# Determining checksum algorithm from known values

I've been analyzing some SPI EEPROM memory, and tried to find out which Checksum algorithm has been used;

For example I've got data: 14567D9h and checksum 187h. Assuming it's normal 16 bit check sum I've got 86h - no match, but after adding 101h it magically changes to 391h

Another Example: 8ADh and check sum B5h with this one is normal - 16 bit checksum results with exact number: B5h (perfect match)

I've checked it with 28 samples i was able to intercept. For some values i have to add 101h to checksum and for some it is only needed to sum it up.

Parity check doesn't fit - if you want I can share some more data - all gathered in one excel file, and calculated. After few days of brainstorm with my friend we haven't come up with anything :/

Maybe there is some additional part in the Algorithm, which i haven't found out yet? CRC and tonnes of other algorithms were checked - only 16 bit checksum was giving any promising results Thanks for help in advance!

some data I've grabbed (more in spreadsheet):

``````F401 84290145h
D400 5D310145h
4000 79810145h
C100 0AB70000h
C100 0AB70000h
3401 F08500BEh
E901 FE2C00BEh
A400 01E400BFh
2A01 0D5D00BFh
7E00 208304D7h
C100 0AB70000h
``````

You can read it this way: checksum: 01F4 (lways 2 bytes) value: 01458429 (always 4 bytes)

as you can see you have to switch positions of the bytes to read data properly

I came across this via manual inspection.

Instead of treating the data like this:

``````struct record {
uint16_t csum;  // 01f4
uint32_t data; // 84290145h
};
``````

treat it like this:

``````struct record {
uint8_t csum;    // 0xf4
uint8_t data[5]; // { 0x01, 0x84, 0x29, 0x01, 0x45 }
};
``````

To calculate the checksum, just do a simple modulo-256 summation of the data bytes. This works out fine for the values you've included in your question.

• Thanks! You have given me new hope :D But the next question is where is this "one" comming from... – Wasilij Grigoriewicz Zaitsev Aug 15 '15 at 11:33
• It's in the data you captured and embedded in original post. If you mean something along the lines of "what does it signify?", that's pretty difficult to approach without knowing more detailed information about the context in which the data is used. – booto Aug 17 '15 at 3:53
• I thing I will be able to find out - in next two weeks i will do some bigger research. I will let you know what i found out , if you want – Wasilij Grigoriewicz Zaitsev Aug 18 '15 at 5:57