5

The checksum algorithm is simple indeed. It adds all the payload bytes modulo 0xFF and then adds 26. I wrote a script to test it: #!/usr/bin/python import binascii def checksum(data): payload = data[3:-1] checksum = 26 for c in payload: checksum += c checksum &= 0xFF return checksum with open("input.txt","r") as f: ...


4

Is it possible to identify a protocol in a pcap file? Yes, but this appears to be a proprietary protocol over TCP/IP. The first four bytes of every message is a 32-bit big-endian value that specifies the length of the following bytes in the message. The messages aren't encrypted, so you might be able to do some data carving. But if you really want to know ...


4

If this is data, then there should be a common clock, with the raising/falling edge signals all on individual ticks of that clock. I scaled the bottom half of your scope output by 500% horizontally, and had gimp overlay a grid on it, playing with the width and shift of the grid until i found something that looks like it could be the clock (click the image ...


3

Your signal is very degraded: your rise and fall times are too slow relative to the bit rate. If the signal really looks as your scope plot shows, and this is not just a measurement issue, then it's no surprise that you cannot get coherent data out of it. Serial port signals should have very clean and well-defined rise and fall times relative to the baud ...


3

You don't really need another tool if you know how to use wireshark. Wireshark will let you extract the TCP part of a stream, which is exactly what you'll get using any kind of proxy or network bridge as well. From your description, i assume the protocol isn't just some kind of plain text, like your chat being encapsulated into SOAP in XML - it'd be easy to ...


3

It may be the case that it's CBC-encrypted data, with the first field being a nonce. Or one of many other possibilities. Either way, as Guntram said in his comment above, you'd need to reverse engineer the software to determine how this data is parsed.


2

The Malware Analysis Tutorial 1 on Dr Fu's Security Blog involves running a piece of malware inside a Windows VM and capturing its network traffic using wireshark in a Linux VM set up for the purpose. Among other things. That should cover the 'acquisition' part of your project nicely in case plain wireshark on its own should not be enough... As regards ...


2

For Firefox (i.e. Gecko) and Chrome (i.e. Blink) you can just look in the source code: Searching the Firefox codebase for getCurrentPosition yields the source file nsGeolocation.cpp. As you see in the linked source line, it creates an instance of a geolocation provider. Assuming Firefox for Desktop, there is only the NetworkGeolocationProvider (FirefoxOS ...


2

just one sample is never sufficient to answer a checksum query you need a bunch of samples to corelate and find patterns so looking at the linked pdf it seems it is clear enough skip the start and sum the data and extract the least two bytes skip sum mask x,x,x,x | y,y,... 0x000000ff = checksum so the sample you posted would be skip ...


2

A comment in your previous question pointed out that your hydrometer likely uses the M-Bus or Meter-Bus protocol, and your fields in question are all thoroughly explained in the documentation of said protocol (PDF) The C-Field is the control field and defines what function is being performed (page 23 of the above PDF). It is an 8-bit value where the lowest ...


2

Got it! The algorithm is a CRC with the following parameters, stored in those two bytes as a big-endian short: Polynomial: 0x2e97 Xor In Value: 0 Xor Out Value: 0 Reflect Input: True Reflect Out: True To figure it out, I used my packet capture data, CRC RevEng, and some shell scripting to glue it together. I then used pycrc to calculate the check values ...


2

Just as an example, consider the source code for AES at https://polarssl.org/aes-source-code. This has various tables, one of which is the Forward S-Box, FSb - which should be the same in all AES implementations. So, a signature checker like signsrch will say "AES" if it finds the fsb table, but it doesn't know which AES implemenation is used. Now, the FSb ...


2

Not sure why my last question was deleted.. anyway here is the answer - the bit order of the sum at the end is reversed.. uint8_t rev(uint8_t b) { b = (b & 0xF0) >> 4 | (b & 0x0F) << 4; b = (b & 0xCC) >> 2 | (b & 0x33) << 2; b = (b & 0xAA) >> 1 | (b & 0x55) << 1; return b; } int main() ...


2

You seem to have the same air conditioner like the guy who asked this question. Add up bytes 0-11, xor with 0x55 to get byte 12. It could help if you stated the brand and model number of your AC unit, that makes it easier for other people who want to do the same thing.


2

Converting the numbers to ASCII, we get: 0 ~ 9 = 0 ~ 9 (0x30 ~ 0x39) 10 ~ 35 = A ~ Z (0x41 ~ 0x5a) 36 ~ 61 = a ~ z (0x61 ~ 0x7a) It is encoded this way probably to make it human-readable.


2

You are right about the 14th byte being the length on (some) short notes, like your file 4: 00000000 08 00 12 d6 02 08 00 10 00 1a cf 02 12 1b 54 68 ..............Th 00000010 69 73 20 6e 6f 74 65 20 69 73 20 74 68 65 20 66 is note is the f 00000020 69 72 73 74 20 6f 6e 65 20 1a 10 0a 04 08 00 10 irst one ....... 00000030 00 10 00 1a 04 08 00 10 00 ...


2

Some RFID cards indeed only provide their IDs. IDs are then matched to a database to say, decide if a door should be opened. It's really up to the card. The two ways I can think of to identify the card's capabilities is either traced it back to the manufacturer (who bought it? What model/type of card was it?) or break it and find the chip and look at it ...


2

I suspect these are IEEE doubles. For example, 0x3fd3333333333333 is 2.99999999999999988897769753748E-1, or around 0.3. I used this converter to check


2

Digital Keychain Photo viewer thingies are sensitive. For DPFMate: You need to use the cable that came with the thingy. The thingy has to be in "UPDATE" mode. It needs to be fully charged before use (about two hours from memory) I have used Kaiser Baas and one other (no name). They both came with built in software; they both work with Windows 10. ...


2

Found the solution: It is a XOR checksum with an initial key "5A" (not including the first four HEX values). 02 00 01 01 [01 00 00 02 40 00] 19 03 5A ^ 01 ^ 00 ^ 00 ^ 02 ^ 40 ^ 00 = 19


2

The first byte starts as 0E is then 0F and then 10. This looks something like a sequential message id, not part of a checksum. The second byte has a pattern to it too and, taking into account the message lengths, I'd interpret it as follows - 00 => request to controller 20 => acknowledgement from controller of the request 10 => response from ...


1

I understand your Arduino serves as a relay in the middle between the controller and the LCD. What you could do (not extremely exciting, but you did not mention whether you made similar experiments already, and I hope I understood your situation well): Modification of single bits. If you visually observe the display and connect a switch at your Arduino ...


1

I am working on the same thing, with a Renogy Commander. Upvote. It is very similar to scraping web sites, because a lot of it is text and graphics to draw the screen, then there are variables with the values I want. Here is a search that can help point you in the right direction: RS-485 monitoring RS485 is a bus-style system so monitoring it doesn'...


1

This could be a self-clocking protocol like Manchester encoding. Also check the patent database for any patents from the companies involved; quite possibly there may be hints there.


1

There are two possibilities: The League of Legends client uses an embedded algorithm to injectively map a club name to a club UUID. The League of Legends client sends the club name to the server and receives the club UUID in response. Either way, you'd be able to see what UUID-channel is eventually joined by the League of Legends client by sniffing the ...


1

I know this question is old but I found it by sheer chance while working out the bit mappings for this same kind of AC. Look at the post by Catalyn here: https://myesp8266.blogspot.com.ar/2016/05/keep-your-house-cool-with-esp8266.html . It seems to be about the same AC protocol and there's something in there about how to calculate the CRC. I haven't tried it ...


1

I approached this from the perspective of a boolean logic simplifier: The more values you can trim, the less inputs your checksum function has and the simpler it will be to understand. Not a complete solution by any measure, but a few thoughts: Trim the rows with identical values from your dataset. They're just noise. Columns 5, 7, 9, 13, 15, and 17 have ...


1

Sounds a lot like my recent CAN bus sniffing. Ha! That's funny, RS485 is a popular alternative to CAN. :P A few quick thoughts: You're not terminating your "RE" master node properly. You need to check the very first comms to see if there is an opening sequence, such as to establish privilege. I see numbers incrementing in your output. That's definitely ...


1

This is not a reverse engineering answer per se, but more of a general common sense approach. Since it is a chat application, it presumably uses a network. I would launch the application while using a network packet dissector (sniffer) like wireshark. From there I would try to identify if a common encryption technique is being used (e.g. TLS encryption). You ...


1

In addition to Guntram Blohm's answer, I would spend time looking up the data sheets for the ICs on the board. Your pictures are too blurry to read part numbers. The data sheet will usually contain information about what the part does and example circuits along with pinouts. Tracing pins from known pins on ICs to the pins on the connector will go a long ...


Only top voted, non community-wiki answers of a minimum length are eligible