CODEWITHSUNDEEP
protocolsreverse-engineeringdecodechecksumcrc
Volodymyr Smirnov
Volodymyr Smirnov

Reputation: 305

Reversing the checksum based on the data

I'm trying to reverse the binary protocol of embedded device. I was able to capture 4 samples of data packages, here they are in hex encoded form:

5E:A1:00:10:10:00:00:02:01:05:F0:F6:4B:00:01:03
5E:A1:00:10:10:00:00:06:01:93:79:DA:F9:00:01:07
5E:A1:00:10:10:00:00:03:01:C9:B1:F0:81:00:01:04
5E:A1:00:10:10:00:00:04:01:A3:BE:2A:3A:00:01:05

Based on other packages I can assert the following:

  1. First 6 bytes (5E:A1:00:10:10:00) - message header, it's static across all other messages.
  2. Next 2 bytes (00:02 or 00:06 or 00:03 or 00:04) - the message numeric id, int16. It's different from message to message.
  3. Next 4 bytes (05:F0:F6:4B or 93:79:DA:F9 or C9:B1:F0:81 or A3:BE:2A:3A) is a checksum of a message. It depends on the data and the message number. I tried that by forming the package manually: when I update bytes in data area of a message or the message number, but not the checksum - the message gets declined by the remote server.
  4. Everything else is just a data of variable length.

My question is: how can I understand the algorithm used for the checksum generation? Is there any software which can be used for that kind of purpose? For example, I input the mask in the data and it tries to guess the algorithm.

Upvotes: 1

Views: 221

Answers (1)

Mark Adler
Mark Adler

Reputation: 112239

If it is a CRC, then reveng may be able to deduce the parameters of the CRC, given enough examples.

Upvotes: 1

Related Questions