Complete the reverse engineering of Windows TCP ISN generation

Characterize the complete offset-update mechanism used by the Windows TCP/IP stack when generating TCP initial sequence numbers, including the effects of time, recent connection activity, and internal per-bucket state.

Background

The paper analyzes Windows TCP initial sequence number generation through static and dynamic reverse engineering of tcpip.sys, supplemented by black-box experiments. It identifies a keyed hash over the connection 4-tuple and an additional evolving offset, and it finds that some source-port pairs exhibit stable relationships between their generated ISNs when connections are initiated close together in time.

The reverse engineering does not recover the full behavior of the offset. A complete characterization would clarify how the offset is updated and how its internal state produces the observed correlations between source-port pairs, thereby improving understanding of the Windows attack mechanism and its security implications.

References

However, we did not fully recover all details of this mechanism.

We therefore complemented the reverse engineering with black-box experiments. We repeatedly created pairs of TCP connections while keeping the source IP address, destination IP address, and destination port fixed and varying the source ports. These experiments revealed that some source-port pairs exhibit a stable relationship between their generated ISNs when the connections are initiated within a short interval. We refer to such pairs as correlative ports.

The Windows analysis remains partial. In particular, although we identified the relevant ISN-generation function and several components of its internal state, additional work would be required to recover the complete offset-update mechanism.

— Cross User/App Network Attacks - Hijacking TCP Connections and DNS Cache Poisoning via a Malicious User/App (Extended Version)  (2609.09345 - Shahar et al., 8 Sep 2026) in Appendix, Section “Reverse-Engineering Methodology and Artifacts,” subsection “Windows”