Attacking a blackbox PRNG Every single PRNG attack I could find during my research depends on knowing the PRNG algorithm(s) as well as having definite output.

Suppose you have the following scenario: nothing is known about the PRNG design and the output you get is filtered through an application such that you only get $A,B,C,D$ where each symbol has some 'probability'. To simplify this you can assume that the output of the PRNG is between 0 and 100 and that it is arbitrarily divided such that each symbol in $A,B,C,D$ has its own range. You do not actually get to see the PRNG output at any point.

What kind of attack is possible on this $A,B,C,D$ output stream? The only one I can think of is if the PRNG cycle is short and it starts repeating.
This depends on the type of attack planned, and the information available. Given only the output string (or parts of it), any decent cryptographic PRNG is infeasible to try to predict (which is usually what you want, since future keys or other parameters are desired).

Additionally, if your symbol distribution is uneven, it is not a very good PRNG. (For the simple reason that it is easier to try to simply brute-force prediction guesses). Their main protection typically is limited number of brute-force trials possible for the attacker.

However, NIST has a standardized test suite to test bit-valued PRNGs (NIST SP 800-22. Simple googling will give you the document, source code and binaries).

The test suite will try to find a common set of weaknesses from a bit-valued PRNG output. Using the results from the test suite, it would be possible to try to estimate the PRNG behavior, statistically, in case it was badly designed. 

In case the PRNG symbols are not binary, and/or they have an uneven distribution, most of the NIST-tests would fail, or refuse to start. It is a straightforward (but not necessarily trivial) transformation of number bases to move from N (evenly distributed) symbols to a binary base. 

For the unevenly distributed case, it might be useful to try to find an evenly distributed set of symbols to try to arrive to applicable binary base. For example:


Given a distribution of A: 1/2, B: 1/4, C: 3/16, D: 1/16
Assign a set of 4-bit codes for each: 8 codes for A, 4 codes for B, 3 codes for C and 1 code for D
Replace the symbol string with this assigned bit-string such that for example for an occurence of A, assign randomly one of its 8 codes to that occurrence.


Because this transformation does not look like the original bit string, you will need more samples (probably at least as many times as is the size of the largest bit-set) to compensate.

In general, some of the NIST tests require in the order of billion-bit samples to complete, so they may be applicable only for automated systems, not for example physical world gaming devices. (Slot machines have sometimes been attacked via weak PRNGs inside them, see e.g. https://www.ethicalhacker.net/features/book-reviews/mitnick-the-art-of-intrusion-ch-1-hacking-the-casinos-for-a-million-bucks)