So I have a program which is highly obfuscated and generates a unique output every time. For ease of reversing I want to make it so that the output is the same for every run (following the logic that if the output is the same, the logic executed will be the same, roughly..)
At one point
strace shows that the program does a number of calls to
clock_gettime just before it generates an id. So I created a kernel module that makes
clock_gettime return exactly the same time. Yet the program is still able to produce a unique output.
In my opinion all programs must make system calls to get unique entropy for seeding random functions and without making any system calls (or if all system calls they did make were made to return non-unique entropy) the program can't produce unique (random) data.
Are there any ways I'm missing that the program can get unique entropy without showing up on
strace (i.e. without making a system call)?