Rating:

### crypto/rejected

Whenever the RNG has to reroll, then it means that the highest bit of the output is 1. This lets you launch a known-plaintext attack on the underlying LFSR. Solve the resulting linear system (over GF(2)) and find the flag.

You don't really get much information if the RNG doesn't reroll. A good choice of modulus is (2^32 // 3) + 1 or (2^32 // 4) + 1.

Hellman's solve script is [available here](https://gist.github.com/hellman/7dd5e14a49bb857c8e07e5f3aab866fc)