1

I have the same situation as in question CRC8 reverse engineering. But changing the final XOR value seems not to solve my problem and reveng does not help as well.

I am copying the text from the original question here again:

I am creating a CAN Bus on-bench testing solution which replicates the entire vehicle to test a single module. I have a number of messages that require a CRC byte in order to be valid. The messages are in little-endian byte order, and the CRC value is held in byte 0. I have collected valid messages with a changing 4 bit alive-counter along with their CRC byte with the hope someone can help. I have tried CRC reveng, but either do not know hot to use it correctly or it is unable to find the polynomial, as it shows "No models found" when searching.

For reference, I found documentation that suggests the polynomial used is the standard SAE J1850 CRC8 polynomial x^8 + x^4 + x^3 + x^2 + 1, with a CRC-ID in decimal of 166 (stated as used for the low byte). I have also tried with the online calculator available here: http://www.sunshine2k.de/coding/javascript/crc/crc_js.html, but cannot get the correct result.

If anyone could provide some assistance, I would greatly appreciate it. I would like help in clarifying the correct polynomial, along with any other relevant parameters.

Here my messages (can provide different, more complex data if required):

CRC   DATA
DE    10 FF FF FF FF FF FF      
CB    11 FF FF FF FF FF FF      
A3    12 FF FF FF FF FF FF      
48    13 FF FF FF FF FF FF      
96    14 FF FF FF FF FF FF      
36    15 FF FF FF FF FF FF      
EB    16 FF FF FF FF FF FF      
1C    17 FF FF FF FF FF FF      
6A    18 FF FF FF FF FF FF      
9D    19 FF FF FF FF FF FF   
40    1A FF FF FF FF FF FF   
E0    1B FF FF FF FF FF FF   
3E    1C FF FF FF FF FF FF   
43    1D FF FF FF FF FF FF   
9E    1E FF FF FF FF FF FF   
69    1F FF FF FF FF FF FF

CAN trace is from a 9G automatic transmission but most of the messages on this powertrain bus seem to use the same mechanism (counter in the same 4 bits, CRC in the first byte, etc.). Any help with finding out how this CRC byte is calculated is highly appreciated : )

Here some more data from another message (id 0x37):

CRC   DATA
FC  20 88 04 21 00 0F 00   
88  21 88 05 21 00 0F 00   
95  22 88 04 21 00 0F 00   
79  23 88 05 21 00 0F 00   
66  24 88 04 21 00 0F 00   
56  25 88 04 21 00 0F 00   
56  26 88 05 21 00 0F 00   
8A  27 88 04 21 00 0F 00   
17  28 88 05 21 00 0F 00   
76  29 88 04 21 00 0F 00   
D3  2A 88 05 21 00 0F 00   
4C  2B 88 04 21 00 0F 00   
EE  2C 88 05 21 00 0F 00   
E9  2D 88 04 21 00 0F 00   
A2  2E 88 05 21 00 0F 00   
1B  2F 88 04 21 00 0F 00

Just found this table in the Damos for the corresponding ECU:

Unique identifier array for the CRC calculation of the signal group TCM_EngIntrvntn_Pr2 of the message TCM_EngIntrvntn_AR2
56  5E  66  6E  76  7E  86  8E  96  9E  A6  AE  B6  BE  C6  CE

Maybe a different initial of final value is used for every counter value? Will try to generate messages with changing data for the same counter value.

Only thing I have in my logs is this one at the moment:

CRC Data (counter value '2')
95  22 88 04 21 00 0F 00   
C1  22 88 05 21 00 0F 00
Peter Fischer
  • 21
  • 6
  • Looks like most reliable way to find that - reverse algo from binary, if you have that. Fortunatelly you already know some checksum constants locations (I hope damos not lie here). – Alexey Esaulenko Nov 09 '23 at 14:49

1 Answers1

1

seems like I finally found it:

CRC is calculated with polynomial 0x2F, inital 0xFF and final 0xFF. As data are the bytes 1 to 7 used and as an 8th byte the value from table for the current message for the current counter value. Yes, there is one table for each message (Unique identifier array for the CRC calculation of the signal group xyz)...

Peter Fischer
  • 21
  • 6
  • I wrote some lines of code to create these tables for all messages on the bus. The code just adds all possible values for the 8th data byte (brute force) and checks if the calculated crc8 value maches that of the logged message. While doing that I found that some messages don't use all 7 bytes but only 3,4 or 6 of the data bytes to calculate the crc value - weird stuff... ;-) – Peter Fischer Dec 19 '23 at 13:22