( solved) Checksum experts , free german beer

[Gazello]

Hello,

I am trying to figure out the checksum of a  welder machine remote control . To work on any other welder it needs to  send two  identify  bytes + a new checksum .

I already tried everything i know including XOR SUM .-256.. CRC8  ( CRC reveng)  but no luck to figure out the checksum algorithum . I collected  all the potentiometer value from 0 to 255  I can simply replay these values and they work , but I still need the checksum for the identify.

Data is simply the 10 bit ADC of the PIC spread to 2 bytes . One byte ist the overflow ( 0-255 ) the other byte is +92 for every ADC ( 1024) value.





Anyone a real expert in CRC or checksum ?

Attached the open office calc with 255 datasets in decimal and hex . It goes along with xor but not the identical result , except 0.

Please see also interesting datasets below the 255 datasets + the identify

I did Open office cal, excel , it is easier to sort the data by checksum or pot value or XOR result.


Thanks and no the manufacture gives no further help at all.

To make it a little more interesting, free beer from germany ( any brand you wish ) for the magician who can solve this puzzle.


Regards
Markus

[hamster_nz]

A text file would help... (I've no open office here, and it is machine readable for analysis)

[Nominal Animal]

Attached is the same dataset in CSV format (comma separator, LF newlines, non-decimal values quoted).

Each message is eight bytes long, and the checksum is a single byte. The same dataset, in hexadecimal only:

Code: [Select]

0x31 0x05 0x01 0x01 0x5F 0x5A 0x00 0x32 : 0x00
0x31 0x05 0x01 0x01 0xA0 0xA5 0x00 0x32 : 0x00
0x31 0x05 0x01 0x01 0x4B 0x6B 0x01 0x32 : 0x01
0x31 0x05 0x01 0x01 0x1B 0xAC 0x05 0x32 : 0x05
0x31 0x05 0x01 0x01 0x12 0xCB 0x06 0x32 : 0x06
0x31 0x05 0x01 0x01 0xED 0x34 0x06 0x32 : 0x06
0x31 0x05 0x01 0x01 0xEC 0x10 0x07 0x32 : 0x07
0x31 0x05 0x01 0x01 0x18 0x6D 0x09 0x32 : 0x09
0x31 0x05 0x01 0x01 0x22 0x57 0x09 0x32 : 0x09
0x31 0x05 0x01 0x01 0xE7 0x92 0x09 0x32 : 0x09
0x31 0x05 0x01 0x01 0x6A 0x71 0x0A 0x32 : 0x0A
0x31 0x05 0x01 0x01 0xF7 0x30 0x0C 0x32 : 0x0C
0x31 0x05 0x01 0x01 0xF7 0x30 0x0C 0x32 : 0x0C
0x31 0x05 0x01 0x01 0x45 0xC9 0x0E 0x32 : 0x0E
0x31 0x05 0x01 0x01 0xBA 0x36 0x0E 0x32 : 0x0E
0x31 0x05 0x01 0x01 0x24 0x8D 0x0F 0x32 : 0x0F
0x31 0x05 0x01 0x01 0x07 0xC6 0x13 0x32 : 0x13
0x31 0x05 0x01 0x01 0x4C 0x74 0x14 0x32 : 0x14
0x31 0x05 0x01 0x01 0x7D 0x45 0x14 0x32 : 0x14
0x31 0x05 0x01 0x01 0xB3 0x8B 0x14 0x32 : 0x14
0x31 0x05 0x01 0x01 0xDE 0xC3 0x15 0x32 : 0x15
0x31 0x05 0x01 0x01 0x52 0x04 0x17 0x32 : 0x17
0x31 0x05 0x01 0x01 0x83 0xD5 0x17 0x32 : 0x17
0x31 0x05 0x01 0x01 0xAD 0xFB 0x17 0x32 : 0x17
0x31 0x05 0x01 0x01 0x09 0xF3 0x18 0x32 : 0x18
0x31 0x05 0x01 0x01 0xF6 0x0C 0x18 0x32 : 0x18
0x31 0x05 0x01 0x01 0x47 0xF6 0x1A 0x32 : 0x1A
0x31 0x05 0x01 0x01 0x0C 0x44 0x1D 0x32 : 0x1D
0x31 0x05 0x01 0x01 0x56 0x70 0x1E 0x32 : 0x1E
0x31 0x05 0x01 0x01 0x60 0x63 0x1F 0x32 : 0x1F
0x31 0x05 0x01 0x01 0x9F 0x9C 0x1F 0x32 : 0x1F
0x31 0x05 0x01 0x01 0x0A 0x05 0x21 0x32 : 0x21
0x31 0x05 0x01 0x01 0xC0 0xCF 0x21 0x32 : 0x21
0x31 0x05 0x01 0x01 0xF5 0xFA 0x21 0x32 : 0x21
0x31 0x05 0x01 0x01 0x2B 0x4A 0x22 0x32 : 0x22
0x31 0x05 0x01 0x01 0xA1 0xC0 0x22 0x32 : 0x22
0x31 0x05 0x01 0x01 0x52 0x16 0x23 0x32 : 0x23
0x31 0x05 0x01 0x01 0xA6 0x3E 0x25 0x32 : 0x25
0x31 0x05 0x01 0x01 0x3B 0xCD 0x26 0x32 : 0x26
0x31 0x05 0x01 0x01 0x2C 0x53 0x28 0x32 : 0x28
0x31 0x05 0x01 0x01 0xF1 0x8E 0x28 0x32 : 0x28
0x31 0x05 0x01 0x01 0x6B 0x7A 0x2B 0x32 : 0x2B
0x31 0x05 0x01 0x01 0x94 0x85 0x2B 0x32 : 0x2B
0x31 0x05 0x01 0x01 0x09 0xE1 0x2C 0x32 : 0x2C
0x31 0x05 0x01 0x01 0x6B 0x83 0x2C 0x32 : 0x2C
0x31 0x05 0x01 0x01 0x94 0x7C 0x2C 0x32 : 0x2C
0x31 0x05 0x01 0x01 0xF6 0x1E 0x2C 0x32 : 0x2C
0x31 0x05 0x01 0x01 0x33 0xFE 0x2D 0x32 : 0x2D
0x31 0x05 0x01 0x01 0x3C 0xF1 0x2D 0x32 : 0x2D
0x31 0x05 0x01 0x01 0xC3 0x0E 0x2D 0x32 : 0x2D
0x31 0x05 0x01 0x01 0x1A 0x9A 0x30 0x32 : 0x30
0x31 0x05 0x01 0x01 0x6F 0xEF 0x30 0x32 : 0x30
0x31 0x05 0x01 0x01 0xA0 0xB7 0x34 0x32 : 0x34
0x31 0x05 0x01 0x01 0xAB 0xBC 0x34 0x32 : 0x34
0x31 0x05 0x01 0x01 0x72 0x2E 0x36 0x32 : 0x36
0x31 0x05 0x01 0x01 0x8D 0xD1 0x36 0x32 : 0x36
0x31 0x05 0x01 0x01 0x36 0x4F 0x37 0x32 : 0x37
0x31 0x05 0x01 0x01 0x57 0x82 0x38 0x32 : 0x38
0x31 0x05 0x01 0x01 0xA8 0x7D 0x38 0x32 : 0x38
0x31 0x05 0x01 0x01 0xB2 0x67 0x38 0x32 : 0x38
0x31 0x05 0x01 0x01 0x22 0x60 0x3C 0x32 : 0x3C
0x31 0x05 0x01 0x01 0x00 0x09 0x3E 0x32 : 0x3E
0x31 0x05 0x01 0x01 0xEA 0xE3 0x3E 0x32 : 0x3E
0x31 0x05 0x01 0x01 0x0D 0x56 0x40 0x32 : 0x40
0x31 0x05 0x01 0x01 0x74 0x64 0x42 0x32 : 0x42
0x31 0x05 0x01 0x01 0x1C 0xD0 0x44 0x32 : 0x44
0x31 0x05 0x01 0x01 0x50 0xD7 0x46 0x32 : 0x46
0x31 0x05 0x01 0x01 0x85 0x02 0x46 0x32 : 0x46
0x31 0x05 0x01 0x01 0x1C 0xBE 0x47 0x32 : 0x47
0x31 0x05 0x01 0x01 0x9B 0x39 0x47 0x32 : 0x47
0x31 0x05 0x01 0x01 0x5F 0x51 0x48 0x32 : 0x48
0x31 0x05 0x01 0x01 0xA0 0xAE 0x48 0x32 : 0x48
0x31 0x05 0x01 0x01 0xC1 0xEA 0x49 0x32 : 0x49
0x31 0x05 0x01 0x01 0xF4 0xDF 0x49 0x32 : 0x49
0x31 0x05 0x01 0x01 0x72 0x37 0x4A 0x32 : 0x4A
0x31 0x05 0x01 0x01 0x64 0xD8 0x4D 0x32 : 0x4D
0x31 0x05 0x01 0x01 0x9B 0x27 0x4D 0x32 : 0x4D
0x31 0x05 0x01 0x01 0x3C 0xE8 0x51 0x32 : 0x51
0x31 0x05 0x01 0x01 0x25 0x9F 0x52 0x32 : 0x52
0x31 0x05 0x01 0x01 0x91 0x2B 0x52 0x32 : 0x52
0x31 0x05 0x01 0x01 0x2D 0x6E 0x55 0x32 : 0x55
0x31 0x05 0x01 0x01 0xF9 0x5D 0x58 0x32 : 0x58
0x31 0x05 0x01 0x01 0x3A 0xBB 0x59 0x32 : 0x59
0x31 0x05 0x01 0x01 0xB1 0x5E 0x5A 0x32 : 0x5A
0x31 0x05 0x01 0x01 0x6D 0xA7 0x5B 0x32 : 0x5B
0x31 0x05 0x01 0x01 0x73 0x40 0x5C 0x32 : 0x5C
0x31 0x05 0x01 0x01 0x80 0x96 0x5D 0x32 : 0x5D
0x31 0x05 0x01 0x01 0xC8 0x95 0x5F 0x32 : 0x5F
0x31 0x05 0x01 0x01 0xB5 0xC1 0x60 0x32 : 0x60
0x31 0x05 0x01 0x01 0x0E 0x5F 0x61 0x32 : 0x61
0x31 0x05 0x01 0x01 0xF1 0xA0 0x61 0x32 : 0x61
0x31 0x05 0x01 0x01 0x4A 0x50 0x63 0x32 : 0x63
0x31 0x05 0x01 0x01 0xB5 0xAF 0x63 0x32 : 0x63
0x31 0x05 0x01 0x01 0x1E 0xFD 0x64 0x32 : 0x64
0x31 0x05 0x01 0x01 0xC3 0x20 0x64 0x32 : 0x64
0x31 0x05 0x01 0x01 0x11 0xB9 0x66 0x32 : 0x66
0x31 0x05 0x01 0x01 0x87 0x2F 0x66 0x32 : 0x66
0x31 0x05 0x01 0x01 0x2B 0x41 0x6A 0x32 : 0x6A
0x31 0x05 0x01 0x01 0x49 0x23 0x6A 0x32 : 0x6A
0x31 0x05 0x01 0x01 0xB6 0xDC 0x6A 0x32 : 0x6A
0x31 0x05 0x01 0x01 0x4E 0xB3 0x6E 0x32 : 0x6E
0x31 0x05 0x01 0x01 0xB1 0x4C 0x6E 0x32 : 0x6E
0x31 0x05 0x01 0x01 0x28 0xF0 0x6F 0x32 : 0x6F
0x31 0x05 0x01 0x01 0xD7 0x0F 0x6F 0x32 : 0x6F
0x31 0x05 0x01 0x01 0x62 0x99 0x71 0x32 : 0x71
0x31 0x05 0x01 0x01 0x9D 0x66 0x71 0x32 : 0x71
0x31 0x05 0x01 0x01 0x05 0x90 0x72 0x32 : 0x72
0x31 0x05 0x01 0x01 0xFA 0x6F 0x72 0x32 : 0x72
0x31 0x05 0x01 0x01 0x40 0x42 0x76 0x32 : 0x76
0x31 0x05 0x01 0x01 0x6A 0x68 0x76 0x32 : 0x76
0x31 0x05 0x01 0x01 0x95 0x97 0x76 0x32 : 0x76
0x31 0x05 0x01 0x01 0xBF 0xBD 0x76 0x32 : 0x76
0x31 0x05 0x01 0x01 0x1A 0x91 0x78 0x32 : 0x78
0x31 0x05 0x01 0x01 0x2F 0xA4 0x78 0x32 : 0x78
0x31 0x05 0x01 0x01 0xD1 0x7F 0x79 0x32 : 0x79
0x31 0x05 0x01 0x01 0x27 0xE7 0x7A 0x32 : 0x7A
0x31 0x05 0x01 0x01 0x62 0xA2 0x7A 0x32 : 0x7A
0x31 0x05 0x01 0x01 0xD9 0x3C 0x7B 0x32 : 0x7B
0x31 0x05 0x01 0x01 0x8D 0xDA 0x7E 0x32 : 0x7E
0x31 0x05 0x01 0x01 0xE8 0xBF 0x7E 0x32 : 0x7E
0x31 0x05 0x01 0x01 0x51 0xE9 0x80 0x32 : 0x80
0x31 0x05 0x01 0x01 0x46 0xDB 0x81 0x32 : 0x81
0x31 0x05 0x01 0x01 0xB9 0x24 0x81 0x32 : 0x81
0x31 0x05 0x01 0x01 0xB0 0x43 0x82 0x32 : 0x82
0x31 0x05 0x01 0x01 0xBB 0x48 0x82 0x32 : 0x82
0x31 0x05 0x01 0x01 0x56 0x79 0x84 0x32 : 0x84
0x31 0x05 0x01 0x01 0x74 0x5B 0x84 0x32 : 0x84
0x31 0x05 0x01 0x01 0xA9 0x86 0x84 0x32 : 0x84
0x31 0x05 0x01 0x01 0x8A 0x80 0x85 0x32 : 0x85
0x31 0x05 0x01 0x01 0x97 0xD6 0x87 0x32 : 0x87
0x31 0x05 0x01 0x01 0x0F 0x8C 0x8B 0x32 : 0x8B
0x31 0x05 0x01 0x01 0x52 0x0D 0x8D 0x32 : 0x8D
0x31 0x05 0x01 0x01 0xAD 0xF2 0x8D 0x32 : 0x8D
0x31 0x05 0x01 0x01 0xA9 0x98 0x8E 0x32 : 0x8E
0x31 0x05 0x01 0x01 0x40 0x54 0x8F 0x32 : 0x8F
0x31 0x05 0x01 0x01 0xBF 0xAB 0x8F 0x32 : 0x8F
0x31 0x05 0x01 0x01 0x4B 0x59 0x90 0x32 : 0x90
0x31 0x05 0x01 0x01 0x0C 0x3B 0x91 0x32 : 0x91
0x31 0x05 0x01 0x01 0xF3 0xC4 0x91 0x32 : 0x91
0x31 0x05 0x01 0x01 0xB6 0xCA 0x93 0x32 : 0x93
0x31 0x05 0x01 0x01 0xE7 0x9B 0x93 0x32 : 0x93
0x31 0x05 0x01 0x01 0x71 0x13 0x99 0x32 : 0x99
0x31 0x05 0x01 0x01 0xAC 0xCE 0x99 0x32 : 0x99
0x31 0x05 0x01 0x01 0x2A 0x26 0x9A 0x32 : 0x9A
0x31 0x05 0x01 0x01 0x60 0x6C 0x9A 0x32 : 0x9A
0x31 0x05 0x01 0x01 0xD5 0xD9 0x9A 0x32 : 0x9A
0x31 0x05 0x01 0x01 0x4B 0x62 0x9B 0x32 : 0x9B
0x31 0x05 0x01 0x01 0x81 0xA8 0x9B 0x32 : 0x9B
0x31 0x05 0x01 0x01 0xB4 0x9D 0x9B 0x32 : 0x9B
0x31 0x05 0x01 0x01 0x12 0xC2 0x9C 0x32 : 0x9C
0x31 0x05 0x01 0x01 0x86 0x1D 0x9E 0x32 : 0x9E
0x31 0x05 0x01 0x01 0xA4 0x1A 0x9F 0x32 : 0x9F
0x31 0x05 0x01 0x01 0xA4 0x1A 0x9F 0x32 : 0x9F
0x31 0x05 0x01 0x01 0x45 0xD2 0xA0 0x32 : 0xA0
0x31 0x05 0x01 0x01 0x6F 0xDD 0xA1 0x32 : 0xA1
0x31 0x05 0x01 0x01 0x90 0x22 0xA1 0x32 : 0xA1
0x31 0x05 0x01 0x01 0x27 0xDE 0xA3 0x32 : 0xA3
0x31 0x05 0x01 0x01 0x93 0x6A 0xA3 0x32 : 0xA3
0x31 0x05 0x01 0x01 0xD8 0x21 0xA3 0x32 : 0xA3
0x31 0x05 0x01 0x01 0x00 0x00 0xA4 0x32 : 0xA4
0x31 0x05 0x01 0x01 0x55 0x55 0xA4 0x32 : 0xA4
0x31 0x05 0x01 0x01 0xAA 0xAA 0xA4 0x32 : 0xA4
0x31 0x05 0x01 0x01 0xFF 0xFF 0xA4 0x32 : 0xA4
0x31 0x05 0x01 0x01 0x22 0x69 0xA6 0x32 : 0xA6
0x31 0x05 0x01 0x01 0x36 0x58 0xA7 0x32 : 0xA7
0x31 0x05 0x01 0x01 0x54 0x3A 0xA7 0x32 : 0xA7
0x31 0x05 0x01 0x01 0xAB 0xC5 0xA7 0x32 : 0xA7
0x31 0x05 0x01 0x01 0x4D 0x8F 0xA8 0x32 : 0xA8
0x31 0x05 0x01 0x01 0x77 0xB5 0xA8 0x32 : 0xA8
0x31 0x05 0x01 0x01 0x6F 0xE6 0xAA 0x32 : 0xAA
0x31 0x05 0x01 0x01 0x90 0x19 0xAA 0x32 : 0xAA
0x31 0x05 0x01 0x01 0xA5 0x2C 0xAA 0x32 : 0xAA
0x31 0x05 0x01 0x01 0x91 0x3D 0xAB 0x32 : 0xAB
0x31 0x05 0x01 0x01 0xA4 0x08 0xAB 0x32 : 0xAB
0x31 0x05 0x01 0x01 0x2C 0x5C 0xAD 0x32 : 0xAD
0x31 0x05 0x01 0x01 0x36 0x46 0xAD 0x32 : 0xAD
0x31 0x05 0x01 0x01 0x5D 0x2D 0xAD 0x32 : 0xAD
0x31 0x05 0x01 0x01 0x67 0x17 0xAD 0x32 : 0xAD
0x31 0x05 0x01 0x01 0xD3 0xA3 0xAD 0x32 : 0xAD
0x31 0x05 0x01 0x01 0x14 0x0A 0xAE 0x32 : 0xAE
0x31 0x05 0x01 0x01 0x02 0x3F 0xB0 0x32 : 0xB0
0x31 0x05 0x01 0x01 0x9A 0x15 0xB5 0x32 : 0xB5
0x31 0x05 0x01 0x01 0xFB 0x93 0xB8 0x32 : 0xB8
0x31 0x05 0x01 0x01 0xEA 0xEC 0xBB 0x32 : 0xBB
0x31 0x05 0x01 0x01 0x1D 0xE2 0xBC 0x32 : 0xBC
0x31 0x05 0x01 0x01 0x7A 0xEB 0xBF 0x32 : 0xBF
0x31 0x05 0x01 0x01 0x85 0x14 0xBF 0x32 : 0xBF
0x31 0x05 0x01 0x01 0x9E 0x78 0xC0 0x32 : 0xC0
0x31 0x05 0x01 0x01 0x42 0x81 0xC1 0x32 : 0xC1
0x31 0x05 0x01 0x01 0x57 0x94 0xC1 0x32 : 0xC1
0x31 0x05 0x01 0x01 0xC5 0x4D 0xC3 0x32 : 0xC3
0x31 0x05 0x01 0x01 0x73 0x49 0xC6 0x32 : 0xC6
0x31 0x05 0x01 0x01 0xCB 0xD4 0xC7 0x32 : 0xC7
0x31 0x05 0x01 0x01 0x07 0xB4 0xC8 0x32 : 0xC8
0x31 0x05 0x01 0x01 0x30 0xC8 0xCA 0x32 : 0xCA
0x31 0x05 0x01 0x01 0x6D 0xB0 0xCB 0x32 : 0xCB
0x31 0x05 0x01 0x01 0x96 0xB2 0xCC 0x32 : 0xCC
0x31 0x05 0x01 0x01 0x19 0x76 0xCE 0x32 : 0xCE
0x31 0x05 0x01 0x01 0x21 0x4E 0xCE 0x32 : 0xCE
0x31 0x05 0x01 0x01 0xE6 0x89 0xCE 0x32 : 0xCE
0x31 0x05 0x01 0x01 0x53 0x1F 0xD0 0x32 : 0xD0
0x31 0x05 0x01 0x01 0xAC 0xE0 0xD0 0x32 : 0xD0
0x31 0x05 0x01 0x01 0x0B 0x29 0xD3 0x32 : 0xD3
0x31 0x05 0x01 0x01 0x29 0x0B 0xD3 0x32 : 0xD3
0x31 0x05 0x01 0x01 0xD6 0xF4 0xD3 0x32 : 0xD3
0x31 0x05 0x01 0x01 0x58 0xA6 0xD5 0x32 : 0xD5
0x31 0x05 0x01 0x01 0x76 0x88 0xD5 0x32 : 0xD5
0x31 0x05 0x01 0x01 0x89 0x77 0xD5 0x32 : 0xD5
0x31 0x05 0x01 0x01 0x39 0xA9 0xD6 0x32 : 0xD6
0x31 0x05 0x01 0x01 0xA5 0x35 0xD6 0x32 : 0xD6
0x31 0x05 0x01 0x01 0x5B 0xEE 0xD7 0x32 : 0xD7
0x31 0x05 0x01 0x01 0xA4 0x11 0xD7 0x32 : 0xD7
0x31 0x05 0x01 0x01 0xB7 0xE5 0xDA 0x32 : 0xDA
0x31 0x05 0x01 0x01 0x10 0x9E 0xDC 0x32 : 0xDC
0x31 0x05 0x01 0x01 0x46 0xED 0xDD 0x32 : 0xDD
0x31 0x05 0x01 0x01 0xB9 0x12 0xDD 0x32 : 0xDD
0x31 0x05 0x01 0x01 0x93 0x73 0xDF 0x32 : 0xDF
0x31 0x05 0x01 0x01 0x14 0xF8 0xE1 0x32 : 0xE1
0x31 0x05 0x01 0x01 0x89 0x65 0xE1 0x32 : 0xE1
0x31 0x05 0x01 0x01 0xEB 0x07 0xE1 0x32 : 0xE1
0x31 0x05 0x01 0x01 0x05 0x87 0xE2 0x32 : 0xE2
0x31 0x05 0x01 0x01 0x2F 0xAD 0xE2 0x32 : 0xE2
0x31 0x05 0x01 0x01 0xD0 0x52 0xE2 0x32 : 0xE2
0x31 0x05 0x01 0x01 0xE8 0xB6 0xE4 0x32 : 0xE4
0x31 0x05 0x01 0x01 0x05 0x7E 0xE5 0x32 : 0xE5
0x31 0x05 0x01 0x01 0x53 0x28 0xE5 0x32 : 0xE5
0x31 0x05 0x01 0x01 0x8E 0xF5 0xE5 0x32 : 0xE5
0x31 0x05 0x01 0x01 0x14 0x01 0xE6 0x32 : 0xE6
0x31 0x05 0x01 0x01 0x60 0x75 0xE6 0x32 : 0xE6
0x31 0x05 0x01 0x01 0x9F 0x8A 0xE6 0x32 : 0xE6
0x31 0x05 0x01 0x01 0x15 0x25 0xE7 0x32 : 0xE7
0x31 0x05 0x01 0x01 0x81 0xB1 0xE7 0x32 : 0xE7
0x31 0x05 0x01 0x01 0x26 0xBA 0xE8 0x32 : 0xE8
0x31 0x05 0x01 0x01 0x9C 0x4B 0xEA 0x32 : 0xEA
0x31 0x05 0x01 0x01 0x93 0x61 0xEB 0x32 : 0xEB
0x31 0x05 0x01 0x01 0xD8 0x2A 0xEB 0x32 : 0xEB
0x31 0x05 0x01 0x01 0xAA 0xA1 0xEC 0x32 : 0xEC
0x31 0x05 0x01 0x01 0xB7 0xF7 0xEE 0x32 : 0xEE
0x31 0x05 0x01 0x01 0xB6 0xD3 0xEF 0x32 : 0xEF
0x31 0x05 0x01 0x01 0x7B 0x18 0xF0 0x32 : 0xF0
0x31 0x05 0x01 0x01 0xA2 0xE4 0xF1 0x32 : 0xF1
0x31 0x05 0x01 0x01 0x4A 0x47 0xF3 0x32 : 0xF3
0x31 0x05 0x01 0x01 0x7F 0x72 0xF3 0x32 : 0xF3
0x31 0x05 0x01 0x01 0xB5 0xB8 0xF3 0x32 : 0xF3
0x31 0x05 0x01 0x01 0x28 0xF9 0xF5 0x32 : 0xF5
0x31 0x05 0x01 0x01 0xCD 0x1C 0xF5 0x32 : 0xF5
0x31 0x05 0x01 0x01 0x78 0xC7 0xF6 0x32 : 0xF6
0x31 0x05 0x01 0x01 0x66 0xFC 0xF7 0x32 : 0xF7
0x31 0x05 0x01 0x01 0x99 0x03 0xF7 0x32 : 0xF7
0x31 0x05 0x01 0x01 0x20 0x33 0xF9 0x32 : 0xF9
0x31 0x05 0x01 0x01 0x20 0x33 0xF9 0x32 : 0xF9
0x31 0x05 0x01 0x01 0x2B 0x38 0xF9 0x32 : 0xF9
0x31 0x05 0x01 0x01 0xDF 0xCC 0xF9 0x32 : 0xF9
0x31 0x05 0x01 0x01 0x7B 0x06 0xFA 0x32 : 0xFA
0x31 0x05 0x01 0x01 0x23 0x7B 0xFB 0x32 : 0xFB
0x31 0x05 0x01 0x01 0xDC 0x84 0xFB 0x32 : 0xFB


[Gazello]

I did some data for CRC Reveng in Wordpad, but not all ,  + tests with reverse data  and no adres .....

[NivagSwerdna]

00   00   A4
55   55   A4
AA   AA   A4
FF   FF   A4

Interesting.... when bytes are the same you get A4

[Gazello]

yes it is is partly XOR . If you sort the data by pot value ( third last) from 0-255 you get mirrored results to the center of 127 = 128  , 126 = 129   , 0 = 255 ,1= 254 ,

But that did not help me any further . It is not a simple sum or XOR,  not standard ( about 10) CRC8 , probably custom CRC8 with unknowm init and xor value, or something else I never heard of...

[hamster_nz]

Doesn't look to be a simple CRC style check sum - the same bit difference gives different changes in the checksum

Code: [Select]

0x31 0x05 0x01 0x01 0x00 0x09 0x3E 0x32 : 0x3E
0x31 0x05 0x01 0x01 0x00 0x00 0xA4 0x32 : 0xA4
                         0x09 0x9A

0x31 0x05 0x01 0x01 0x12 0xCB 0x06 0x32 : 0x06
0x31 0x05 0x01 0x01 0x12 0xC2 0x9C 0x32 : 0x9C
                         0x09 0x9A

0x31 0x05 0x01 0x01 0x14 0x0A 0xAE 0x32 : 0xAE
0x31 0x05 0x01 0x01 0x14 0x01 0xE6 0x32 : 0xE6
                         0x09 0x48

0x31 0x05 0x01 0x01 0x1A 0x9A 0x30 0x32 : 0x30
0x31 0x05 0x01 0x01 0x1A 0x91 0x78 0x32 : 0x78
                         0x09 0x48

0x31 0x05 0x01 0x01 0x22 0x60 0x3C 0x32 : 0x3C
0x31 0x05 0x01 0x01 0x22 0x69 0xA6 0x32 : 0xA6
                         0x09 0x9A

0x31 0x05 0x01 0x01 0x28 0xF0 0x6F 0x32 : 0x6F
0x31 0x05 0x01 0x01 0x28 0xF9 0xF5 0x32 : 0xF5
                         0x09 099A



[NivagSwerdna]

OK I give up.  Definitely XOR (or bitwise addition based) but I can't quite get it.... Bed time for me...

... if you were offering a La Chouffe I might have stayed up later. 

[Gazello]

La Chouffe.................... every beer you wish (available in europe)

[NivagSwerdna]

Is it possible to change the address?  Change it by one bit from 5 to 4 and see how the data changes?

[Blinkenlights]

There is an improved Checksum algo called "Fletchers" that includes an addition or subtraction step as well as the XOR... perhaps that is why there is no match with just an XOR

[hamster_nz]

These pairs are most likely worth of further inspection:

Code: [Select]

0x31 0x05 0x01 0x01 0x00 0x00 0xA4 0x32 : 0xA4
0x31 0x05 0x01 0x01 0x00 0x09 0x3E 0x32 : 0x3E

0x31 0x05 0x01 0x01 0x0C 0x3B 0x91 0x32 : 0x91
0x31 0x05 0x01 0x01 0x0C 0x44 0x1D 0x32 : 0x1D

0x31 0x05 0x01 0x01 0x14 0x01 0xE6 0x32 : 0xE6
0x31 0x05 0x01 0x01 0x14 0x0A 0xAE 0x32 : 0xAE
0x31 0x05 0x01 0x01 0x14 0xF8 0xE1 0x32 : 0xE1

0x31 0x05 0x01 0x01 0x1C 0xBE 0x47 0x32 : 0x47
0x31 0x05 0x01 0x01 0x1C 0xD0 0x44 0x32 : 0x44

0x31 0x05 0x01 0x01 0x22 0x60 0x3C 0x32 : 0x3C
0x31 0x05 0x01 0x01 0x22 0x69 0xA6 0x32 : 0xA6

0x31 0x05 0x01 0x01 0x27 0xDE 0xA3 0x32 : 0xA3
0x31 0x05 0x01 0x01 0x27 0xE7 0x7A 0x32 : 0x7A

0x31 0x05 0x01 0x01 0x28 0xF0 0x6F 0x32 : 0x6F
0x31 0x05 0x01 0x01 0x28 0xF9 0xF5 0x32 : 0xF5

0x31 0x05 0x01 0x01 0x2B 0x38 0xF9 0x32 : 0xF9
0x31 0x05 0x01 0x01 0x2B 0x41 0x6A 0x32 : 0x6A
0x31 0x05 0x01 0x01 0x2B 0x4A 0x22 0x32 : 0x22

0x31 0x05 0x01 0x01 0xC3 0x0E 0x2D 0x32 : 0x2D
0x31 0x05 0x01 0x01 0xC3 0x20 0x64 0x32 : 0x64

0x31 0x05 0x01 0x01 0xEA 0xE3 0x3E 0x32 : 0x3E
0x31 0x05 0x01 0x01 0xEA 0xEC 0xBB 0x32 : 0xBB

0x31 0x05 0x01 0x01 0xF1 0x8E 0x28 0x32 : 0x28
0x31 0x05 0x01 0x01 0xF1 0xA0 0x61 0x32 : 0x61

They only differ in the last byte of message, but the checksum differs greatly.

For example, these pairs all have the same difference in low nibble of the 6th byte - the 0 becomes a 9, and it is last before the checksum:

Code: [Select]

0x31 0x05 0x01 0x01 0x00 0x00 0xA4 0x32
0x31 0x05 0x01 0x01 0x00 0x09 0x3E 0x32

0x31 0x05 0x01 0x01 0x22 0x60 0x3C 0x32
0x31 0x05 0x01 0x01 0x22 0x69 0xA6 0x32

0x31 0x05 0x01 0x01 0x28 0xF0 0x6F 0x32
0x31 0x05 0x01 0x01 0x28 0xF9 0xF5 0x32
The checksums change in a non-obvious way (or if it is obvious, it is one I cannot see).

[Gazello]

NO I dont have a dataset with one one bit difference , there are only 5 adresses which are completly different .

I cant see it for days. I use decimal to "see" more obvious things and to calculate easier



 
       

[NivagSwerdna]

D1  D2 CS
95   90   0
160   165   0

This is interesting

~95=160 and ~90=165

So

a op b => X
!a op !b => X

That identity is rather familiar...

Maybe not XOR but something simpler

[Ash]

Does the TIG welder give any acknowledgement of success / failure on the communication bus?

If so, wouldn't it be faster to just brute force the thing.. its only 256 possibilities for each packet, and then there are 256 possible settings, so run through them all and record the working ones. Then you can build a table for your software with either the full packet, or just the relevant checksum for the value.. 

Ash.

[hamster_nz]

First little wedge in...

If bytes 1,2 & 3 are the same, then if bytes 4 = bytes 5 then the checksum is the same:

0x31   0x05   0x01   0x01   0x00   0x00   0xA4   0x32
0x31   0x05   0x01   0x01   0x55   0x55   0xA4   0x32
0x31   0x05   0x01   0x01   0xAA   0xAA   0xA4   0x32
0x31   0x05   0x01   0x01   0xFF   0xFF   0xA4   0x32


Extended a little bit to...

If values 1,2 & 3 are the same, then if 4th and 5th byte XOR to the same value then the checksum is the same:

0x31   0x05   0x01   0x01   0x7D   0x45   0x14   0x32   
0x31   0x05   0x01   0x01   0x4C   0x74   0x14   0x32
0x31   0x05   0x01   0x01   0xB3   0x8B   0x14   0x32

0x7D XOR 0x45 = 0x4C XOR 0x74 = 0xB3 XOR 0x8B

0x31   0x05   0x01   0x01   0x67   0x17   0xAD   0x32
0x31   0x05   0x01   0x01   0x5D   0x2D   0xAD   0x32
0x31   0x05   0x01   0x01   0x36   0x46   0xAD   0x32
0x31   0x05   0x01   0x01   0x2C   0x5C   0xAD   0x32
0x31   0x05   0x01   0x01   0xD3   0xA3   0xAD   0x32

0x67   XOR 0x17 = 0x5D XOR 0x2D = 0x36 XOR 0x46 = 0x2C XOR 0x5C = 0xD3 XOR 0xA3

So if you only want to change bytes 4 and 5, you could look up the checksum. e.g  byte[6] = checksum_lookup_table[byte4 XOR byte5].

If that is the case (I haven't checked all the pairs in the supplied data), then these are also valid checksums (but most likely not valid commands!):

0x31   0x05   0x01   0x01   0x00   0x00   0xA4 0x32
0x31   0x05   0x01   0x01   0x00   0x02   0x76 0x32
0x31 0x05 0x01 0x01 0x00 0x37 0x91 0x32
0x31   0x05   0x01   0x01   0x00   0x38   0x14 0x32
0x31   0x05   0x01   0x01   0x00   0x56   0x17 0x32 
0x31   0x05   0x01   0x01   0x00   0x70   0xAD 0x32
0x31 0x05 0x01 0x01 0x00 0xB2 0xA1 0x32
0x31 0x05 0x01 0x01 0x00 0xFA 0xA3 0x32

So what is needed is to work out how the value in byte 5 alters the checksum in byte 6.

[NivagSwerdna]

Incidentally... what makes you think it is a checksum rather than the lsB of the reading?

[Gazello]

Hi to all the helpers,


the pot value  is not the problem , as I mentioned  I can simply replay the collected data .


The problem is the identifier . It is send out once a second and you have to answer right to make it work at all. NO acknowlege. Brute force does not work



 

[mahi]

I've ran all sample data through a program and the XOR result of all bytes (excluding the checksum) is always the same for byte combinations that have the same checksum.

So it is a checksum based on XOR. However, the checksum value itself does not seem to have a direct relation to the XOR result. Perhaps a mathematical operation is performed on the XOR result but I fail to see it. Maybe it's simply using a lookup table for obfuscation?

Instead of trying to figure out the relation between the checksum and the XOR value - if there even is one - you may be better off constructing a lookup table yourself (as already suggested by hamster_nz). The problem at this moment is that your sample data does not yet have all checksums from 0x00 to 0xFF - 109 values are still missing. Do you think you can somehow generate them?

Here's the (incomplete) lookup table constructed from the data provided earlier in the thread. The XOR in the list below is calculated over all bytes excluding checksum and the start (0x31) and end (0x32) bytes.

Code: [Select]

XOR  => Checksum
0x00 => 0x00
0x01 => ?
0x02 => ?
0x03 => 0xBB
0x04 => ?
0x05 => 0xA4
0x06 => 0x1F
0x07 => 0x76
0x08 => 0xF3
0x09 => 0x9A
0x0A => 0x21
0x0B => 0x48
0x0C => 0x3E
0x0D => ?
0x0E => 0xEC
0x0F => 0x85
0x10 => 0xE6
0x11 => 0x8F
0x12 => 0x34
0x13 => 0x5D
0x14 => 0x2B
0x15 => 0x42
0x16 => 0xF9
0x17 => 0x90
0x18 => 0x15
0x19 => ?
0x1A => 0xC7
0x1B => 0xAE
0x1C => ?
0x1D => ?
0x1E => 0x0A
0x1F => 0x63
0x20 => ?
0x21 => 0xCC
0x22 => ?
0x23 => 0x1E
0x24 => ?
0x25 => 0x01
0x26 => ?
0x27 => 0xD3
0x28 => ?
0x29 => ?
0x2A => 0x84
0x2B => ?
0x2C => 0x9B
0x2D => ?
0x2E => 0x49
0x2F => ?
0x30 => ?
0x31 => ?
0x32 => 0x91
0x33 => ?
0x34 => 0x8E
0x35 => 0xE7
0x36 => 0x5C
0x37 => ?
0x38 => 0xB0
0x39 => ?
0x3A => ?
0x3B => ?
0x3C => ?
0x3D => 0x14
0x3E => ?
0x3F => 0xC6
0x40 => 0x4A
0x41 => 0x23
0x42 => ?
0x43 => 0xF1
0x44 => 0x87
0x45 => 0xEE
0x46 => 0x55
0x47 => 0x3C
0x48 => ?
0x49 => 0xD0
0x4A => ?
0x4B => ?
0x4C => ?
0x4D => 0x1D
0x4E => 0xA6
0x4F => ?
0x50 => ?
0x51 => ?
0x52 => 0x7E
0x53 => 0x17
0x54 => 0x61
0x55 => ?
0x56 => ?
0x57 => 0xDA
0x58 => 0x5F
0x59 => 0x36
0x5A => 0x8D
0x5B => 0xE4
0x5C => ?
0x5D => 0xFB
0x5E => 0x40
0x5F => ?
0x60 => 0xEF
0x61 => ?
0x62 => ?
0x63 => ?
0x64 => 0x22
0x65 => ?
0x66 => 0xF0
0x67 => 0x99
0x68 => ?
0x69 => ?
0x6A => 0xCE
0x6B => 0xA7
0x6C => ?
0x6D => 0xB8
0x6E => ?
0x6F => 0x6A
0x70 => 0x09
0x71 => 0x60
0x72 => ?
0x73 => ?
0x74 => ?
0x75 => 0xAD
0x76 => ?
0x77 => ?
0x78 => 0xFA
0x79 => 0x93
0x7A => 0x28
0x7B => ?
0x7C => 0x37
0x7D => ?
0x7E => 0xE5
0x7F => ?
0x80 => ?
0x81 => ?
0x82 => 0x46
0x83 => ?
0x84 => 0x59
0x85 => 0x30
0x86 => 0x8B
0x87 => 0xE2
0x88 => ?
0x89 => 0x0E
0x8A => 0xB5
0x8B => 0xDC
0x8C => 0xAA
0x8D => 0xC3
0x8E => 0x78
0x8F => ?
0x90 => 0x72
0x91 => ?
0x92 => 0xA0
0x93 => ?
0x94 => 0xBF
0x95 => 0xD6
0x96 => ?
0x97 => ?
0x98 => 0x81
0x99 => 0xE8
0x9A => ?
0x9B => ?
0x9C => ?
0x9D => 0x25
0x9E => 0x9E
0x9F => 0xF7
0xA0 => ?
0xA1 => 0x58
0xA2 => ?
0xA3 => ?
0xA4 => ?
0xA5 => ?
0xA6 => ?
0xA7 => 0x47
0xA8 => ?
0xA9 => 0xAB
0xAA => ?
0xAB => 0x79
0xAC => 0x0F
0xAD => 0x66
0xAE => 0xDD
0xAF => ?
0xB0 => 0xD7
0xB1 => ?
0xB2 => 0x05
0xB3 => ?
0xB4 => 0x1A
0xB5 => ?
0xB6 => 0xC8
0xB7 => 0xA1
0xB8 => ?
0xB9 => 0x4D
0xBA => 0xF6
0xBB => 0x9F
0xBC => ?
0xBD => 0x80
0xBE => ?
0xBF => 0x52
0xC0 => ?
0xC1 => ?
0xC2 => 0x0C
0xC3 => ?
0xC4 => 0x13
0xC5 => 0x7A
0xC6 => 0xC1
0xC7 => 0xA8
0xC8 => 0x2D
0xC9 => 0x44
0xCA => ?
0xCB => ?
0xCC => ?
0xCD => ?
0xCE => ?
0xCF => 0x5B
0xD0 => 0x38
0xD1 => 0x51
0xD2 => 0xEA
0xD3 => ?
0xD4 => 0xF5
0xD5 => 0x9C
0xD6 => ?
0xD7 => ?
0xD8 => 0xCB
0xD9 => ?
0xDA => ?
0xDB => ?
0xDC => 0x06
0xDD => 0x6F
0xDE => ?
0xDF => ?
0xE0 => 0x7B
0xE1 => ?
0xE2 => ?
0xE3 => 0xC0
0xE4 => ?
0xE5 => 0xDF
0xE6 => 0x64
0xE7 => ?
0xE8 => ?
0xE9 => 0xE1
0xEA => 0x5A
0xEB => ?
0xEC => ?
0xED => 0x2C
0xEE => ?
0xEF => ?
0xF0 => ?
0xF1 => ?
0xF2 => ?
0xF3 => 0x26
0xF4 => ?
0xF5 => ?
0xF6 => 0x82
0xF7 => 0xEB
0xF8 => 0x6E
0xF9 => 0x07
0xFA => 0xBC
0xFB => 0xD5
0xFC => 0xA3
0xFD => 0xCA
0xFE => 0x71
0xFF => 0x18

[Gazello]

I cant produce any data , the only thing  I could do is , do the same thing for all 1023 ADC values !! and probably that data will fill the gaps in the lookup table.

[NivagSwerdna]

a op b => X
!a op !b => X

and of course that holds... for XOR

[jmelson]

The way I cracked this on a Fanuc serial encoder was by recording a bunch of outputs to a file.  Observing the data seemed to indicate a 5 bit CRC.  So, I built a 5-bit CRC checker in a C program, with the polynomial entered manually, and then ran it against the recorded data.  I then tried running it while entering all the polynomials.  One of them resulted in a constant zero output, so that was the magic polynomial.  You could even automate this and have the program go through all possible polynomials, looking for one where the resulting CRC output did not change.

Note that not all CRCs have to be an 8-bit polynomial.

Jon

[JimRemington]

But that is a really tough job because  everthing is done by hand and a logicanalyzer

If you will actually be using the results of all this effort, you will need to automate the message collection, correct?

So do that now, and collect a complete set of messages.

[hamster_nz]

I did some testing on all the longer datasets i have and it seems to work , but I really cant believe they  use a lookuptable for confusion .

The lookup table may serve some non-technical purpose. The most obvious one I can think of is it provides something that can be considered copyrightable.

[Rerouter]

Its not too uncommon in vehicles, running all bytes through a lookup table as anither layer if security through obscurity. Its expecially rife in earth moving equiptment where the crc input bytes and output bytes are pushed through one. Makes it a right pain to crack, (took jtag revengineerg to break those)