How can I guess hashing or checksum algotrithm which is used?

Question

I am hacking a chinese smartwatch. I extracted a animated GIF from its firmware and edited it to test my tools. The new filesize was less than the old one, so I added zero's with trunk command on Linux. However, after writing back the ROM, it refuses to boot without showing me anything. A friend of mine suggested me that there might be a simple checksum at end of file. However, I am unable to determine what kind of checksum it is in order to add it to my edited file. I added two sample files in this google drive folder (0 and 1 .gif). The original userspace firmware is FILE_01_mtk. If I look at the first file, there are only a few bytes after the '3B' marker (probably end of GIF). However, the second GIF is completely different, with the '3B' alot before.

Can someone help me figure out what checksum or hash is used?

Thanks, Alexandre Croteau

Answer 1

You can dump the ROM, disassemble, find the code that loads and reads the GIF, and you are sure to find the checksum algorithm.

Other than that, you pretty much have to run a guessing game, remembering to check both endians. If you were the developer, what might you use? Usually they are either common or simplistic.

Answer 2

There is too little information to answer this properly, but I suspect there may be a checksum on the whole firmware and not just per file. Try changing some bytes here and there (both in the target file and outside) and see if it works or not. In the worst case you'll need to disassemble the code and try to find the checking routine.