Re: help trying to reverse engineer CRC algorithm

On Fri, 4 Jul 2008 13:16:27 -0700 (PDT), mramirez
<manologab@xxxxxxxxx> wrote:


This packages are all 136 bytes long, all the .... are filled with
0x00,
each line is a diferent packet except the last one.

26 00 00 00 .... 00 AD D2 7E
26 05 00 00 .... 00 2A 24 7E
26 04 00 00 .... 00 0B BA 7E
26 20 00 00 .... 00 AE 8F 7E
26 21 00 00 .... 00 8F 11 7E
26 22 00 00 .... 00 FD BB 7E
26 23 00 00 .... 00 DC 25 7E
26 24 00 00 .... 00 08 E7 7E
26 28 00 00 .... 00 E2 5E 7E
26 02 01 00 .... 00 C4 1E 7E

Hi Manolo,

At least with this packets I found a solution: It is a standard CRC16
called X-25, below are the Ross-Williams-CRC-Model parameters and
a test program (Pascal units available from sig line):

uses
mem_Util,crcmodel;

const
CRCX25: TCRCParam = (poly : $1021;
init : $ffff;
xorout: $ffff;
check : $906e;
width : 16;
refin : true;
refout: true;
name : 'X-25');

const
b2: array[1..8] of byte = ($05, $04, $20, $21, $22, $23, $24, $28);
var
buf: array[1..132+1] of byte;
ctx: TCRC_ctx;
CRC: longint;
i: integer;
begin
fillchar(buf, sizeof(buf),0);
buf[1] := $26;
writeln('Selftest X-25: ', cm_SelfTest(CRCX25));
cm_Create(CRCX25,nil,ctx);
for i:=1 to 8 do begin
buf[2] := b2[i];
cm_Full(ctx, CRC, @buf, sizeof(buf));
writeln(Hexbyte(b2[i]):3, '00 ... 00 ', HexByte(CRC and $ff):3,
HexByte(CRC shr 8 and $ff):3);
end;
end.

The output is:
Selftest X-25: TRUE
0500 ... 00 2a 24
0400 ... 00 0b ba
2000 ... 00 ae 8f
2100 ... 00 8f 11
2200 ... 00 fd bb
2300 ... 00 dc 25
2400 ... 00 08 e7
2800 ... 00 e2 5e


To be honest I found this by brute force. The first all 0 message
indicates that init/xorout should be nonzero. I found the following
polynomials: f014 e03e 820c 741b 5e57 430a 2389 1021 081e. And of
course 1021 is a standard poly.

The rest was good luck.

Wolfgang

--
In order to e-mail me a reply to this message, you will have
to remove PLEASE.REMOVE from the address shown in the header
or get it from http://home.netsurf.de/wolfgang.ehrhardt
(Free open source Crypto, AES, CRC, Hash for Pascal/Delphi)
.