0

Dear members,

I am trying to figure out the parameters of some hexadecimal CRC32 values I have.

The values are:

Value - input (before hashing)
55D3028A - J
73AF2D02 - O
6742BE71 - T

I hope I can figure out the polynominal and initial/final XOR value so I can hash my own values.

I'm using reveng to getting the parameters for hashing my own strings, but I didn't found a working solution.

the commands I've tried:

  • ./reveng.exe -w 32 -q 40000000 -s 55d3028a 73af2d02 6742be71
  • ./reveng.exe -w 32 -p 40000000 -q 80000000 -s 55d3028a 73af2d02 6742be71
  • ./reveng.exe -w 32 -p 80000000 -q c0000000 -s 55d3028a 73af2d02 6742be71
  • ./reveng.exe -w 32 -p c0000000 -q 0 -s 55d3028a 73af2d02 6742be71
  • ./reveng.exe -w 32 -l -s 55d3028a 73af2d02 6742be71

Is it possible to use the input value(s) and the given crc(s) to bruteforce/calculate the parameters or does someone know a other method to achieve the same goal.

Thanks in advance,

EvilID

  • are you sure the algorithm is a CRC and not some other chevksum/hash? where are you getting the data from? – Igor Skochinsky Apr 29 '18 at 20:11
  • Well, I'm getting the values from software that I use and the documentation states that it is crc 32-bit 4 bytes. – EvilID Apr 29 '18 at 21:17
  • If you have the software calculating these, why not just try to find the code and see what is actually happening? Or is the question more about solving it the way you asked for? – Johann Aydinbas Apr 29 '18 at 21:52
  • I could try to find the code inside the program, but I indeed hope to learn how to solve it without doing that. Just for learning purposes. – EvilID Apr 30 '18 at 6:37
  • 1
    @josh The reveng approach was for me to figure out if it was indeed possible to calculate the parameters with the known information in the first place. – EvilID May 1 '18 at 5:03
3

I wanted to give this a try because it seemed interesting but I did not succeed.

Still, maybe this will lead you in the right direction for further tests.

I started reading some introduction material on CRCs:

http://www.sunshine2k.de/articles/coding/crc/understanding_crc.html

and this one where someone else was trying to reverse engineer a CRC:

https://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html

to get a general understanding what we're dealing with. Then I was about to write some small Z3 script but luckily stumbled upon

https://github.com/DennisYurichev/yurichev.com/blob/master/blog/CRC_cracker_Z3/CRC_cracker.py

which is described here: https://yurichev.com/blog/CRC_cracker_Z3/

Basically, that is a script that uses Z3 (Microsoft's theorem prover) to calculate the CRC sum and it tries to find the polynomial, test Big and Little Endian interpretation, and an inverted input/output or not. You supply it with input data and the CRC sums they have to generate and then it tells you the parameters.

That script did not produce a result for me though. That either means it's not a CRC, not a 32 bit CRC, the input/output is modified beyond simple inversion, or the supplied samples are not just over the 3 letters you listed.

I also could not find any matching publicly known set of parameters (such as CRC32C), for that I tested some parameter sets using https://pycrc.org/

If your actual target was recreating the checksum I'd probably go reverse engineer the code now instead of treating it as a blackbox.

  • have you tried hashing the strings including the terminating 0, or maybe even padded to 4 bytes? – Igor Skochinsky May 2 '18 at 8:42
  • 1
    I just did for the terminating 0 (no result), and padded to 4 byte it ran more than an hour until I had to cancel it. – Johann Aydinbas May 5 '18 at 2:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.