I got help from a guy named Peter. He gave me a piece of test code in C. The CRC algorithm looked pretty similar to the ones I already tried. But what was important was that he pointed out that the first sample message most likely had a bit error.
int crc16(unsigned char *ptr, int count)
unsigned int crc;
If you have known data and a known CRC, and an unknown value (like the initial CRC value or the final XOR value), you can always loop through all possible values and find those that give you the answer you want. It might not be practical for 32-bit CRCs, but for 8- and 16-bit CRCs it shouldn't take too long to run.
You'll need at least two sets of known ...
I did not find anything using the whole message; however, because the last 5 bytes are the same in all the messages you provided, I omitted them one by one and ran reveng on the truncated messages.
reveng provides the following output if we leave out the last 4 bytes:
./reveng -w 8 -s 301300B9 31130036 321300BA 33130035
width=8 poly=0x1d init=0xff ...
Well thanks to @IgorSkochinsky who suggested in another question of mine to try a disassembler, I found a Docker image that contained a Blackfin toolchain which allowed me to use objdump to disassemble the code:
bfin-elf-objdump -D -b binary -mbfin bootloader.bin > bootloader.disasm
After hastily consulting a manual on Blackfin assembler and poking ...