Skip to main content
6 votes
Accepted

What Checksum/CRC algorithm in RF packet?

The checksum algorithm is simple indeed. It adds all the payload bytes modulo 0xFF and then adds 26. I wrote a script to test it: #!/usr/bin/python import binascii def checksum(data): payload =...
Johann Aydinbas's user avatar
6 votes
Accepted

Identification of RF hash algorithm

As explained there for a similar problem, facing an unknown Frame Check Sequence, the first thing should be to determine if it is an affine function of the frame data, for the sense that has in ...
fgrieu's user avatar
  • 186
5 votes
Accepted

Reverse-engineering a weird 24-bit possibly not CRC checksum

The answer turns out to be very simple, once you understand what CRC is. It's similar to a CRC -- the checksum is the remainder when dividing the input by the polynomial with truncated representation ...
user202729's user avatar
5 votes
Accepted

CRC8 reverse engineering

Use that same page, and select CRC_SAE_J1850, but then switch to 'Custom' and change the 'Final Xor Value' to 0x7a. The settings should be: Input Reflected: No Output Reflected: No Polynomial: 0x1d ...
booto's user avatar
  • 931
4 votes
Accepted

Reverse engineering serial communication CRC algorithm

This question seems simpler than you might expect. Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Reverse engineering CRC and rolling code

Figured it out. It was not as complicated as I thought. Here is how it goes. 9d1748c2aa11d2044f 9d1748c2aa12b70132 9d1748c2aa139c081f 9d1748c2aa164b01ca 9d1748c2aa173008b7 9d1748c2aa19fa047f ...
vini_i's user avatar
  • 171
4 votes
Accepted

Reverse engineering the IBM BSC (Bisync) protocol

SOLUTION I got help from a guy named Peter. He gave me a piece of test code in C. The CRC algorithm looked pretty similar to the ones I already tried. But what was important was that he pointed out ...
Mattis Lind's user avatar
4 votes

Reverse engineering the IBM BSC (Bisync) protocol

If you have known data and a known CRC, and an unknown value (like the initial CRC value or the final XOR value), you can always loop through all possible values and find those that give you the ...
Malvineous's user avatar
4 votes
Accepted

Finding the hash algorithm for these payload-crc pairs

Based on the data provided, it appears to be a very simple check with the 5th byte being the sum of the first 3 bytes exclusive-or'd with the 4th byte. // input bytes byte b[4]; // check byte byte c =...
Ian Cook's user avatar
  • 2,558
4 votes
Accepted

Figuring out a (possibly 16-bit) CRC algorithm

These are simple XOR checksums. Here's how they work using a short message as an example: STX |<------------- data -------------->|s1 |s2 02 30 80 41 44 3b 43 57 ff 03 66 e4 The ...
Edward's user avatar
  • 2,521
4 votes
Accepted

What is 'standard' CRC-16?

This seems to be CRC-16/MODBUS. Parameter specification can be found on this nice list of CRC16 specifications: width=16 poly=0x8005 init=0xffff refin=true refout=true xorout=0x0000 check=0x4b37 ...
ynwarcs's user avatar
  • 441
3 votes
Accepted

Behringer CRC8 algorithm

Well thanks to @IgorSkochinsky who suggested in another question of mine to try a disassembler, I found a Docker image that contained a Blackfin toolchain which allowed me to use objdump to ...
Malvineous's user avatar
3 votes

Trying to figure out the CRC or checksum for a Fluke 233 wireless display multimeter

Your algorithm is probably the following: width=16 poly=0x1021 init=0xffff refin=true refout=true xorout=0xffff check=0x906e name="X-25" Operating on the whole packet except the first two ...
regregex's user avatar
  • 131
3 votes

CRC32 reverse engineer without knowing parameters, but knowing the input value

I wanted to give this a try because it seemed interesting but I did not succeed. Still, maybe this will lead you in the right direction for further tests. I started reading some introduction ...
Johann Aydinbas's user avatar
3 votes

Reverse engineer CAN-Bus checksum

As can be demonstrated by this page: CRC width: CRC-8 CRC parametrization: Predefined, CRC8_SAE_J1850 (Polynomial: 0x1d, Initial value: 0xff, Final xor: 0xff) CRC Input Data: Bytes, D1-D7
booto's user avatar
  • 931
3 votes
Accepted

Reverse engineer checksum algorithm

You seem to have the same air conditioner like the guy who asked this question. Add up bytes 0-11, xor with 0x55 to get byte 12. It could help if you stated the brand and model number of your AC unit,...
Guntram Blohm's user avatar
3 votes
Accepted

Decoding algorithm with checksum

Looks like it's just addition for the checksum, so nice job on that. The mystery byte is part of the checksum. The accumulator is 2 bytes. data = """...
pythonpython's user avatar
3 votes

Reverse engineering 16-bit checksum algorithm for 433Mhz RF remote control

I finally figured it out myself. I used the CRC RevEng utility obtained from here: https://reveng.sourceforge.io/ ..to find the algorithm was CRC-16/XMODEM with polynomial 0x1021 and initial value 0. ...
KevinD's user avatar
  • 71
3 votes

determine if 2 byte checksum is CRC-16 based

You could try with CRC Beagle.
Loïc Damien's user avatar
2 votes

De-ciphering help needed

I edited your example data to include block- and line numbers to make referencing them easier. Unfortunately, this increased the size of the question to more than 32K, so i had to throw away some ...
Guntram Blohm's user avatar
2 votes

Daikin A/C 4bit CRC/Checksum

Not sure why my last question was deleted.. anyway here is the answer - the bit order of the sum at the end is reversed.. uint8_t rev(uint8_t b) { b = (b & 0xF0) >> 4 | (b & 0x0F) &...
daikin's user avatar
  • 21
2 votes

how to bypass CRC checksum in firmware header

You cannot bypass it, you must recalculate all required checksums. Ubiquiti XW firmware is made from parts below: UBNT <version-string> CRC32(header part) <4byte padding> PART u-boot <...
mindc's user avatar
  • 121
2 votes

Find out the checksum/crc/whatever is used in this file

There are many ways to go about solving this, but here's how I might approach it based on a common workflow of mine for hacking games (you could say I'm the resident game-hacker around here). Before ...
dsasmblr's user avatar
  • 2,234
2 votes
Accepted

Simple 8bit checksum

It is a plain byte sum. for the last line: aa+1c+01+01+04+39+00+00+00+00+00+00+00+00+02+a6+00+00+14+29+00+00+25+dc = 02EB
Willem Hengeveld's user avatar
2 votes

reverse a RF rolling code

Partial Answer: Looking only at the last 2bytes in binary shows some patterns where groups of bits are being flipped between groups of 4 messages ( Not2, Not3), or between groups of 8 (Not4). The ...
pythonpython's user avatar
2 votes

Checksum in CANbus Message

Assuming this is CAN, then there is already a CRC as part of the CAN Spec. Here is a writeup on the CAN CRC. There's some python implementations which build CAN CRCs you could try adapting.
pythonpython's user avatar
2 votes

Trying to find a checksum (possible CRC?) algorithm for CAN messages on a Porsche

The answer See the code at the end for how to calculate this, but if you're interested, here are the details explaining how I got there. Throughout this text, numbers are mostly in hex, so keep that ...
Edward's user avatar
  • 2,521
2 votes
Accepted

Reverse engineering Roland TR-8S kit file format .t8k

After having unsuccessfully looking for complicated things I tried to think like a software developer and I found this: CRC32 of "534d504c00000200cdcde87e" = 0xdddcdb3c
Gordon Freeman's user avatar
2 votes

Is there a software that can reverse calculate checksums by brute force?

The OA Labs hashdb project has a general framework for this, though it's primarily aimed at strings. Nonetheless, it does have a hefty list of algorithms implemented and an easy way to run them ...
goatshriek's user avatar
2 votes

2-byte checksum

I do not know what type of CRC-8 this is. I tried everything and I found the solution. Please, see the code below. It works if you do not take 4 first bytes into calculation. Maybe it will help ...
kostinalex's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible