12
votes
Accepted
Finding out checksum algorithm
It's a big-endian CRC16 (polynomial 0x8005) of the data from the byte following the 0x82 up to and including the byte before the CRC.
For example, for your last RX frame:
82 00 00 00 ff 00 00 00 01 ...
- 881
10
votes
Accepted
Backblaze 16-bit checksum ("bzsanity")
I'll use "test@test.com" for the sake of example.
Algorithm
Convert the email address to its ASCII bytes. For example, the ASCII bytes for "test@test.com" are 74 65 73 74 40 74 65 73 74 2E 63 6F 6D.
...
- 20.5k
8
votes
Accepted
I really struggled to figure it out, now can anyone help me reverse engineer this checksum?
The key is getting getting a megaton of samples, so that the analysis has something to feed on. It really helps if you can stick the samples in a database table or dictionary that can be queried ...
- 1,960
8
votes
Accepted
Reverse engineer 4-bit CRC in LG IR packet
This seems to be a checksum, just as you state in your question, not a CRC as mentioned in the header.
Group the values into blocks of 4 bits, add them, ignore overflow (in these examples, ignore ...
- 12.7k
7
votes
Accepted
Hash algorithm written in C decompiled with IDA
-1640531527 is hexadecimal '0x9e3779b9'.
This number is used in boost hash function.
The code here in function ub4 hash( k, length, initval) looks similar to yours, at least in the last part.
I think ...
- 7,875
7
votes
Bypassing CRC check
The message "crc changed, discarding .udd data" is from OllyDbg itself, not from your target application.
- 20.5k
6
votes
Accepted
What Checksum/CRC algorithm in RF packet?
The checksum algorithm is simple indeed. It adds all the payload bytes modulo 0xFF and then adds 26.
I wrote a script to test it:
#!/usr/bin/python
import binascii
def checksum(data):
payload =...
- 1,341
6
votes
Hash algorithm written in C decompiled with IDA
Some more low-level details:
What is the purpose of (*(_BYTE *)(content + 7) << 24) isn't a byte only 8 bits, so won't it be 0 every time?
In C, shifts implicitly promote the operand to at ...
- 61
6
votes
Accepted
Reverse-engineering a weird 24-bit possibly not CRC checksum
The answer turns out to be very simple, once you understand what CRC is.
It's similar to a CRC -- the checksum is the remainder when dividing the input by the polynomial with truncated representation ...
- 665
6
votes
Accepted
Identification of RF hash algorithm
As explained there for a similar problem, facing an unknown Frame Check Sequence, the first thing should be to determine if it is an affine function of the frame data, for the sense that has in ...
- 176
4
votes
Hash algorithm written in C decompiled with IDA
Just a small addition to the previous answers.
The following shift construct, asked in 3, is a widely used way to convert a byte stream into a 32-bit integer.
(*(_BYTE *)(content + 7) << 24)
...
- 1,731
4
votes
Accepted
Reverse engineering serial communication CRC algorithm
This question seems simpler than you might expect.
Since as OP noted, the code is irrelevant to validation mechanism used in the discussed system, I shall ignore it. It is indeed irrelevant as will ...
- 11.4k
4
votes
Backblaze 16-bit checksum ("bzsanity")
As CTO and founder of Backblaze, I wrote the original source code of the Backblaze client, and Jason Geffner above is correct. That is:
hexencode the email address (all lowercase, email addresses are ...
- 41
4
votes
Accepted
Reverse engineering CRC and rolling code
Figured it out. It was not as complicated as I thought. Here is how it goes.
9d1748c2aa11d2044f
9d1748c2aa12b70132
9d1748c2aa139c081f
9d1748c2aa164b01ca
9d1748c2aa173008b7
9d1748c2aa19fa047f
...
- 171
4
votes
Reverse engineering the IBM BSC (Bisync) protocol
If you have known data and a known CRC, and an unknown value (like the initial CRC value or the final XOR value), you can always loop through all possible values and find those that give you the ...
- 341
4
votes
Accepted
Reverse engineering the IBM BSC (Bisync) protocol
SOLUTION
I got help from a guy named Peter. He gave me a piece of test code in C. The CRC algorithm looked pretty similar to the ones I already tried. But what was important was that he pointed out ...
- 71
4
votes
Accepted
Finding the hash algorithm for these payload-crc pairs
Based on the data provided, it appears to be a very simple check with the 5th byte being the sum of the first 3 bytes exclusive-or'd with the 4th byte.
// input bytes
byte b[4];
// check byte
byte c =...
- 2,229
3
votes
CRC32 reverse engineer without knowing parameters, but knowing the input value
I wanted to give this a try because it seemed interesting but I did not succeed.
Still, maybe this will lead you in the right direction for further tests.
I started reading some introduction ...
- 1,341
3
votes
Reverse engineer CAN-Bus checksum
As can be demonstrated by this page:
CRC width: CRC-8
CRC parametrization: Predefined, CRC8_SAE_J1850 (Polynomial: 0x1d, Initial value: 0xff, Final xor: 0xff)
CRC Input Data: Bytes, D1-D7
- 881
3
votes
Trying to figure out the CRC or checksum for a Fluke 233 wireless display multimeter
Your algorithm is probably the following:
width=16 poly=0x1021 init=0xffff refin=true refout=true xorout=0xffff check=0x906e name="X-25"
Operating on the whole packet except the first two ...
- 31
3
votes
Accepted
Reverse engineer checksum algorithm
You seem to have the same air conditioner like the guy who asked this question. Add up bytes 0-11, xor with 0x55 to get byte 12.
It could help if you stated the brand and model number of your AC unit,...
- 12.7k
3
votes
Accepted
Behringer CRC8 algorithm
Well thanks to @IgorSkochinsky who suggested in another question of mine to try a disassembler, I found a Docker image that contained a Blackfin toolchain which allowed me to use objdump to ...
- 341
3
votes
Accepted
Decoding algorithm with checksum
Looks like it's just addition for the checksum, so nice job on that.
The mystery byte is part of the checksum.
The accumulator is 2 bytes.
data = """...
- 798
3
votes
Reverse engineering 16-bit checksum algorithm for 433Mhz RF remote control
I finally figured it out myself. I used the CRC RevEng utility obtained from here:
https://reveng.sourceforge.io/
..to find the algorithm was CRC-16/XMODEM with polynomial 0x1021 and initial value 0. ...
- 71
2
votes
Reverse engineering of some checksum algorithm
(I was trying to add this as a comment, but don't have enough reputation points)
I noticed the consecutive checksums {00,00,10,00,10} repeat 21 times in the first 1100 samples of which 8 times with ...
- 41
2
votes
De-ciphering help needed
I edited your example data to include block- and line numbers to make referencing them easier. Unfortunately, this increased the size of the question to more than 32K, so i had to throw away some ...
- 12.7k
2
votes
Daikin A/C 4bit CRC/Checksum
Not sure why my last question was deleted.. anyway here is the answer - the bit order of the sum at the end is reversed..
uint8_t rev(uint8_t b) {
b = (b & 0xF0) >> 4 | (b & 0x0F) &...
- 21
2
votes
how to bypass CRC checksum in firmware header
You cannot bypass it, you must recalculate all required checksums.
Ubiquiti XW firmware is made from parts below:
UBNT <version-string> CRC32(header part) <4byte padding>
PART u-boot <...
- 121
2
votes
Accepted
Figuring out the CRC part of a packet
The CRC is, as suspected, a fairly standard CRC16 with the polynomial 0x8005 (reflected: 0xA001). The only online calculators that I could find for this are:
BobTech's (clear the 'reverse data bytes' ...
- 1,960
2
votes
Find out the checksum/crc/whatever is used in this file
There are many ways to go about solving this, but here's how I might approach it based on a common workflow of mine for hacking games (you could say I'm the resident game-hacker around here). Before ...
- 2,154
Only top scored, non community-wiki answers of a minimum length are eligible