Check and determine the CRC algorithm from the data CRC – embedded application.

I have a set of data protected by a 16-bit checksum and I need to correct it. The checksum locations are known, the exact area where they are calculated and the exact algorithm used to calculate them No. 16-bit, LSB first. I suspect it is some kind of 16-bit CRC, but I can’t find the code that actually calculates the checksum.

Example:

< /p>

00 4E00FFFF26EC14091E00A01830393630 
10 30313131313030393030363030313030
20 30303131313030393030363030313030
30 30303131313030393030363030313030
40 3030FFFF225E36350 304D313037**080000000000000 0808000000

The checksums are stored in 4E and 64. I don’t know whether they are calculated from the offset of the first word at the beginning of each data part or after that, Or calculate across the entire range. I have tried many common CRC algorithms and polynomials with no luck. There are no references or specifications available for this application.

This is another data section with a different CRC, Used for comparison.

00 4E00FFFF26C014091600A01030393132 
10 30313131313030393030313230313030
20 30303131313030393030313230313030
30 30303131313030393030313230313030
40 3030FFFF13030313030313030 br />50 64000000000000008080808080800000
60 00000000**72F8**E001EB00130105000E01

My question is, anyone can identify Algorithm? Is there a way to calculate the CRC polynomial and other factors from the data and CRC?

Thank you!

Edit:

Searching for the public CRC16 polynomial 0xA001 in my disassembly shows this function:

34F86; = ============== SUBROUTINE ================================== ====
34F86
34F86
34F86 Possible_Checksum:; CODE XREF: MEM_EXT_4:00034FEEP
34F86; MEM_EXT_4:0003503AP ...
34F86 mov [-r0] , r9; Move Word
34F88 mov r4, r12; Move Word
34F8A mov r5, r13; Move Word
34F8C shr r4, #14; Shift Right
34F8E shl r5, #2; Shift Left
34F90 or r5, r4; Logical OR
34F92 mov r4, r12; Move Word
34F94 mov DPP0, r5; Move Word
34F98 and r4, # 3FFFh; Logical AND
34F9C movb rl3, [r4]; Move Byte
34F9E mov DPP0, #4; Move Word
34FA2 movbz r9, rl3; Move Byte Zero Extend
34FA4 mov r15, #0; Move Word
34FA6
34FA6 loc_34FA6:; CODE XREF : MEM_EXT_4:00034FC8j
34FA6 mov r4, [r14]; Move Word
34FA8 xor r4, r9; Logical Exclusive OR
34FAA and r4, #1; Logical AND
34FAC jmpr cc_Z, loc_34FBA; Relative Conditional Jump
34FAE mov r4, [r14]; Move Word
34FB0 shr r4, #1; Shift Right
34FB2 xor r4, #0A001h; Logical Exclusive OR
34FB6 mov [r14], r4; Move Word
34FB8 jmpr cc_UC, loc_34FC0; Relative Conditional Jump
34FBA; ------------------- -------------------------------------------------- ------
34FBA
34FBA loc_34FBA:; CODE XREF: MEM_EXT_4:00034FACj
34FBA mov r4, [r14]; Move Word
34FBC shr r4, #1; Shift Right
34FBE mov [r14], r4 ; Move Word
34FC0
34FC0 loc_34FC0:

you posted from loc_34FA6 The code is basically as follows:

unsigned short
crc16_update(unsigned short crc, unsigned char nextByte)
{
crc ^= nextByte;

for (int i = 0; i <8; ++i) {
if (crc & 1)
crc = (crc >> 1) ^ 0xA001 ;
else
crc = (crc >> 1);
}

return crc;
}

This is 0xA001 polynomial CRC-16. Once the data range for CRC-16 is found, initialize the CRC to 0xFFFF and call this function for each byte in the sequence. Store the return value and pass it back the next time it passes. The last value returned is your final CRC.

I’m not sure what the prologue is doing...

I have a set of 16-bit checksums Protected data, I need to correct. The checksum positions are known, the exact area where they are calculated and the exact algorithm used to calculate them is not. 16-bit, LSB first. I suspect it is some kind of 16-bit CRC, but I Could not find the code that actually calculates the checksum.

Example:

00 4E00FFFF26EC14091E00A01830393630 
10 30313131313030393030363030313030
20 30303131313030393030363030313030
30 3030313131313030393030363030313030304DFF 0373633633030FF 037363 40 3030393630 **0CE0**
50 64000000000000008080808080800000
60 00000000**BE6E**FC01E001EB0013010500

Checksums are stored in 4E and 64. I don’t know if they start from each data part The offset of the first word is calculated from then, or calculated over the entire range. I have tried many common CRC algorithms and polynomials with no luck. There are no references or specifications available for this application.

This is another data part with a different CRC for comparison.

00 4E00FFFF26C014091600A01030393132 
10 30313131313030393030313230313030
20 30303131313030393030313230313030
30 30303131313030393030313230313030
40 3030FFFF225E343231324F313044**8348**
50 64000000000000008080808080800000
60 00000000**72F8**E001EB00130105000E01

My question is, anyone does Can the algorithm be identified? Is there a way to calculate the CRC polynomial and other factors from the data and CRC?

Thank you!

Edit:

Searching for the public CRC16 polynomial 0xA001 in my disassembly shows this function:

34F86; = ============== SUBROUTINE ================================== ====
34F86
34F86
34F86 Possible_Checksum:; CODE XREF: MEM_EXT_4:00034FEEP
34F86; MEM_EXT_4:0003503AP ...
34F86 mov [-r0] , r9; Move Word
34F88 mov r4, r12; Move Word
34F8A mov r5, r13; Move Word
34F8C shr r4, #14; Shift Right
34F8E shl r5, #2; Shift Left
34F90 or r5, r4; Logical OR
34F92 mov r4, r12; Move Word
34F94 mov DPP0, r5; Move Word
34F98 and r4, # 3FFFh; Logical AND
34F9C movb rl3, [r4]; Move Byte
34F9E m ov DPP0, #4; Move Word
34FA2 movbz r9, rl3; Move Byte Zero Extend
34FA4 mov r15, #0; Move Word
34FA6
34FA6 loc_34FA6:; CODE XREF : MEM_EXT_4:00034FC8j
34FA6 mov r4, [r14]; Move Word
34FA8 xor r4, r9; Logical Exclusive OR
34FAA and r4, #1; Logical AND
34FAC jmpr cc_Z, loc_34FBA; Relative Conditional Jump
34FAE mov r4, [r14]; Move Word
34FB0 shr r4, #1; Shift Right
34FB2 xor r4, #0A001h; Logical Exclusive OR
34FB6 mov [r14], r4; Move Word
34FB8 jmpr cc_UC, loc_34FC0; Relative Conditional Jump
34FBA; ------------------- -------------------------------------------------- ------
34FBA
3 4FBA loc_34FBA:; CODE XREF: MEM_EXT_4:00034FACj
34FBA mov r4, [r14]; Move Word
34FBC shr r4, #1; Shift Right
34FBE mov [r14], r4; Move Word
34FC0
34FC0 loc_34FC0:

The code you posted from loc_34FA6 is basically as follows:

unsigned short
crc16_update(unsigned short crc, unsigned char nextByte)
{
crc ^= nextByte;

for (int i = 0; i <8; ++i) {
if (crc & 1)
crc = (crc >> 1) ^ 0xA001;
else
crc = (crc >> 1);
}

return crc;
}

This is a CRC-16 with a 0xA001 polynomial. Once found, CRC-16 is applicable Data range, initialize the CRC to 0xFFFF, and call this function for each byte in the sequence. Store the return value and pass it back in the next pass. The final return value is your final CRC.

I'm not sure what the prologue is doing...

Leave a Comment

Your email address will not be published.