dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
1996
martino
join:2013-09-08
canada

martino

Member

CRC calculator + how to use

I need help with understanding how the CRC at the end of firmware files are generated.
At the end of the file, the crc supposed to be the last 4 bytes, but something called magic numbers are also mentioned.

Opened in Cygnus free hex editor , I have a firmware file which ends:

003AFFF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
003B0000 23 DE 53 C4 85 DA 20 BB

At first tried by cutting down at the end "85 DA 20 BB", and saved file, then used 3 different crc calculator program to get crc value of the file.
All 3 gave the same results, but it did not match with the original "85 DA 20 BB"

Next tried cutting down "23 DE 53 C4 85 DA 20 BB" ,and saved file and then used 3 different crc calculator program to get crc valueof the file.
same as before, all 3 gave the same results, but it did not look like anything as in the file.

The 3 crc calculator program I used in Windows XP:
HashMyFiles, HashCalc-Slavasoft, F-CRC Calculator

Any suggestion why this did not work ?
How can I calculate crc ?

Thanks!

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

You can not calculate the CRC of a file, insert that CRC into the file, and expect the CRC of the changed file to remain the same -it's not possible.

For things to work the way you expect, the inserted CRC would have to be stripped out of the file, then the CRC performed. And this couldn't work unless you knew exactly what to strip out of the file. Apparently you don't.

toro
join:2006-01-27
Scarborough, ON

toro to martino

Member

to martino
What firmware is this ?
martino
join:2013-09-08
canada

martino

Member

Rtp300
But i put it there as an example
So is it possible to calculate or not ?
thanks

toro
join:2006-01-27
Scarborough, ON

toro

Member

There are more than one methods to calculate a CRC, there's no universal one.
Yes, it's certainly possible to calculate the CRC for RTP300 I've done it with a Linux tool called "tichksum". No idea what's the algorithm but what I can tell you for sure is that it's 8 bytes long not 4.
martino
join:2013-09-08
canada

martino

Member

The 3 programs I mentioned, calculates crc-32....the result was an 8 digits number, is that 8 bytes ?

So it can be done,by removing everything after the FF-s and run calculation from beginning ?

I have a live PC LinuxOS cd, where is tichksum can be found ?

Thanks

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

CRC32 is eight hexadecimal digits.

toro
join:2006-01-27
Scarborough, ON

toro to martino

Member

to martino
said by martino:

I have a live PC LinuxOS cd, where is tichksum can be found ?

»www.google.com/search?q=tichksum
martino
join:2013-09-08
canada

martino

Member

looks like "tichksum" needs to be compiled from source code
there could be many issues with dependencies, missing libraries,etc...
I do not even have a Linux computer
I am done with this!

thanks for all the replies

toro
join:2006-01-27
Scarborough, ON

toro

Member

If you want to PM me a file I can apply the checksum to it.
Or if you decide to get a linux box and want a compiled version for x86, you can get it from »Re: [General] The new PAP2 v2.0 - Firmware 3.1.24!
martino
join:2013-09-08
canada

martino

Member

thanks for your generous offer, but I prefer to learn how to do it by myself
do you refer to file: pap2v2-utils.tbz2 (1) as a the compiled version ?
mazilo
From Mazilo
Premium Member
join:2002-05-30
Lilburn, GA

mazilo to martino

Premium Member

to martino
said by martino:

looks like "tichksum" needs to be compiled from source code
there could be many issues with dependencies, missing libraries,etc...

IIRC, this utility just needs a math library. So, the compilation is very simple and straightforward.

toro
join:2006-01-27
Scarborough, ON

toro to martino

Member

to martino
Yes, once you extract it you will find the compiled version of the tool.
martino
join:2013-09-08
canada

martino to mazilo

Member

to mazilo
yes, after extraction there are 4 files, including tichksum 18 kb 1/24/2008
I am going to start up a "live" linux distro from a CD on the weekend and try to run it
thanks for all the inputs

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

What OS are you using now?
mazilo
From Mazilo
Premium Member
join:2002-05-30
Lilburn, GA

mazilo to martino

Premium Member

to martino
You can get this tichksum; however, I don't know if it is compatible with your file.
martino
join:2013-09-08
canada

martino to graysonf

Member

to graysonf
already mentioned it my post #1
windows xp sp3
planning to start up a PCLinuxOS or Ubuntu "live" CD system on the weekend

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

There are many, many free Windows checksum utils available. I like Hashtab:

»www.implbits.com/HashTab ··· ows.aspx

But nothing is going to work like you want it to unless you know how to restore the file to the condition it was in when originally hashed prior to having the checksum inserted.
martino
join:2013-09-08
canada

1 edit

martino

Member

to make it clear:
-after I remove checksum from firmware end, the remaining file there is not the same as original file ??

This is how I saw the CRC process described:

The first thing to verify is that there were no transmission faults.
This can be done by adding to the software its Cyclic redundancy check (CRC) value.
The sender of the new program must compute the check value of the software and send it.
Upon reception of the software, the device creates the CRC of what has been downloaded and compares it to the original CRC.
If they are equal the program should be correct. Otherwise, it has been corrupted and it must be discarded.

1)What is the difference?
2)Can you tell me how to restore file to "original" condition ?

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

The way CRC checking is most often done is that the checksum is a separate value provided with the file, not within it.

So you need two pieces - the file and its checksum. You then perform a checksum on the file you downloaded and compare it to the separate checksum. If they are the same, the downloaded file is intact.
RonR
join:2003-10-10
Ash Flat, AR

RonR

Member

said by graysonf:

The way CRC checking is most often done is that the checksum is a separate value provided with the file, not within it.

Most firmware files and the like have one or more bytes reserved to hold a value necessary to cause the overall CRC checksum of the file to be an expected value (0, -1, or whatever). If you modify some area of the file, it's necessary to also set the reserved byte(s) so that the file's overall CRC checksum is still the expected value.

This allows the software which is loading/flashing the new firmware file to perform an integrity check without any additional files or information.

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

To make use of this feature out of band you would have to know where this information is stored within the file and to what portion of the file it applies to make use of it to get the expected result. Without that knowledge, as in the case of the OP, it isn't going to work.

toro
join:2006-01-27
Scarborough, ON

toro to martino

Member

to martino
In the case of RTP300 and other VoIP adapters based on the same design called by some CYT (from Cyber Tan, the company who designed them or portions of them), the checksum of the firmware .bin file is simply added as 8 bytes at the end of the file. So to obtain the file without checksum, shorten the file by 8 bytes.
The checksum is verified by the firmware updating tool to verify the integrity of the file uploaded before flashing.

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

If you read the OP, he tried exactly what you suggested but it failed. So there are a few possibilities:

1) He's making some fundamental mistake on an otherwise intact file and the process fails.

2) He's doing things correctly, but is using a corrupted file and the process fails.

Of course a failed checksum doesn't tell you what is wrong, only that it is wrong.

One thing that comes to my mind is using a Windows editor to edit a Unix file, making no changes whatsoever, and failing checksum anyway due to a CRLF conversion somewhere in the file.
martino
join:2013-09-08
canada

martino to toro

Member

to toro
you forget about another possibility

3) the CRC included on the file's end was calculated using some non-standard algoritm method, these are the common ones, and likely many more of them.....

CRC-1 most hardware; also known as parity bit 0x1 0x1 0x1
CRC-4-ITU G.704 0x3 0xC 0x9
CRC-5-EPC Gen 2 RFID[15] 0x09 0x12 0x14
CRC-5-ITU G.704 0x15 0x15 0x1A
CRC-5-USB USB token packets 0x05 0x14 0x12
CRC-6-CDMA2000-A mobile networks[16] 0x27 0x39 0x33
CRC-6-CDMA2000-B mobile networks[16] 0x07 0x38 0x23
CRC-6-ITU G.704 0x03 0x30 0x21
CRC-7 telecom systems, G.707, G.832, MMC, SD 0x09 0x48 0x44
CRC-7-MVB Train Communication Network, IEC 60870-5[17] 0x65 0x53 0x72
CRC-8 0xD5 0xAB 0xEA[7]
CRC-8-CCITT I.432.1; ATM HEC, ISDN HEC and cell delineation 0x07 0xE0 0x83
CRC-8-Dallas/Maxim 1-Wire bus 0x31 0x8C 0x98
CRC-8-SAE J1850 AES3 0x1D 0xB8 0x8E
CRC-8-WCDMA mobile networks[16][18] 0x9B 0xD9 0xCD[7]
CRC-10 ATM; I.610 0x233 0x331 0x319
CRC-10-CDMA2000 mobile networks[16] 0x3D9 0x26F 0x3EC
CRC-11 FlexRay[19] 0x385 0x50E 0x5C2
CRC-12 telecom systems[20][21] 0x80F 0xF01 0xC07[7]
CRC-12-CDMA2000 mobile networks[16] 0xF13 0xC8F 0xF89
CRC-13-BBC Time signal, Radio teleswitch[22] 0x1CF5 0x15E7 0x1E7A
CRC-15-CAN 0x4599 0x4CD1 0x62CC
CRC-15-MPT1327 [23] 0x6815 0x540B 0x740A
Chakravarty optimal for payloads 64 bits[17] 0x2F15 0xA8F4 0x978A
CRC-16-ARINC ACARS applications[24] 0xA02B 0xD405 0xD015
CRC-16-CCITT X.25, V.41, HDLC FCS, XMODEM, Bluetooth, PACTOR, SD, many others; known as CRC-CCITT 0x1021 0x8408 0x8810[7]
CRC-16-CDMA2000 mobile networks[16] 0xC867 0xE613 0xE433
CRC-16-DECT cordless telephones[25] 0x0589 0x91A0 0x82C4
CRC-16-T10-DIF SCSI DIF 0x8BB7[26] 0xEDD1 0xC5DB
CRC-16-DNP DNP, IEC 870, M-Bus 0x3D65 0xA6BC 0x9EB2
CRC-16-IBM Bisync, Modbus, USB, ANSI X3.28, SIA DC-07, many others; also known as CRC-16 and CRC-16-ANSI 0x8005 0xA001 0xC002
Fletcher Used in Adler-32 A & B Checksums Not a CRC; see Fletcher's checksum
CRC-17-CAN CAN FD[27] 0x1685B 0x1B42D 0x1B42D
CRC-21-CAN CAN FD[27] 0x102899 0x132281 0x18144C
CRC-24 FlexRay[19] 0x5D6DCB 0xD3B6BA 0xAEB6E5
CRC-24-Radix-64 OpenPGP, RTCM104v3 0x864CFB 0xDF3261 0xC3267D
CRC-30 CDMA 0x2030B9C7 0x38E74301 0x30185CE3
Adler-32 Zlib Not a CRC; see Adler-32
CRC-32 HDLC, ANSI X3.66, ITU-T V.42, Ethernet, Serial ATA, MPEG-2, PKZIP, Gzip, Bzip2, PNG,[28] many others 0x04C11DB7 0xEDB88320 0x82608EDB[10]
CRC-32C (Castagnoli) iSCSI, SCTP, G.hn payload, SSE4.2, Btrfs, ext4 0x1EDC6F41 0x82F63B78 0x8F6E37A0[10]
CRC-32K (Koopman) 0x741B8CD7 0xEB31D82E 0xBA0DC66B[10]
CRC-32Q aviation; AIXM[29] 0x814141AB 0xD5828281 0xC0A0A0D5
CRC-40-GSM GSM control channel[30][31] 0x0004820009 0x9000412000 0x8002410004
CRC-64-ECMA ECMA-182, XZ Utils 0x42F0E1EBA9EA3693 0xC96C5795D7870F42 0xA17870F5D4F51B49
CRC-64-ISO HDLC, Swiss-Prot/TrEMBL; considered weak for hashing[32] 0x000000000000001B 0xD800000000000000 0x800000000000000D

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

Well, I said a few possibilities, not all.

The problem you have is one lack of knowledge - you don't know what algorithm was used to checksum the file, and even if you did know, you can't be sure you aren't making some mistake trying to process the file, or or even if the file you have is not corrupted in some way. As I said, failure means failure, but not why.

Exactly what are you trying to accomplish?
martino
join:2013-09-08
canada

martino

Member

file is not corrupted, flashes error free into device
see post 1, sentence 1

graysonf
MVM
join:1999-07-16
Fort Lauderdale, FL

graysonf

MVM

Ask the people who generated the file.

toro
join:2006-01-27
Scarborough, ON

toro to graysonf

Member

to graysonf
said by graysonf:

If you read the OP, he tried exactly what you suggested but it failed.

I did read it, but unless I'm misunderstanding, his original question was about the algorithm used. None of the algorithms he tried generated the same CRC he was seeing at the end of the file.
Hence my answer about the utility I have been using to generate the checksum for firmware files compatible with the RTP300 router (and other routers from the same family).
martino
join:2013-09-08
canada

martino to graysonf

Member

to graysonf
why I wasn't think of that
I am going to call the nice people at Vonage right now