1

I'm trying to reverse engineer a serial protocol of a compressor, but i've no luck calculation the checksum.

e.g. here are some messages including the 16-bit checksum at the end of the message.

ff 02 ff 01 10 00 10 00 41 9e e2
ff 02 ff 01 10 00 10 00 42 9d e3
02 fe 03 00 00 00 00 00 00 fd c1
00 fe 02 83 01 10 00 00 00 00 6c c1

By now i know following octets

00  target addr
fe  seems like a seperator
02  own addr
83  register addr
01  value1 high
10  value1 low
00  value2 high
00  value2 low
00  value3 high
00  value3 low
6c  Checksum
c1  Checksum

I've tried to calculate the Checksum with different 16-Bit CRC's and brute-forcing with "reveng", but sadly i had no luck.

Also there is no way to put own Bits into the checksum function, but i can provide additional messages.

Can anybody help?

  • 2
    Why not reverse engineer the code that produces the checksum? – Jason Geffner Jan 26 '15 at 19:53
1

The first byte is a simple checksum variant. In C:

uint8_t firstbyte( uint8_t const *data, size_t bytes )
{
    uint8_t sum;
    for (sum = 0; bytes; --bytes)
        sum -= *data++;
    return sum;
}

The second byte is a shift and add thing something like the BSD checksum:

uint8_t secondbyte( uint8_t const *data, size_t bytes )
{
    uint8_t sum;
    for (sum = 0; bytes; --bytes) {
        sum = (sum << 1) | ((sum & 0x80) ? 1 : 0);
        sum += *data++;
    }
    return sum;
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.