# Protocol RE, mysterious checksum function

Im trying to reverse engineer a protocol in which some text is sent and has a specific number appended. I figured out that the number is some kind of a checksum (depends on the text somehow) and also that it increments by one on cases such as this: "aaaaaaab" = X and "aaaaaaba" = X+1. Does anyone here have any idea what I could be dealing with?

``````iiiiiiii =  4d0b
iiiiiiil =  920b
iiiiiill =  ce0b
iiiiilll =  120c
iiiillll =  5a0c
iiilllll =  990c
iillllll =  dd0c
illlllll =  210d
llllllll =  680d
liiiiiii =  940b
iliiiiii =  950b
iiliiiii =  960b
iiiliiii =  970b
iiiiliii =  980b
iiiiilii =  990b
iiiiiili =  9b0b
iiiiiiil =  920b
aaaaaaaa =  210f
aaaaaaab =  a110
aaaaaaba =  a210
aaaaaaca =  9f0f
aaaaaacb =  1f11
baaaaaaa =  a610
``````

The second part is what I have deduced to be the number which depends on the string. It's also obvious from the data that the first two digits are least significant.

• Could literally be anything. Can you look at the binary producing the data? Mar 30 '17 at 2:54
• I can but I'm not technically able to follow the flow of execution. There are some other information that I have gathered by sniffing the connection the software creates. I'm adding it on the main question. Thank you! Mar 30 '17 at 5:37
• Can you share the binary which computes the data ?
– w s
Mar 30 '17 at 6:12
• It actually communicates with a device so it's probably going to be a bit difficult to simulate the environment. Either way the software can be found at en.realandbio.com/download/software-download_c0003 . It is the RIMS binary. Mar 30 '17 at 7:00
• I think you should make an effort reverse engineering the code producing said checksum, and ask specific questions relating to understanding the code. Mar 30 '17 at 12:56