Im reverse engineering a Keyborard RGB LED Control Software and there is a Library called "HidServ.dll" that seems to be the interface between the Keyboard and the Software. Every Function of that Library is called like this for example: (This is my translation of the assembler code, the function names are not the real ones)

int arghash1 = ArgHash(0, arg1, arg1len);
int arghash2 = ArgHash(ahash1, arg2, arg2len);
int arghash3 = ArgHash(ahash2, arg3, arg3len);

int count = HidServ.RequestGetDeviceCount(arg1, arg2, arg3, arghash3, 0);

It seems to compute some kind of hash of the first 3 arguments. Heres the the ArgHash function:

public unsafe static int ArgHash(int startvalue, byte* argumentPtr, int length)

    for (int i = 0; i < length; i++)
        startvalue += cryptarray[*(argumentPtr + i)];

    return startvalue;

So basically the function adds together the values of cryptarray on the indexes of the values of each byte of an argument.

The cryptarray is 256 bytes long and looks like this:

private static byte[] cryptarray = new byte[]
        0xFD, 0x86, 0xD1, 0xCA, 0xDB, 0xD5, 0xCC, 0x5E, 0x02, 0x0E, 0xE0, 0xB6, 0xA9, 0xF7, 0x6D, 0xA8,
        0xE2, 0x77, 0x0D, 0x09, 0xFE, 0x3D, 0x9A, 0x0B, 0x28, 0x85, 0xDC, 0xC3, 0x52, 0x48, 0x00, 0x01,
        0xBE, 0x79, 0x51, 0xFF, 0xB7, 0x83, 0xA2, 0x14, 0x10, 0x20, 0x82, 0xED, 0xD9, 0x16, 0x43, 0x4F,
        0x1C, 0x90, 0xC6, 0xD8, 0xBF, 0x56, 0x0C, 0x5C, 0xAA, 0xD3, 0x95, 0x0A, 0x73, 0x21, 0x67, 0xEB,
        0xDD, 0xA4, 0x8E, 0x26, 0xB8, 0xF2, 0xE8, 0x25, 0x1F, 0x59, 0x66, 0x1D, 0x61, 0x1E, 0xBB, 0xE5,
        0x99, 0xC5, 0x8F, 0xBC, 0xA6, 0xEE, 0x33, 0xB0, 0x53, 0x89, 0xD0, 0x2E, 0xC7, 0x88, 0xCE, 0x45,
        0x4C, 0xB2, 0x23 ,0x76, 0xB1, 0xF0, 0xF8, 0xCD, 0xFC, 0x06, 0x19, 0x29, 0x37, 0x98, 0x7E, 0x22,
        0xA7, 0xDA, 0x32, 0x60, 0x08, 0x8C, 0x24, 0x8A, 0x84, 0xC4, 0x4A, 0x12, 0x70, 0xB9, 0x49, 0x74,
        0x30, 0xE1, 0x2A, 0x4E, 0x2D, 0x4B, 0x7C, 0x5F, 0x71, 0xC8, 0x04, 0x41, 0x81, 0x63, 0x3F, 0xF3,
        0x6C, 0xF1, 0x8D, 0x9B, 0x6E, 0xAD, 0x6F, 0xB3, 0x38, 0x54, 0x2C, 0x87, 0x64, 0x7B, 0x0F, 0xC9,
        0xFA, 0xC0, 0xDF, 0xFB, 0xF4, 0xD7, 0x07, 0x92, 0x69, 0xC2, 0x7D, 0x1B, 0x80, 0x68, 0xB4, 0x15,
        0x47, 0x50, 0x57, 0x39, 0x3B, 0x2B, 0x5A, 0xD4, 0x13, 0x6B, 0xB5, 0x3E, 0x1A, 0xE3, 0x9D, 0xF9,
        0x17, 0x35, 0x46, 0x78, 0x75, 0xA5, 0x6A, 0x55, 0x9C, 0x4D, 0xEC, 0xA3, 0x36, 0x31, 0xE9, 0xF6,
        0x62, 0xEF, 0x40, 0xC1, 0xBD, 0x94, 0x3A, 0x96, 0x11, 0x97, 0x7F, 0x72, 0x9E, 0x7A, 0xBA, 0xE6,
        0xCF, 0xAF, 0x18, 0x44, 0xEA, 0x03, 0x9F, 0x2F, 0x93, 0xCB, 0x8B, 0xD6, 0xE4, 0x58, 0x5D, 0xA1,
        0x27, 0xE7, 0xAC, 0x91, 0xAB, 0x34, 0x3C, 0x05, 0xAE, 0x5B, 0x42, 0x65, 0xA0, 0xF5, 0xD2, 0xDE

Does anyone know which Encryption algorythm this is? Is it the USB CRC5 Algorythm?

  • cryptarray looks like an sbox. startvalue is just sum of all the lookups in cryptarray - substitution of all bytes.
    – sudhackar
    Apr 2, 2019 at 4:22
  • I suspect its calculating some kind of checksum, but i dont really know which kind Apr 2, 2019 at 5:59
  • 1
    Its not any "kind of checksum". Its just the sum of substituted bytes. Simple sum.
    – sudhackar
    Apr 2, 2019 at 6:56
  • The sum has to have a purpose. And since its a HID library, the receiving device may also calculate the sum from the the received data and compares it to the given sum. In this case it would be called a checksum. I dont know for sure if its really a checksum (that's why I'm asking here) but to reject my assumptions without any explaination is not very helpful. Apr 2, 2019 at 17:52


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.