Search code examples
reverse-engineeringchecksumcrc16

Config File Checksum guessing (CRC)


I'm currently "hacking" an old 3d Printer, built in 1996. There is Software running on an old Windows PC. I need to modify some parameters which are not accessible from the front end, so I wanted to modify the config files. But if I modify something, it could not be read anymore. I noticed, that there is a checksum at the end of the file, and I'm not really an checksum expert. I assume that, while loading the file, this checksum is calculated again and compared to the one at the end. I'm having trouble finding out which checksum algorithm is used.

What I already found out: I think it's not just an addition of the bits in the file. When I'm switching two characters, an checksum, that is generated with addition, would not change. But the software won't take that file.

I'm guessing its some kind of CRC16, because a checksum looks like that:

0x4f20

As I have calculated that number with several usual CRC16 parameters and could not find a match with the "4f20", I assume that it must be an custom CRC16..

Here is a complete sample file:

PACKET noname
  style 502
  last_modified 1511855084 # Tue Nov 28 08:44:44 2017

  STRUCTURE MACHINE_OVRL
    PARAM distance_units
      Value = "millimeters"
    ENDPARAM
    PARAM language
      Value = "English"
    ENDPARAM
  ENDSTRUCTURE
ENDPACKET
checksum 0x4f20

I think either the checksum itself or the complete line "checksum 0x4f20" is not being considered while calculated, because thats not possible (?)

Any help is appreciated.

Edit: I got some more files with checksums of course, but these are a lot longer than this file. If needed, I could provide them too..


Solution

  • RevEng was written for this purpose. Given several examples of the input and the associated CRCs, RevEng will derive the CRC parameters. If it is a CRC.