are There Any RNG Certificates?
The best online casinos subject their RNG software to testing regularly. The most notable agencies that issue certificates are iTechLabs and Gaming Labs International.
This post is a gentle introduction to reverse-engineering, through the unusual medium of tool-assisted speedrunning.
We're going to find an RNG (random number generator) in a game, using a combination of dynamic and static analysis, and then predict it later on. It also introduces usage of a debugger and disassembler, as well as some scripting.
But why?
Tool-assisted speedrunning is beating games as fast as possible, but with infinite retries. Whenever you make a mistake, you can go back in time - literally - and try with different inputs. More sophisticated tooling allows to enter and modify the input that's passed to the game each frame. It's a meta-game; I find it kind of fun, and it makes for some cool results. TASing is about going fast: everything that makes us not fast has to be taken care of, including luck.
In video games, many events aren't random: they're given the illusion of randomness by a random number generator. Every time something in the game needs a random event, for example the generation of dust particles, or the movement of an enemy, it calls the RNG, which returns a random number. We can imagine the RNG function: it most likely returns a random number, which is then used by calling code.
If we fully understood how some RNG in a game worked and its effects on the game, we'd be able to manipulate luck itself with careful play. But how do we find out?
Dynamic analysis
The game I'm using here is the Gameboy Advance game
Shaman King - Master of Spirits (U)
. I'm using the BizHawk emulator.Well, how does the game work? Magic box casino. After playing around for a bit to get a sense of the game, we go forward. You play a dude with a sword: he can attack with it, jump around, and do special attacks with souls he collects. That's all that we have access to.
How do you play casino. After completing the first area, we come across an interesting enemy:
We meet a boxer enemy. He jumps back and forth, and seems to attack at a random(!) pace. After a hop, he will either jab (straight punch) or wait. We have a source of random phenomena! When running straight at him, his pattern is Jab, Jab, Jab, Wait, Jab and so on.
No matter how long we wait, this pattern is always the same. This suggests that the RNG isn't called by anyone else other than the boxer. Most of our actions don't seem to call the RNG either, like jumping, attacking or backdashing.
However, when we special attack a few times and then walk to him, the pattern changes:
The pattern is now Jab, Jab, Wait, Jab, Jab. We now know that special attacks do call, and thus change the RNG. But, more importantly, we have two states of the game that we can compare against: the normal state where we walk up, and the other one where we special attack and change the RNG.
Our emulator has save states, which saves the game's state. If we have two different states, we can compare between them. Let's do so with the use of RAM search, which gives us an overview of the game's entire memory. At the first search we're met with the IWRAM, which is the GBA's RAM, address space:
We can use savestates with our emulator, so let's do so. We have two states: normal and changed RNG. We load the first state, then set our comparaison to “Not Equal To” to compare against the previous values. Finally, we load the second state with changed RNG, and we get a list of what addresses have changed:
It's likely that the address of our RNG is hiding here somewhere. But what do I mean by address? Wasn't the RNG a function?
In order for RNG to function, it needs to generate a random number each time. So how would we implement it ourselves? Most likely, we would need an algorithm that generates a wide range of possible values, ideally without much repetition. But, more importantly, in order to function it may need to know the previously generated number, in order to use it as a base for the next one. Thus we can spectulate that an RNG functions as some kind of generator, creating a sequence of random numbers.
To generate something new in a sequence, we need to know the last number in the sequence. It's very likely this is stored in RNG. This may not always be the case: some old video game RNGs are more primitive, relying on things like clock time for random events.
So, is our value really here? Let's check by freezing all these addresses: freezing an address means that it keeps its last value and cannot be modified. What happens?
The boxer now only waits - he never chooses to jab anymore. If we froze on a different RNG value, he would have likely only jabbed. We can use binary search to find the proper address: we freeze half the addresses and keep the other ones unfrozen, and check if the behavior of the boxer is still non-random. If it is, then the address is in the frozen half: if not, the address is is the not-frozen half.
After a few searches, we find our address
0x1DC8
in IWRAM. It behaves as expected: the RNG is called & changes both when we do the special attack, and after boxer guy's hop, to determine if he jabs or waits.We just did some dynamic analysis: we reasoned about how the program (the game) works as it ran, by observing it. By doing so, we were able to determine information about our program much faster than if we were disassembling the game directly. We now know the address where the RNG is located in memory, but that tells us nothing about how it actually works. All we can observe is that the RNG changes. What's the algorithm behind it?
Dynamic analysis
We could look at the game's binary in a disassembler. We're looking for
0x1DC8
in IWRAM, but what does that really mean?In a GBA, memory and I/O is memory mapped, meaning that both normal memory and I/O is mapped onto fixed addresses. The GBA's address bus is 32 bits long, meaning it could address up to 4 gigabytes of address space. Most of the GBA has already been reverse engineered for us, and we can take a look at the GBA's memory map directly. Under “General Internal Memory” we find:
Starting at address
0x30000000
is our On-chip Work RAM, also known as the IWRAM segment we found earlier. Similarly, we find that ROM starts at 0x08000000
. When looking at disassembly, we would be looking for address 0x3001DC8
, as that's the memory mapped address.Using a debugger, we can find the code that updates this address. No$GBA is an emulator which includes a built-in debugger which is sufficient for our needs. We can define a breakpoint whenever the RNG is written to, in
Debug -> Toggle Breakpoint
. [03001DC8]!
will halt execution on write. Finally, we do something in the game which advances the RNG:We find a
str
that updates the RNG at 0x0800BD34
in the binary. str r0, [r3]
will write the value of r0
, which seems to contain our new RNG value 0x8AF90E43
, into an address equal to the value of r3
. r3
contains our RNG address, 0x03001DC8
, or 0x1DC8
in IWRAM. What does the code do? Let's go to a disassembler and find out.Reversing RNG generation
After setting up our disassembler, IDA, for GBA games, we look at the routine we found in more detail:
Here,
dword_3001DC8
is equal to 0x03001DC8
, which is 0x1DC8
in IWRAM. The muls
will overflow the value, making the mult equivalent to a modulo 232. So what this routine does is equivalent to:Define Rng In Gaming Kev
This is a pretty common RNG algorithm called a linear congruential generator.
Emulating RNG generation: looking ahead
Phew. Let's see what we have:
- Some things (like enemies) can call the RNG.
- RNG advances every time by a known algorithm.
- We can get the current RNG value by reading off memory.
With this in place, we can predict RNG pretty easily. Why would this be useful? With knowledge of RNG, we can predict how anything in the game will act. We can map each future RNG value to an enemy behavior, like the boxer punching or not for example. For example, we could say that the boxer will punch on this RNG, then after three more calls, and so on. And knowing this, we can make our TAS runs that much faster, manipulating RNG in advance so that the right RNG hits at the right time.
However, there's one important detail: RNG can advance more than once per frame. If there are multiple enemies on-screen, then we'll have no idea what called RNG. While this is impossible to solve without disassembling every enemy's behavior, we can try something else: have our code tell us how much RNG is called per frame.
To implement this I chose a dequeue, implemented with a circular buffer, which is very space efficient. The idea is that we can memoize the next RNG values, thus predicting RNG in the future. How does this particular queue work? I find it's best to try it out.
At the start, we fill our buffer with values. Each value is generated from the previous one. Take the first generated value, when you click for the first time. The previous value is
0x0
, so 0x0 * 0x41C64E6D 0x0
. Finally we add 0x3039
, so the resulting value is 0x0 + 0x3039 0x3039
. The queue lets us memoize values. If RNG advances, then insert a new value.This acts like a normal queue. But when its capacity is full, the last value is overwritten and the head (the circle) and tail (the square) indexes change.
What if our RNG advances more than needed? Here our queue size is 8, but if RNG advances 30 times in a single frame, how do we tell? We don't have the intermediate values, we can only read from RNG frame-by-frame. In other words, we only have the starting RNG and ending RNG, and can't tell how much the RNG function was applied between the two values.
A simple way to solve this is to take the start value, apply the RNG function over and over (while storing the intermediate values) until we match the end values. The number of times we applied the RNG function is the same as the number of RNG calls.
However, with something like an array, it would be hard to both keep a cache of values and predict next values at the same time. The answer is the queue: we can infinitely take from the queue and insert back the advanced RNG value. We keep this infinite loop going until we find our RNG. To illustrate, let's start from a full buffer, looking for value
0xE6791B2E
. Try it out:In short, we can seek infinitely whenever RNG advances. Whenever we “consume” a value - that is, read the last RNG and insert a new RNG based on that one - increment a count by one. By reading the last few RNGs, we can have a list of what RNGs passed, even if we do not know them; we predicted them using our RNG function and stepping until we find our value.
Implementing it in Lua, we can predict values in advance, and predict by how much RNG advanced when it did advance. You can find the source here.
Conclusion
Define Rng In Gaming Keyboard Software
This post shows some basic reverse-engineering techniques as well as the full spectrum of tools available applied to a real problem, via tool-assisted speedrunning. It shows how far you can go in reversing a program, even with information that's sometimes very limited, using scripting to solve your problems.
Rng Meaning
If you are interested in reverse-engineering, trying to RE games is a pretty fun way to learn without too much pressure. In the future, we might delve more into patching the game itself, as well as the object system, to implement our RNG prediction in the game itself.