CRC8 reverse engineering

Question

I am creating a CAN Bus on-bench testing solution which replicates the entire vehicle to test a single module. I have a number of messages that require a CRC byte in order to be valid. The messages are in little-endian byte order, and the CRC value is held in byte 0. I have collected valid messages with a changing 4 bit alive-counter along with their CRC byte with the hope someone can help. I have tried CRC reveng, but either do not know hot to use it correctly or it is unable to find the polynomial, as it shows "No models found" when searching.

For reference, I found documentation that suggests the polynomial used is the standard SAE J1850 CRC8 polynomial x^8 + x^4 + x^3 + x^2 + 1, with a CRC-ID in decimal of 166 (stated as used for the low byte). I have also tried with the online calculator available here: http://www.sunshine2k.de/coding/javascript/crc/crc_js.html, but cannot get the correct result.

If anyone could provide some assistance, I would greatly appreciate it. I would like help in clarifying the correct polynomial, along with any other relevant parameters. Here are a list of values captured:

CRC in Byte0

This is the text version of above. I've separated the CRC value in byte 0 from the rest of the message for clarity.

57   0000C0F0C1FFFF
0A   0100C0F0C1FFFF
ED   0200C0F0C1FFFF
B0   0300C0F0C1FFFF
3E   0400C0F0C1FFFF
63   0500C0F0C1FFFF
84   0600C0F0C1FFFF
D9   0700C0F0C1FFFF
85   0800C0F0C1FFFF
D8   0900C0F0C1FFFF
3F   0A00C0F0C1FFFF
62   0B00C0F0C1FFFF
EC   0C00C0F0C1FFFF
B1   0D00C0F0C1FFFF
56   0E00C0F0C1FFFF

Answer 1

Use that same page, and select CRC_SAE_J1850, but then switch to 'Custom' and change the 'Final Xor Value' to 0x7a.

The settings should be:

• Input Reflected: No
• Output Reflected: No
• Polynomial: 0x1d
• Initial Value: 0xff
• Final Xor Value: 0x7a

Use Byte1-Byte7 as input.

Given:

• crc_data[n] is the crc from your provided data for dataset n
• crc_sae_j1850[n] is the standard CRC SAE J1850 value for dataset n

I noticed that for any i, j:

crc_data[i] ^ crc_data[j] = crc_sae_j1850[i] ^ crc_sae_j1850[j]

e.g. for i=0, j=1:

0x57 ^ 0x0a = 0xd2 ^ 0x8f
0x5d        = 0x5d

This means that the final xor value can be adjusted to get the desired values:

new_final_xor = original_final_xor ^ crc_data[i] ^ crc_sae_j1850[i]
              = 0xff               ^ 0x57        ^ 0xd2
              = 0x7a