1

I am trying to reverse engineer the key fob of my Ford Fiesta 2014 but I am stuck at finding the used checksum algorithm. I've successfully demodulates the key fob signal (using on-off keying + manchester encoding) and identified different type of bytes (see below).

|---b1---|---b2---|---b3---|---b4---|---b5---|---b6---|---b7---|---b8---|---b9---|---b10--|
|preamble|-------------------------rolling code-------------------------|counter*|checksum|
|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|

*counter: this byte is also used for the commando, the last 4 bits are different for OPEN,
CLOSE, TRUNK while the first 4 bits is a counter.

As the preamble is the same for all packets I assume it is not used in calculating the checksum. I am pretty sure it is not a CRC as I tried finding the CRC polynomial by bruteforcing (+bruteforcing the final XOR) but found no matching model (using https://github.com/nitram2342/bruteforce-crc).

I have tried some other standard checksum methods (XOR, 2s complement, modulo 256, ...) but without success. I have read other stackexchange posts about finding the checksum algorithm but couldn't apply them to my packets. I am stuck with this problem for a few days now and it seems that I am not making any progress.

These 3 packets might be helpful as they only differ in the first 3 bits of the 7th byte (b7) and the first 4 bits of the counter (b9).

|---b1---|---b2---|---b3---|---b4---|---b5---|---b6---|---b7---|---b8---|---b9---|---b10--|
|preamble|-------------------------rolling code-------------------------|counter-|checksum|
|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|
|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|
|01010101|10110100|01010110|11101111|00011011|11011001|10100111|11111001|01101011|01001101|

Here are some more packets:

|preamble|-------------------------rolling code-------------------------|counter-|checksum|
|01010101|10110100|01010110|11101111|00011011|11011001|10100011|11111001|01100111|01111000|
|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|
|01010101|00010111|11110101|01001100|10111000|01111010|01011010|10100001|01101001|10100000|
|01010101|00010110|11110100|01001101|10111001|01111011|01011011|10100000|01101010|10100101|
|01010101|10110100|01010110|11101111|00011011|11011001|10100111|11111001|01101011|01001101|
|01010101|00010001|11110011|01001010|10111110|01001100|01011100|00001000|10110100|01010011|
|01010101|00011001|11111011|01000010|10110110|01000100|00001001|01010100|10110101|00011000|
|01010101|10011001|01111011|11000010|00110110|11000100|11011100|11010100|11100000|00100001|
|01010101|01000100|10100110|00011111|11101011|00011001|00001001|11010101|11100001|01001110|
|01010101|01000101|10100111|00011110|11101010|00011000|00001000|11011110|11100010|11110110|
|01010101|01010100|10110110|00001111|11111011|01011001|00011001|11001101|00100001|10111101|
|01010101|01010101|10110111|00001110|11111010|01011000|00011000|11001110|00100010|00000101|
|01010101|10011011|01111001|11000000|00110100|10010110|11001111|11010110|00100011|11011011|
|01010101|01010001|10110011|00001010|11111110|01011100|00011100|11001000|00100100|00111001|
|01010101|10011001|01111011|11000010|00110110|10010100|11001001|11010100|00100101|01101111|
*these packets were not all recorded sequentially as you may notice some gaps in the counter.

I am new to the reverse engineering and signal processing scene so excuse me if I am not using the right terminology or if I am overlooking some simple things. p.s. please don't steal my car :)

EDIT 1

I found these packets where the checksum is the same that might help:

|preamble|-------------------------rolling code-------------------------|counter-|checksum|
|01010101|10110100|01010110|11101111|00011011|11011001|10100010|11111001|01101000|01001110|
|01010101|01000100|10100110|00011111|11101011|00011001|00001001|11010101|11100001|01001110|

|01010101|01010001|10110011|00001010|11111110|01011100|00011100|11000010|00101110|10111101|
|01010101|01010000|10110010|00001011|11111111|00111101|00011101|11000011|00001111|10111101|
  • What is the keyfob supposed to do? What do those packets mean (what is the car supposed to do when receiving it)? Are you sure that they are the checksum? How many different possible packets are there (if there are only for example 10 of them it may be easier to record them all and replay when needed) – user202729 Nov 4 '18 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.