Updated all the stray calls to rand() to use nbase_rnd instead. The

only code left in Nmap that still uses rand() is in the Lua math 
library.  Perhaps at some point we'll need to expose high-quality random 
numbers to Lua via our custom nmap library.

nmap.cc

@@ -505,7 +505,6 @@ int nmap_main(int argc, char *argv[]) {
   size_t sslen;
   int option_index;
   bool iflist = false;
-  struct timeval tv;
 
   // Pre-specified timing parameters.
   // These are stored here during the parsing of the arguments so that we can
@@ -649,10 +648,6 @@ int nmap_main(int argc, char *argv[]) {
 
   if (argc < 2 ) printusage(argv[0], -1);
 
-  /* You never know when "random" numbers will come in handy ... */
-  gettimeofday(&tv, NULL);
-  srand((tv.tv_sec ^ tv.tv_usec) ^ getpid() + 31337);
-
   Targets.reserve(100);
 #ifdef WIN32
   win_pre_init();

output.cc

@@ -129,8 +129,9 @@ static const char *logtypes[LOG_NUM_FILES]=LOG_NAMES;
 static void skid_output(char *s)
 {
   int i;
-  for (i=0;s[i];i++)
-    if (rand()%2==0)
+  for (i=0; s[i]; i++)
+    /* We need a 50/50 chance here, use a random number */
+    if ((get_random_u8() & 0x01) == 0)
       /* Substitutions commented out are not known to me, but maybe look nice */
       switch(s[i])
 	{
@@ -142,7 +143,7 @@ static void skid_output(char *s)
 	case 'e':
 	case 'E': s[i]='3'; break;
 	case 'i':
-	case 'I': s[i]="!|1"[rand()%3]; break;
+	case 'I': s[i]="!|1"[get_random_u8() % 3]; break;
 	  /*      case 'k': s[i]='c'; break;
 	        case 'K': s[i]='C'; break;*/
 	case 'o':
@@ -158,8 +159,13 @@ static void skid_output(char *s)
 	}  
     else
       {
-	if (s[i]>='A' && s[i]<='Z' && (rand()%3==0)) s[i]+='a'-'A';
-	else if (s[i]>='a' && s[i]<='z' && (rand()%3==0)) s[i]-='a'-'A';
+	if (s[i] >= 'A' && s[i] <= 'Z' &&
+	    (get_random_u8() % 3 == 0)) {
+	  s[i] += 'a'-'A'; /* 1/3 chance of lower-case */
+	}
+	else if (s[i] >= 'a' && s[i] <= 'z' && (get_random_u8() % 3 == 0)) {
+	  s[i] -= 'a'-'A'; /* 1/3 chance of upper-case */
+	}
       }
 }
 

scan_engine.cc

@@ -2718,7 +2718,7 @@ static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
 
     seq = seq32_encode(USI, tryno, pingseq);
     if (pspec->pd.tcp.flags & TH_ACK)
-	  ack = rand();
+	  ack = get_random_u32();
 
     if (pspec->pd.tcp.flags & TH_SYN) {
       tcpops = (u8 *) "\x02\x04\x05\xb4";

tcpip.cc

@@ -1198,8 +1198,6 @@ if (seq) {
 
 if (ack)
   tcp->th_ack = htonl(ack);
-/*else if (flags & TH_ACK)
-  tcp->th_ack = rand() + rand();*/
 
 if (reserved)
   tcp->th_x2 = reserved & 0x0F;