Reverse engineering of some checksum algorithm

Question

I am trying to reverse some communication protocol between transmitter (controlled by PCF7952 chip) and receiver on 433 Mhz frequency

I know how to prepare the "right" package which would be received and controller on the receiver's side 100% will act by this command.

But, the last 2 bits of command are unknown for me, it seems that it's a some kind of checksum / crc (but why it's only 2 bits?)

For now everytime I'm sending 4 commands with equal "body" but with 00, 01, 11, 10 in the end.

One of them is eventually working for the receiver but the goal is to execute the command from the first attempt (now it's 25% probability that the first attempt would be successful, definitely because of wrong last 2 bits)

I used to think that transmitter uses standard CRC calculation methods and the program just adds, let's say, kind of lower bits from this CRC8 / CRC16 / CRC32 sequence generated for the body of command.

I tried to use possible CRC algo from http://www.lammertbies.nl/comm/info/crc-calculation.html but did not find any positive matches in these sequences

Also I tried to check any parity bits algorithms also no luck with that

Here is samples of bit sequences (last 2 bits is checksum (maybe), third bit from the end is always 0, at least in my 2200 samples grabbed), which are grabbed from working device (transmitter)

0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 1010 1001 1010 1010 1101 10 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 0100 1111 0101 0100 1101 0101 11 000
0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 1010 1011 1010 1000 1111 10 011
0111 1001 1101 1011 0001 1000 1100 0111 1100 0100 1101 1101 1101 0101 1010 01 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 1011 0011 0011 1011 0000 1111 10 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 0101 1111 1101 1101 1101 1100 11 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 0101 1111 1111 1111 1101 1110 11 001
0111 1001 1101 1011 0001 1000 1100 0111 1100 1100 1000 0000 0101 0000 0011 01 011
0111 1001 1101 1011 0001 1000 1100 0111 1100 1010 0110 0010 0010 0100 0011 11 010
0111 1001 1101 1011 0001 1000 1100 0111 1100 1100 1000 1000 1101 0000 1011 01 010

Also here is the file with all bit sequences grabbed - https://drive.google.com/file/d/0B6VO67TWi9UOSkt4VHJNQmtSTXc/view

Honestly, I don't know where else to look.

Any hints/help or anything at all is much appreciated.

Answer 1

(I was trying to add this as a comment, but don't have enough reputation points)

I noticed the consecutive checksums {00,00,10,00,10} repeat 21 times in the first 1100 samples of which 8 times with 19 samples in between while the data remains random/different.

E.g.

This makes me wonder if the checksum is maybe time/clock based? With only 2 bits of checksum repetitions are of course very likely, but not sure if up to this extent it is "just a coincidence".

There are also a lot of repetions of {11,01,11,11,01}. Not sure if this helps, it's just something I noticed.