Programming Forums > Application Development > Assembly

htel · Dec 29th, 2005, 5:53 PM

I was wondering if anyone is clever enough to solve the following riddle which would enable people to flash chips on freeview boxes via the rs232 port when they go bad.

The freeview box accepts the header and verifies the crc but how on earth does it come up with this crc?

I have tried crc/crc32/adler etc using the first 0x30 bytes but get different results.

The header:
00020000 A1 37 20 48 00 0B 53 17-00 25 20 88 00 00 00 04 .7 H. S.% ....
00020010 00 00 00 0A 80 00 01 00-80 00 01 00 49 69 6E 69 .........Iini
00020020 74 69 61 6C 20 76 65 72-73 69 6F 6E 00 00 00 00 tial version....
00020030 29 DB AC C4 78 9C EC BD-0D 78 5C C7 71 20 58 F3 )...x...x\.q X.

The crc is 29 DB AC C4
The header is 0x34 bytes which includes the crc at the end.

Agian from a different version:
00020000 A1 37 20 48 00 0A B1 34-00 21 1E 94 00 00 00 03 .7 H..4.!....
00020010 00 00 00 16 80 00 01 00-80 00 01 00 56 30 2E 33 .........V0.3
00020020 2E 32 32 00 00 00 00 00-00 00 00 00 00 00 00 00 .22.............
00020030 2D E9 9D DF 78 9C E4 BD-0D 74 54 D7 75 28 BC E7 -...x...tT.u(..

The crc is now 2D E9 9D DF

Dameon · Dec 29th, 2005, 6:00 PM

Did you try a simple checksum?

htel · Dec 30th, 2005, 11:37 AM

I have tried a whole host of checksums none of which gives the same result. The LSI LOGIC chip inside uses some method to get the result above but I can't fathom out how it does it.

Which checksum would you suggest?

Dameon · Dec 30th, 2005, 12:04 PM

I wasn thinking along the lines of adding the values of each byte or counting the number of bits, rather than the more sophisticated and expensive algorithms.

If the data from which you got those hex dumps were uploaded, it would be easier for people to poke around.

htel · Dec 31st, 2005, 10:31 AM

Good idea, the data is here http://www.htelephones.co.uk/frt/data1.bin
http://www.htelephones.co.uk/frt/data2.bin

I know for sure that it refers to the 0x30 bytes as I changed a few bytes and the crc failed on the box.

Mad_guy · Jan 1st, 2006, 1:07 AM

Perhaps you would like to take a look at this article (+HCU and +Fravia articles rule): http://www.woodmann.com/fravia/crctut1.htm

htel · Jan 1st, 2006, 4:59 PM

Thanks for that, though I have read this article beforehand. However it fails to show how to calculate a crc and give the same result. No matter what method I try nothing will produce the same crc as the one it is supposed to.

Dec 29th, 2005, 5:53 PM	#1
htel Newbie Join Date: Dec 2005 Posts: 4 Rep Power: 0	crc check riddle I was wondering if anyone is clever enough to solve the following riddle which would enable people to flash chips on freeview boxes via the rs232 port when they go bad. The freeview box accepts the header and verifies the crc but how on earth does it come up with this crc? I have tried crc/crc32/adler etc using the first 0x30 bytes but get different results. The header: 00020000 A1 37 20 48 00 0B 53 17-00 25 20 88 00 00 00 04 .7 H. S.% .... 00020010 00 00 00 0A 80 00 01 00-80 00 01 00 49 69 6E 69 .........Iini 00020020 74 69 61 6C 20 76 65 72-73 69 6F 6E 00 00 00 00 tial version.... 00020030 29 DB AC C4 78 9C EC BD-0D 78 5C C7 71 20 58 F3 )...x...x\.q X. The crc is 29 DB AC C4 The header is 0x34 bytes which includes the crc at the end. Agian from a different version: 00020000 A1 37 20 48 00 0A B1 34-00 21 1E 94 00 00 00 03 .7 H..4.!.... 00020010 00 00 00 16 80 00 01 00-80 00 01 00 56 30 2E 33 .........V0.3 00020020 2E 32 32 00 00 00 00 00-00 00 00 00 00 00 00 00 .22............. 00020030 2D E9 9D DF 78 9C E4 BD-0D 74 54 D7 75 28 BC E7 -...x...tT.u(.. The crc is now 2D E9 9D DF

Dec 29th, 2005, 6:00 PM	#2
Dameon Troll Join Date: Apr 2005 Location: Texas Posts: 732 Rep Power: 4	Did you try a simple checksum? __________________ MD5(sig) = bcef75433db02e9ad9bf81d6f7c5c270

Dec 30th, 2005, 12:04 PM	#4
Dameon Troll Join Date: Apr 2005 Location: Texas Posts: 732 Rep Power: 4	I wasn thinking along the lines of adding the values of each byte or counting the number of bits, rather than the more sophisticated and expensive algorithms. If the data from which you got those hex dumps were uploaded, it would be easier for people to poke around. __________________ MD5(sig) = bcef75433db02e9ad9bf81d6f7c5c270

Jan 1st, 2006, 1:07 AM	#6
Mad_guy Hobbyist Programmer Join Date: Oct 2004 Location: Sandstorm, Techno Club Posts: 239 Rep Power: 4	Perhaps you would like to take a look at this article (+HCU and +Fravia articles rule): http://www.woodmann.com/fravia/crctut1.htm __________________ os: mac os 10.5.4 revision control: git editor: emacs site

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Dec 30th, 2005, 11:37 AM	#3
htel Newbie Join Date: Dec 2005 Posts: 4 Rep Power: 0	I have tried a whole host of checksums none of which gives the same result. The LSI LOGIC chip inside uses some method to get the result above but I can't fathom out how it does it. Which checksum would you suggest?

Dec 31st, 2005, 10:31 AM	#5
htel Newbie Join Date: Dec 2005 Posts: 4 Rep Power: 0	Good idea, the data is here http://www.htelephones.co.uk/frt/data1.bin http://www.htelephones.co.uk/frt/data2.bin I know for sure that it refers to the 0x30 bytes as I changed a few bytes and the crc failed on the box.

Jan 1st, 2006, 4:59 PM	#7
htel Newbie Join Date: Dec 2005 Posts: 4 Rep Power: 0	Thanks for that, though I have read this article beforehand. However it fails to show how to calculate a crc and give the same result. No matter what method I try nothing will produce the same crc as the one it is supposed to.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Programming Forums > Application Development > Assembly

crc check riddle