Help reverse engineering a CRC

Question

Evening all

Been trying to reverse-engineer the CRC for this data, and no clue what CRC is being used. What we think is the first 6 bytes are the data, the 7th is a sequence number, and the 8th the actual CRC.

So: Data: 277F0000FFFF Sequence/counter?: 00 CRC: 61

Sample here:

277F0000FFFF0061
277F0000FFFF0104
277F0000FFFF024E
277F0000FFFF032B
277F0000FFFF043F
277F0000FFFF055A
277F0000FFFF0610
277F0000FFFF0775
277F0000FFFF0838
277F0000FFFF095D
277F0000FFFF0A17
277F0000FFFF0B72
277F0000FFFF0C66
277F0000FFFF0D03
277F0000FFFF0E49
277F0000FFFF0F2C
277F0000FFFF1036
277F0000FFFF1153
277F0000FFFF1219
277F0000FFFF137C
277F0000FFFF1468
277F0000FFFF150D
277F0000FFFF1647
277F0000FFFF1722
277F0000FFFF186F
277F0000FFFF190A
277F0000FFFF1A40
277F0000FFFF1B25
277F0000FFFF1C31
277F0000FFFF1D54
277F0000FFFF1E1E
277F0000FFFF1F7B
277F0000FFFF202A
277F0000FFFF214F
277F0000FFFF2205
277F0000FFFF2360
277F0000FFFF2474
277F0000FFFF2511
277F0000FFFF265B
277F0000FFFF273E
277F0000FFFF2873
277F0000FFFF2916
277F0000FFFF2A5C
277F0000FFFF2B39
277F0000FFFF2C2D

Tried reveng both with and without the counter, but no clue and have no idea what to do next. Any suggestions please?

REVENG -w 8 -s 277F0000FFFF0061 277F0000FFFF0104 277F0000FFFF024E 277F0000FFFF1219 REVENG: no models found

REVENG -w 8 -s 277F0000FFFF61 277F0000FFFF04 277F0000FFFF4E 277F0000FFFF19 REVENG: no models found

I may be wrong, but these look like canbus messages to me. Please provide more details about this:

From what application is it?

Do you have a firmware dump?

Some more relevant information about this. — Deadbeef, Aug 24 '23 at 21:39
This if from a Claas tractor, I believe, and yes CANBUS. No firmware dump unfortunately.
I plan to grab my own traces, just in case there's any more info I can find, these were provided to me however as being exactly that. I have asked Claas for assistance in encoding this "Open Steering Interface" protocol, but no response as yet.

I'm suspecting their interface is not quite as "open" as they might otherwise claim.. — Andy, Aug 26 '23 at 14:06
Hello Andy, would you please include the CAN identifiers as well? I mean CAN identifers plus the 8 payload bytes. — C0DER, Aug 27 '23 at 20:38
Thanks, will see if I have them - I was given this trace sanitised, but it's on my to-do list to gather some myself with full IDs — Andy, Aug 30 '23 at 17:23

score 1 · Answer 1 · answered Jul 24 '23 at 08:22

From this dataset looks like the CRC init value changes - its in a group of 8 different values with poly=0xc5

$ reveng -w 8 -s 277F0000FFFF024E 277F0000FFFF055A 277F0000FFFF0B72 277F0000FFFF0C66
width=8  poly=0xc5  init=0xd4  refin=false  refout=false  xorout=0x00  check=0x42  residue=0x00  name=(none)
$ reveng -w 8 -s 277F0000FFFF2205 277F0000FFFF2511 277F0000FFFF2B39 277F0000FFFF2C2D
width=8  poly=0xc5  init=0x5e  refin=false  refout=false  xorout=0x00  check=0x40  residue=0x00  name=(none)
$ reveng -w 8 -s 277F0000FFFF202A 277F0000FFFF273E 277F0000FFFF2916
width=8  poly=0xc5  init=0x1d  refin=false  refout=false  xorout=0x00  check=0x2b  residue=0x00  name=(none)
$ reveng -w 8 -s 277F0000FFFF2360 277F0000FFFF2474 277F0000FFFF2A5C
width=8  poly=0xc5  init=0x9b  refin=false  refout=false  xorout=0x00  check=0xfd  residue=0x00  name=(none)
$ reveng -w 8 -s 277F0000FFFF214F 277F0000FFFF265B 277F0000FFFF2873
width=8  poly=0xc5  init=0xd8  refin=false  refout=false  xorout=0x00  check=0x96  residue=0x00  name=(none)
$ reveng -w 8 -s 277F0000FFFF0061 277F0000FFFF0775 277F0000FFFF095D 277F0000FFFF0E49 277F0000FFFF1219 277F0000FFFF150D 277F0000FFFF1B25 277F0000FFFF1C31
width=8  poly=0xc5  init=0x97  refin=false  refout=false  xorout=0x00  check=0x29  residue=0x00  name=(none)
$ reveng -w 8 -s 277F0000FFFF032B 277F0000FFFF043F 277F0000FFFF0A17 277F0000FFFF0D03
width=8  poly=0xc5  init=0x11  refin=false  refout=false  xorout=0x00  check=0xff  residue=0x00  name=(none)
$ reveng -w 8 -s 277F0000FFFF0104 277F0000FFFF0610 277F0000FFFF0838 277F0000FFFF0F2C
width=8  poly=0xc5  init=0x52  refin=false  refout=false  xorout=0x00  check=0x94  residue=0x00  name=(none)

Whats confusing to me is this property still holds for all available value in this dataset. From wikipedia

Example

In [26]: tests = ['277F0000FFFF0061', '277F0000FFFF0104', '277F0000FFFF024E', '277F0000FFFF032B', '277F0000FFFF043F', '277F0000FFFF055A', '277F0000FFFF0610', '277F0000FFFF0775', '
    ...: 277F0000FFFF0838', '277F0000FFFF095D', '277F0000FFFF0A17', '277F0000FFFF0B72', '277F0000FFFF0C66', '277F0000FFFF0D03', '277F0000FFFF0E49', '277F0000FFFF0F2C', '277F0000FF
    ...: FF1036', '277F0000FFFF1153', '277F0000FFFF1219', '277F0000FFFF137C', '277F0000FFFF1468', '277F0000FFFF150D', '277F0000FFFF1647', '277F0000FFFF1722', '277F0000FFFF186F', '
    ...: 277F0000FFFF190A', '277F0000FFFF1A40', '277F0000FFFF1B25', '277F0000FFFF1C31', '277F0000FFFF1D54', '277F0000FFFF1E1E', '277F0000FFFF1F7B', '277F0000FFFF202A', '277F0000FF
    ...: FF214F', '277F0000FFFF2205', '277F0000FFFF2360', '277F0000FFFF2474', '277F0000FFFF2511', '277F0000FFFF265B', '277F0000FFFF273E', '277F0000FFFF2873', '277F0000FFFF2916', '
    ...: 277F0000FFFF2A5C', '277F0000FFFF2B39', '277F0000FFFF2C2D']
In [27]: b = [bytes.fromhex(i) for i in tests]
In [28]: xor(xor(b[0], b[1]), b[8]) == b[9]
Out[28]: True

I wonder if the init comes from info in a different PGN perhaps?
I'm going to try and get my own trace, perhaps this one was filtered before I received it, this is all I have:

https://pastebin.com/Z2fSNfsF and there's this one as well from the same machine: https://pastebin.com/bHRe2PJw — Andy, Jul 25 '23 at 09:45

Help reverse engineering a CRC

1 Answers1