Reverse engineering CRC and rolling code

Question

Using an SDR I read out the transmitted message of a key fob for my old car. The car is a 98 Mercury Grand Marquis. It's quite old so I dought it's very sophisticated.

55549d1748c2aa11d2044f
55549d1748c2aa12b70132
55549d1748c2aa139c081f
55549d1748c2aa148102ff
55549d1748c2aa156604e7
55549d1748c2aa164b01ca
55549d1748c2aa173008b7
55549d1748c2aa18150297
55549d1748c2aa19fa047f
55549d1748c2aa1adf0162
55549d1748c2aa1bc4084f
55549d1748c2aa1ca9022f
55549d1748c2aa1d8e0417
55549d1748c2aa1e7301fa
55549d1748c2aa1f5808e7
55549d1748c2aa203d02c7
55549d1748c2aa212204af
55549d1748c2aa22070192
55549d1748c2aa23ec087f
55549d1748c2aa24d1025f
55549d1748c2aa25b60447
55549d1748c2aa269b012a
55549d1748c2aa27800817
55549d1748c2aa286502f7
55549d1748c2aa294a04df

Here is some of the data I've captured. What I have so far is as follows.

Bytes 1-6 never change. I assume they are like a signature or serial number or ID of some sorts.

Bytes 7 and 8 count up. I'm guessing this is the number only used once. When byte 8 rolls over, byte 7 increments.

Byte 9 seems random. It might be the rolling code.

Byte 10 is the button being pressed. The fob has 4 buttons and there are four numbers that show up here: 0x04, 0x08, 0x01, and 0x02.

Byte 11 also seems random. I assume this is the CRC just because it shows up at the end of the message.

I've tried using reveng with no success. I fed it all of the listed data and more and it always comes back with "no model found". I'm not at all familiar with using reveng so just in case I'm an idiot here are the commands I've tried. each command was followed by the data through a batch file.

reveng -w 8 -s
reveng -w 8 -l -s
reveng -w 8 -F -s
reveng -w 8 -l -F -s

Any thoughts or ideas would be appreciated.

Edit 1

It seems that I may have cracked the checksum. It is a simple sum of the message. The catch is that the first 2 bytes are not included. Also, the sum is truncated to just the least significant byte. I have not exhaustively checked the whole data set but spot checking seems to work 100% of the time.

9d1748c2aa11d2044f  34f
9d1748c2aa12b70132  332
9d1748c2aa139c081f  31f
9d1748c2aa164b01ca  2ca
9d1748c2aa173008b7  2b7
9d1748c2aa19fa047f  37f
9d1748c2aa1adf0162  362
9d1748c2aa1d8e0417  317
9d1748c2aa1e7301fa  2fa

Answer 1

Figured it out. It was not as complicated as I thought. Here is how it goes.

9d1748c2aa11d2044f
9d1748c2aa12b70132
9d1748c2aa139c081f
9d1748c2aa164b01ca
9d1748c2aa173008b7
9d1748c2aa19fa047f
9d1748c2aa1adf0162
9d1748c2aa1d8e0417
9d1748c2aa1e7301fa

The 0x55 and 0x54 at the beginning of the message are the preamble and are not important.

Bytes 1-4 never change. I assume they are like a signature or serial number or ID of some sorts.

Bytes 5 and 6 count up. I'm guessing this is the number only used once. When byte 8 rolls over, byte 5 increments.

Byte 8 is the button being pressed. The fob has 4 buttons and there are four numbers that show up here: 0x04, 0x08, 0x01, and 0x02.

Byte 9 is the CRC. It is simply the sum of all the bytes and then gets truncated to the least significant byte.

Byte 7 might be the rolling code. If this is the rolling code then it's not super secure. Byte 7 is always 0x1b less than the last one. For instance, in the data set the first two entries are consecutive. 0xd2 - 0x1b = 0xb7 which is byte 7 of the following message. As long as you capture at least one message then any message can be reproduced using the counting number to see how many 0x1b to subtract.

Edit

Just came across someone with a 2004 Mercury Grand Marquis. The ID for their remote was different but the rolling code and CRC schemes were exactly the same.

I reckon that every Ford remote that looks like this uses this same scheme.