I'm investigating a tool. I have an section of an eeprom memory dump that this tool uses, shown in the figure below. By my inquiries, the two bytes highlighted in red are based on the bytes highlighted in green, because when the tool I am investigating changes any of the bytes in the green section, the tool changes the two bytes in red. When I manually change the data in green the tool does not recognize the file. There is a redundant section just below, which I did not highlighted. However, the same applies to it. When I make redundant modifications to these sections, the tool does not recognize the file too. The remainder of the file, outside the highlighted sections and its redundant portion, can be reset and the tool continues to recognize the file.

enter image description here

I tried CRC-16, CRC-16 CCITT, xor operations every 2 bytes, for example: 0x2017 ^ 0x28B3 ^ 0x10DB ^ 0xB858 ... But I did not find the values ​​highlighted in red. Anyone have any tips?

[EDITED]

I will put the numbers of the region in green here, maybe it can be more useful for those who want to help

20 17 28 B3 10 DB B8 58 00 00 00 00 00 00 00 00 54 48 AA 00 54 48 AA 00 00 00 00 00 00 00 00 00 4A 7E 5E 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 7D 5E 6C 00 00 00 00 00 00 00 00 00 00 00 00 CD 7E 85 5B 7A B4 A2 CC A0 5C 81 D2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 CD 7E 85 5B 7A B4 02 00 00 00 F9 E5 02 99 A6 1B 02 02 00 00 01 00 00 80 6B 00 0D 4E 04 00 00 00

  • 1
    Did you account for endieness? IE 0x1720 ^ 0xB320 ... – Twifty Oct 5 at 22:10
  • Yes, I tried, but it just change the endieness of the result. With the first I found 0x57ad, changing the endianness it became 0xad57. – Daniel Oct 8 at 11:42
  • 1
    Why don't you try to reverse the "tool" you are investigating to find out about the algo being used? – josh Oct 10 at 21:27
  • 1
    It's hard to reverse engineer the algorithm from just one example. There should be some of them, ideally have low Hamming distance; or alternatively you can post the tool used and people can do either way. – user202729 Oct 26 at 13:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.