4

I'm stuck trying to figure out how to calculate the two last checksum bytes (16-bits) of these packets. The remaining data fields are understood, and it is just the two last bytes that I am current unable to generate properly.

Below is a dump of many learned (recorded) packets from the retail/original remote control with correct checksum(CRC?) values at the end (the last two bytes). The format of this listing is comma separated bytes printed in decimal format.

196,215,0,14,197,176,7,50,1,155,165,1,133,220
196,215,0,14,197,176,7,50,2,155,165,1,30,0
196,215,0,14,197,176,7,50,2,155,165,2,46,99
196,215,0,14,197,176,7,50,2,155,165,2,46,99
196,215,0,14,197,176,7,50,3,155,165,2,88,215
196,215,0,14,197,176,7,50,4,155,165,17,43,168
196,215,0,14,197,176,7,50,5,155,165,17,93,28
196,215,0,14,197,176,7,50,5,155,165,17,93,28
196,215,0,14,197,176,7,50,5,155,165,17,93,28
196,215,0,14,197,176,7,50,5,155,165,18,109,127
196,215,0,14,197,176,7,50,6,155,165,18,246,163
196,215,0,14,197,176,7,50,6,155,165,18,246,163
196,215,0,14,197,176,7,50,8,155,165,33,82,201
196,215,0,14,197,176,7,50,8,155,165,33,82,201
196,215,0,14,197,176,7,50,8,155,165,33,82,201
196,215,0,14,197,176,7,50,9,155,165,34,20,30
196,215,0,14,197,176,7,50,9,155,165,34,20,30
196,215,0,14,197,176,7,50,9,155,165,34,20,30
196,215,0,14,197,176,7,50,11,155,165,176,90,141
196,215,0,14,197,176,7,50,16,155,165,49,222,156
196,215,0,14,197,176,7,50,16,155,165,49,222,156
196,215,0,14,197,176,7,50,16,155,165,50,238,255
196,215,0,14,197,176,7,50,18,155,165,66,125,0
196,215,0,14,197,176,7,50,19,155,165,66,11,180
196,215,0,14,197,176,7,50,19,155,165,66,11,180
196,215,0,14,197,176,7,50,19,155,165,65,59,215
196,215,0,14,197,176,7,50,19,155,165,65,59,215
196,215,0,14,197,176,7,50,21,155,165,82,62,28
196,215,0,14,197,176,7,50,21,155,165,82,62,28
196,215,0,14,197,176,7,50,22,155,165,81,149,163
196,215,0,14,197,176,7,50,22,155,165,81,149,163
196,215,0,14,197,176,7,50,23,155,165,176,14,24
196,215,0,14,197,176,7,50,23,155,165,176,14,24
196,215,0,14,197,176,7,50,24,155,165,176,218,246
196,215,0,14,197,176,7,50,24,155,165,176,218,246
196,215,0,14,197,176,7,50,27,155,165,160,83,27
196,215,0,14,197,176,7,50,30,155,165,161,255,127
196,215,0,14,197,176,7,50,34,155,165,162,172,199
196,215,0,14,197,176,7,50,37,155,165,192,177,14
196,215,0,14,197,176,7,50,42,155,165,192,101,224
196,215,0,14,197,176,7,50,45,155,165,100,193,163
196,215,0,14,197,176,7,50,48,155,165,96,163,6
196,215,0,14,197,176,7,50,50,155,165,96,78,110
196,215,0,14,197,176,7,50,52,155,165,100,41,115
196,215,0,14,197,176,7,50,53,155,165,101,79,230
196,215,0,14,197,176,7,50,53,155,165,105,142,106
196,215,0,14,197,176,7,50,54,155,165,106,37,213
196,215,0,14,197,176,7,50,55,155,165,107,67,64
196,215,0,14,197,176,7,50,55,155,165,108,51,167
196,215,0,14,197,176,7,50,55,155,165,109,35,134
196,215,0,14,197,176,7,50,56,155,165,110,199,11
196,215,0,14,197,176,7,50,56,155,165,110,199,11
196,215,0,14,197,176,7,50,57,155,165,110,177,191
196,215,0,14,197,176,7,50,57,155,165,110,177,191
196,215,0,14,197,176,7,50,57,155,165,110,177,191
196,215,0,14,197,176,7,50,58,155,165,109,26,0
196,215,0,14,197,176,7,50,58,155,165,108,10,33
196,215,0,14,197,176,7,50,59,155,165,107,12,114
196,215,0,14,197,176,7,50,59,155,165,106,28,83
196,215,0,14,197,176,7,50,59,155,165,105,44,48
196,215,0,14,197,176,7,51,0,155,165,104,164,182
196,215,0,14,197,176,7,51,0,155,165,103,85,89
196,215,0,14,197,176,7,51,1,155,165,102,51,204
196,215,0,14,197,176,7,51,1,155,165,101,3,175
196,215,0,14,197,176,7,51,1,155,165,100,19,142
196,215,0,14,197,176,7,51,2,155,165,99,248,181
196,215,0,14,197,176,7,51,2,155,165,98,232,148
196,215,0,14,197,176,7,51,3,155,165,97,174,67
196,215,0,14,197,176,7,51,3,155,165,97,174,67
196,215,0,14,197,176,7,51,3,155,165,97,174,67
196,215,0,14,197,176,7,51,4,155,165,97,255,110
196,215,0,14,197,176,7,51,4,155,165,97,255,110
196,215,0,14,197,176,7,51,7,155,165,96,116,147
196,215,0,14,197,176,7,51,9,155,165,113,212,217
196,215,0,14,197,176,7,51,12,155,165,112,120,189
196,215,0,14,197,176,7,51,15,155,165,113,243,64
196,215,0,14,197,176,7,51,16,155,165,114,12,106
196,215,0,14,197,176,7,51,16,155,165,115,28,75
196,215,0,14,197,176,7,51,16,155,165,116,108,172
196,215,0,14,197,176,7,51,17,155,165,117,10,57
196,215,0,14,197,176,7,51,17,155,165,118,58,90
196,215,0,14,197,176,7,51,17,155,165,119,42,123
196,215,0,14,197,176,7,51,18,155,165,119,177,167
196,215,0,14,197,176,7,51,18,155,165,119,177,167
196,215,0,14,197,176,7,51,19,155,165,119,199,19
196,215,0,14,197,176,7,51,19,155,165,119,199,19
196,215,0,14,197,176,7,51,19,155,165,119,199,19
196,215,0,14,197,176,7,51,20,155,165,118,134,31
196,215,0,14,197,176,7,51,20,155,165,117,182,124
196,215,0,14,197,176,7,51,20,155,165,116,166,93
196,215,0,14,197,176,7,51,21,155,165,115,160,14
196,215,0,14,197,176,7,51,21,155,165,114,176,47
196,215,0,14,197,176,7,51,21,155,165,113,128,76
196,215,0,14,197,176,7,51,22,155,165,113,27,144
196,215,0,14,197,176,7,51,22,155,165,113,27,144
196,215,0,14,197,176,7,51,22,155,165,113,27,144
196,215,0,14,197,176,7,51,22,155,165,113,27,144
196,215,0,14,197,176,7,51,23,155,165,113,109,36
196,215,0,14,197,176,7,51,26,155,165,112,68,131
196,215,0,14,197,176,7,51,30,155,165,176,87,62

Data format:

196,215,0,REMOTESERIAL_hibyte,REMOTESERIAL_lobyte,176,TIME_HOUR,TIME_MINUTE,TIME_SECOND,ALARM_HOUR|(ALARM_ENABLE<<7),ALARM_MINUTE,COMMAND,CHECKSUM1,CHECKSUM2

The two first bytes (196,215) are probably a 16-bit sync word [magic value]. There is a preamble in front with 4 times 0xAA bytes to sync the receiver clock, but I don't think that is part of the checksum as the data is used to sync the receiver and thus can often be garbled before the receiver AGC stabilizes. In any case those initial values are static and will not change the checksum values from packet to packet.

There is an RTC (Real Time Clock) chip inside the remote and each packet contains HH:MM:SS time, so that is responsible for changing the checksum values often even though the previous command is repeated. I have never seen only one of the checksum values change alone. When there is a change in the packet data, both checksum bytes always seem to change, not just one of them.

The chip used in the remote is a ChipCon CC1050 (433MHz). According to the datasheet this chip does not have CRC support built-in, unlike later models like the CC1101. The CRC algorithm for that and other chips are detailed in Design Note DN502: https://www.ti.com/lit/an/swra111e/swra111e.pdf?ts=1618523904103

I have tried this algorithm (and two other CRC16 algorithms I found online) with the packet data and various portions of it, with and without the preamble and sync words to no avail. I did this also with a brute force of all 65536 possible initial values for the 16-bit CRC, to no avail.

I hope someone can figure this out, because I have tried many different approaches but seem to be hitting my head in the wall at the moment. :)

Improve this question

1 Answer 1

Reset to default
3

I finally figured it out myself. I used the CRC RevEng utility obtained from here: https://reveng.sourceforge.io/

..to find the algorithm was CRC-16/XMODEM with polynomial 0x1021 and initial value 0. That was actually one of the algorithms I had tried earlier, and I had brute-forced the polynomial, but not the initial value which I had at something else from the CRC16 example source I had obtained online.

Here is the reveng command line I used to detect the algorithm. I supplied 6 samples on the command line, and later tried the suggested algorithm on all recorded samples and it all matches.

abcde@ub18:~/reveng-2.1.1$ ./reveng -w 16 -q 40000000 -s c4d7000ec5b00732019ba50185dc c4d7000ec5b00732029ba5011e00 c4d7000ec5b00732029ba5011e00 c4d7000ec5b00732029ba5011e00 c4d7000ec5b00732029ba5011e00 c4d7000ec5b00732029ba5011e00
width=16  poly=0x1021  init=0x0000  refin=false  refout=false  xorout=0x0000  check=0x31c3  residue=0x0000  name="CRC-16/XMODEM"
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.