0

What I would like to know is whether or not I have sufficient information to determine a particular checksum algorithm being used.

In my case I have a very large stream of data with many frames of data and their respective checksums. Here is what I know:

  1. The data-field (of which the checksum is being computed) for each frame in the stream.
  2. The checksum of each packet.

Is this a sufficient amount of information to determine a checksum algorithm? I also have many samples so I could try out a particular checksum algorithm on all the samples to see whether/not the algorithm will work in each case.

Here is more information that may clarify things:

  1. The length of the data appears to be 2 bytes.
  2. The length of the checksum appears to be 4 bytes.
  • 1
    What is the length of the checksum ? What is the length of the data ? How many different data samples do you have ? Can you post some of these samples ? – w s Feb 16 '17 at 15:15
  • 1
    @ws Let me answer those questions, in my question. Sorry for not providing that information sooner, and thanks for letting me know. – Snoop Feb 16 '17 at 15:16
  • 1
    The fact that the length of checksum is less then length of data looks very strange from architectural point of view (in this case you don't need checksum, it's enough to repeat the data). Are you sure that you know all input components of the checksum ? – w s Feb 16 '17 at 15:27
  • @ws The answer to your question is technically no, and that it may actually be more than 2, but I thought that the other parameters were just start-of-frame and end-of-frame sequences surrounding the actual data-field. Does that make sense? – Snoop Feb 16 '17 at 15:31
1

In most cases - yes, you probably have enough information to determine the algorithm, especially if the checksum algorithm is standard(just try to compute all well-known 32 bit checksums on some data samples and see if it fits).

However there are some assumptions in this claim:

  • You have many pairs with different data and its checksum
  • You really know all the components of the data on which the checksum is computed and their respective order
  • This is really checksum and not something else

In this case I'd recommend to reverse engineer the software that computes or checks the checksum: if checksum is not standard it is very much easier.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.