### crypto/rejected

Whenever the RNG has to reroll, then it means that the highest bit of the output is `1`. This lets you launch a known-plaintext attack on the underlying LFSR. Solve the resulting linear system (over `GF(2)`) and find the flag.

You don't really get much information if the RNG doesn't reroll. A good choice of modulus is `(2^32 // 3) + 1` or `(2^32 // 4) + 1`.

Hellman's solve script is [available here](https://gist.github.com/hellman/7dd5e14a49bb857c8e07e5f3aab866fc)