4

I am trying to create a communication interface using C Language to an Air conditioning system, after analyzing the data packets I have identified that the data packet is consist of an 8 bit CRC (I am pretty sure the CRC is the last byte because the rest of the data only changes when I change something in the settings).

So what I need to do now is to be able to reverse engineer the process on how to come up with this CRC

A802000000001F5D0000000073
A802000000001E5D0000000070
A802000000001D5D0000000071

In the data above I purposely changed 1F -> 1E -> 1D and as you can see the value of last byte changed from 73 -> 70 -> 71.

I tried different on-line CRC calculators but still had no luck.

I managed to capture more data samples:

A80300000004045D0000000045
A80300000004055D0000000044
A803000000040F61000000004A
A802000000040F61000000004B
A81200004004169A00000000FB
A81200004004159A00000000F8
A81200004004149A00000000E5
A81200084000149C00000000E7
A83200084000149C0000000087
A85200084000149C00000000A7

Any help would be greatly appreciated.

Improve this question
4
  • See RS-485 Checksum Reverse Engineering (Watlow EZ-Zone PM) - the takeaway is that you need to reverse engineer the client's code or the server's code. Any answer provided below would just be guessing.
    – Jason Geffner
    Commented Mar 10, 2015 at 12:58
  • I agree with Jason, reversing the code is the only sure method to achieve this. There are so many zeroes in your packets, we can only guess how they're used in the checksum bit. However, this certainly isn't a CRC (the output bits should change more depending on the input if it was), this seems rather like a primitive scheme to me (xor each byte with something, add up the values, xor the result with something else) since in many cases, adding 1 to a nibble subtracts 1 from the checksum.
    – Guntram Blohm
    Commented Mar 10, 2015 at 19:45
  • And there've been several questions (4460, 6927, 8097) where, given enough samples, the algorithm could be found. But, to do this in your case, longer sequences of "change a byte, check the result" would be helpful.
    – Guntram Blohm
    Commented Mar 10, 2015 at 19:47
  • 2
    Hi thank you for the response. Finally I got it.. it's actually not a CRC so Guntram was right!!! the formula is add up all the values then XOR with 0x55 (Magic Number) and so far everything is a hit if I try this formula to all data packets.
    – Nick
    Commented Mar 11, 2015 at 2:43

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.