(i've also posted this question on stackoverflow before i found out there was a specific stackexchange site for reverse engineering. My bad. Original post here: https://stackoverflow.com/questions/26095009/need-help-reverse-engineering-a-crc16)
I'm trying to connect to the Safecom TA-810 (badge/registration system) to automate the process of calculating how long employee's have worked each day. Currently this is done by:
- Pulling the data into the official application
- Printing a list of all 'registrations'
- Manually entering the values from the printed lists into our HR application
This is a job that can take multiple hours which we'd like to see automated. So far the official tech support has been disappointing and refused to share any details.
Using wireshark I have been capturing the UDP transmissions and have pretty much succeeded in understanding how the protocol is built up. I'm only having issues with what i suppose is a CRC field. I don't know how it is calculated (CRC type and parameters) and using which fields ...
This is how a message header looks like:
D0 07 71 BC BE 3B 00 00 D0 07 - Message type 71 BC - This i believe is the CRC BE 3B - Some kind of session identifier. Stays the same for every message after the initial message (initial message has '00 00' as value) 00 00 - Message number. '01 00', '02 00', '03 00'
Header only examples E8 03 17 FC 00 00 00 00 -> initial request (#0, no session nr) D0 07 71 BC BE 3B 00 00 -> Initial response (#0, device sends a session nr) 4C 04 EF BF BE 3B 06 00 -> Message #6, still using the same session # as the initial response Larger example, which has data 0B 00 07 E1 BE 3B 01 00 7E 45 78 74 65 6E 64 46 6D 74
I've also been trying to figure this out by reading the disassembled code from the original application. The screenshot below happens before the socket.sendto and seems to be related.
Any help will be extremely appreciated.
EDIT: Made some success with debugging the application using ollydbg. The CRC appears in register (reversed) EDX at the selected line in the following screenshot.