I am trying to determine the algorithm behind a 32-byte protected section of memory on a big-endian system. It will render invalid if even a single bit is changed, but I can generate any number of valid 32-byte messages.
Here shows a variety of example data. I believe the last 4 bytes are the checksum. All of them are accepted by the algorithm.
00000000000000000000000000000000000000000007478A000101004892B760 F0000000000000000000000000000000000000000002D8DF00010100C9E23610 3065C0000000000000000000000000000000000000006F850001010060EB9F07 FFFFFFFF03FC6BBD000000000000000000000000000000000001010070B88F3A FFFFFFFF0397E33D340C804138458C5006060968570C214B0001017AE8F416FE
I was able to create a bunch of custom messages with very little differences. Doesn't seem like it could be a CRC-32.
FFFFFFFF01671F7E000000000000000000000000000000000001010021E4DE0E (00) FFFFFFFF01671F84000000000000000000000000000000000001010021EADE08 (01) FFFFFFFF01671F88000000000000000000000000000000000001010021EEDE04 (02) FFFFFFFF01671F86000000000000000000000000000000000001010021ECDE06 (03) FFFFFFFF01671F8C000000000000000000000000000000000001010021F2DE00 (04) FFFFFFFF01671F8A000000000000000000000000000000000001010021F0DE02 (05) FFFFFFFF01671F86000000000000000000000000000000000001010021ECDE06 (06) FFFFFFFF01671F8C000000000000000000000000000000000001010021F2DE00 (07) FFFFFFFF01671F90000000000000000000000000000000000001010021F6DDFC (08)
All of the input bytes are the same, except one byte that increases by 1 in each message.
Here is a list of 50 or so pairs.
Basically, are there any analysis methods that can be applied to a set of data to determine some properties of the algorithm? I can generate any number of these messages, and verify that they are accepted.
Edit: By shifting a single bit, I noticed that 0x04 was added to two bytes, but subtracted to another (F84 -> F88, 1EA -> 1EE, E08 -> E04). After some experimentation (Mainly adding and subtracting different values and testing them) I was lucky that it turned out to be a summation of the fourteen preceding 16-bit words. AND-masking the sum by 0xFFFF, this value equals 15th word (e.g. 21EA in the first message). This value is then subtracted from 0xFFF2 to produce the 16th word in the message.