CRC's..Checksums.. Reverse Engineering!

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
Post Reply
User avatar
Tazzi
Posts: 3438
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by Tazzi »

antus wrote:Ok. The CVN is a CRC16, and the sum is a 16 bit 2s compliment. When calculating the data you need to update the CVN first, as it IS included in the sum. The CVN is not a derivative of the sum (or directly vice versa).

Makes sense really as the scan tools (or PCs) can verify the CVN after reading the bin for warranty test purposes (that's why its in there), but the PCM only needs to do the sum which is quicker in an embedded system like a pcm. CRC can be accellerated with a lookup table, but they are probably looking at it from a space savings angle in the pcm, and its not really needed anyway.

Next steps, figure out how to ID each segment type, handle disabled sums and segments, handle differing numbers of segments, and add partnumber/ID strings.

Also, put this login in to a TP checksum plugin. Probably merge the delco checksum plugin, ls1 checksum plugin, and e38 checksumtool in to one TP5 checksum plugin.

Whos keen to help work on XDFs?
Alright! Major progress! :thumbup:

how to ID each segment type
I assume we simply do this via the part number in each section? Always appear between the two checksums.

handle disabled sums and segments
Again, same as above? If the ID number doesnt appear/ no checksums/ all 00's or FF's.. then that segment must not be supported?

partnumber/ID strings
I think this is something we need to get rolling. Need as many partnumbers/IDs for each segment and the OS number to find how eveything differs. :thumbup:


Iv got no experience in XDF's, will probably be more of a pain than help but Ill try!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
antus
Site Admin
Posts: 8257
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by antus »

Tazzi wrote: how to ID each segment type
I assume we simply do this via the part number in each section? Always appear between the two checksums.
I mean the order of the index does not match the order displayed by other apps. There must be a way to know if a segment is engine operations, engine dignostics etc. Then we can order them in a more logical way in applications. It may be a static order, I havnt had time to check yet.
Tazzi wrote: handle disabled sums and segments
Again, same as above? If the ID number doesnt appear/ no checksums/ all 00's or FF's.. then that segment must not be supported?
Nope, they're there and they have sums. But other apps can say "unused". Probably they will be missing the type information (see above).
Tazzi wrote: partnumber/ID strings
I think this is something we need to get rolling. Need as many partnumbers/IDs for each segment and the OS number to find how eveything differs. :thumbup:
That bit is easy, its just a text string in the header. Just reading it out and displaying it comes after v0.1 of my app :D
Tazzi wrote: Iv got no experience in XDF's, will probably be more of a pain than help but Ill try!
Great! A lot of it is changing, testing, looking for changes. Entering whats figured out in to the Tunerpro XDF editor. For the amount of data, its a lot of work. But we need to decide what OSIDs are most common and hit those.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Tazzi
Posts: 3438
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by Tazzi »

Yeah thats what I mneant, each segments "number" might be static (havent checked). Bit if the segments are there.. and other apps say "unused".. then there must be something in the index indicating it I reckon.

Haha, yes it is the easy bit, but its identifying all the possible OSID's that we could potentially support.. or finding any that dont match up/work with our current findings!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3438
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by Tazzi »

antus wrote:Ok. The CVN is a CRC16, and the sum is a 16 bit 2s compliment. When calculating the data you need to update the CVN first, as it IS included in the sum. The CVN is not a derivative of the sum (or directly vice versa).
Alright cool, iv got to the same point now, only difference is Im using the little algo for checksum1 instead of adding it all up as thats just what I had previously. :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Tazzi
Posts: 3438
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by Tazzi »

In the bin Im tinkering with, Iv got:
2008 VE M6
Seg1: Operating System - 12612381
Seg2: System - 92205534
Seg3: Fuel System - 92196978
Seg4: Speedometer - 92196089
Seg5: Engine Diagnostics - 92205532
Seg6: Engine Operations -92207268

2009 VE M6
Seg1: Operating System - 12633016
Seg2: System - 92246473
Seg3: Fuel System - 92241157
Seg4: Speedometer - 92241152
Seg5: Engine Diagnostics - 92241159
Seg6: Engine Operations - 92241170

Ill grab some more and see if they change

*Edit
Ant, the "unused" is transmission :thumbup:
Evidently manuals will not have that section.

This makes sense, since the "Index" only has 6 segments mapped into it and that is it. And these 6 segments take up most of the bin. The trans will be an entirely separate bin.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
immortality
Posts: 3427
Joined: Thu Apr 09, 2009 12:31 pm
cars: VH, VN, VS, VX

Re: CRC's..Checksums.. Reverse Engineering!

Post by immortality »

I'm happy to help but this stuff is over my head :(

I haven't done any coding since I was at tech and that was to long ago.
User avatar
Tazzi
Posts: 3438
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by Tazzi »

immortality wrote:I'm happy to help but this stuff is over my head :(

I haven't done any coding since I was at tech and that was to long ago.
It all mapping out the bins now.. sort of. Just need to see if certain parameters changes their offset in their segments when opening up different bins. Hopefully, they are all in the same offsets.. will find out shortly.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
Holden202T
Posts: 10311
Joined: Sat Feb 28, 2009 9:05 pm
Location: Tenambit, NSW
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by Holden202T »

when I saw the bit about mapping it out, reminded me about this .... VZ V6 5 speed auto (190kw alloytec) not sure if its any use to your stuff or not.
2010-12-31 - original file read.bin
(2.5 MiB) Downloaded 317 times
testing VZ V6 Auto.xdf
(14.77 KiB) Downloaded 331 times
most of the stuff in there is change it in HPT/efilive and see what changes in the bin using compare in tuner pro then making the XDF from there....
User avatar
antus
Site Admin
Posts: 8257
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by antus »

Heres something for anyone who wants to play along. I dont know if it will handle all bins or not, but one way to find out......
Attachments
E38 Sums.zip
(54.9 KiB) Downloaded 388 times
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
Tazzi
Posts: 3438
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: CRC's..Checksums.. Reverse Engineering!

Post by Tazzi »

Ah damnnn... each bin with a different OSID has to be worked out individually. Just checked three bins with varying ID's, and the parameters in each one are found at different locations in their segments. The offset from the beginning of the segment to the parameters is not the same. Guess that solves that question.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Post Reply