Help with working out checksum method

Wireless & IoT
1

Hello Forum members

I have been trying to crack the checksum method for an RC tank controller from Heng Long

the Transmitter and Receiver use a TI CC2500 2.4ghz transceiver module and using a logic analyzer

have got the SPI codes to setup the CC2500 and the stick function data sent from the transmitter to the

tank control receiver board, the codes I have received are

Idle 3F7F82005A AC 120000 CHECKSUM IS AC

Ignition 3F7F82045A B0 120000 CHECKSUM IS B0

Mach Gun 3F7F82025A AE 120000 CHECKSUM IS AE

Main Gun 3F7F82015A AD 120000 CHECKSUM IS AD

BB Gun 3F7F82405A EC 120000 CHECKSUM IS EC

Gun Elevation 3F7F82205A CC 120000 CHECKSUM IS CC

Turret Right 3F7F82085A B4 120000 CHECKSUM IS B4

Turret Left 3F7F82105A BC 120000 CHECKSUM IS BC

Motor Fwd Full 3F0080085A 2D 120000 CHECKSUM IS 2D

Motor Rvs Full 3FFE80085A 2B 120000 CHECKSUM IS 2B

Motor Left Full 3F7F00085A 2A 120000 CHECKSUM IS 2A

Motor Right Full 3F7FFF085A 29 120000 CHECKSUM IS 29

Mach Gun & Gun Elevation together 3F7F83225A CF 120000 CHECKSUM IS CF

Motor Fwd Full & Turrett Right 3F0183085A 37 120000 CHECKSUM IS 37

Motor Fwd Full & Fwd Right Full & Machine Gun 3F0FF3025A B3 120000 CHECKSUM IS B3

Do not know what the 120000 is, it could be the binding code not sure, I would have to look at another

transmitter to see if it changes.

I have tried the simple XOR and summing checksums to no avail and have used reveng thinking it may be

a type of CRC checksum as shown below, as you can see some work providing the correct checksum and others

do not.

would appreciate any help in working out the checksum method for the Heng Long transmitter.

regards Andrew

F:>reveng -a4 -w8 -s 3F7F82005AAC 3F7F82405AEC

width=8 poly=0x01 init=0x34 refin=false refout=false xorout=0x00 check=0x05 name=(none)

width=8 poly=0x01 init=0xc2 refin=true refout=true xorout=0x00 check=0x72 name=(none)

F:>reveng -c -w 8 -p 01 -i 34 3F7F82015A

ad correct

F:>reveng -c -w 8 -p 01 -i 34 3F7F82025A

ae correct

F:>reveng -c -w 8 -p 01 -i 34 3F7F82045A

a8 wrong should be B0

F:>reveng -c -w 8 -p 01 -i 34 3F7F82085A

a4 wrong should be B4

F:>reveng -c -w 8 -p 01 -i 34 3F7F82105A

bc correct

F:>reveng -c -w 8 -p 01 -i 34 3F7F82205A

8c wrong should be CC

F:>reveng -c -w 8 -p 01 -i 34 3F0183085A

db wrong should be 37

F:>reveng -c -w 8 -p 01 -i C2 3F0183085A

2d wrong should be 37

2

You are on the right track, but not there yet. Try supplying more messages to reveng -s (e.g. at least three at a time).

3

Hello jremington

Thanks for the reply.

I have tried as you suggested three or more but it says no models found, I even tried using reveng without the constants in those data frames 3F & 5A thinking that they maybe the preamble and postamble in the data frame, but still no success, any other suggestions?

regards Andrew

F:>reveng -a 4 -w 8 -s 3f7f82005aac 3f0183085a37 3ffe82005a2b

reveng: no models found

F:>reveng -a 4 -w 8 -s 3f7f82005aac 3f0183085a37 3ffe82005a2b 3f07ff025ab3

reveng: no models found

F:>reveng -a 4 -w 8 -s 3f7f82005aac 3ffe82005a2b

width=8 poly=0x91 init=0x68 refin=false refout=false xorout=0x00 check=0xfa name=(none)

width=8 poly=0xb9 init=0xe5 refin=true refout=true xorout=0x00 check=0xe4 name=(none)

width=8 poly=0xdb init=0xb6 refin=true refout=true xorout=0x00 check=0x2e name=(none)

F:>reveng -c -w 8 -p db -i b6 3f7f83225a

88 should be CF

F:>reveng -c -w 8 -p 91 -i 68 3f7f83225a

80 should be CF

F:>reveng -a 4 -w 8 -s 3f7f82005aac 3f07ff025ab3

width=8 poly=0x87 init=0x53 refin=false refout=false xorout=0x00 check=0xcc name=(none)

F:>reveng -c -w 8 -p 87 -i 53 3f7f83225a

5c should be CF

F:>reveng -a 4 -w 8 -s 3f7f82005aac 3f0183225acf

reveng: no models found

F:>reveng -a 4 -w 8 -s 3f7f82005aac 3f7f82025aae 3f7f045ab0

reveng: no models found

F:>reveng -a 4 -w 8 -s 7f8200ac 7f8202ae

width=8 poly=0x01 init=0x51 refin=false refout=false xorout=0x00 check=0x60 name=(none)

width=8 poly=0x01 init=0xa8 refin=true refout=true xorout=0x00 check=0x24 name=(none)

F:>reveng -a 4 -w 8 -s 7f8200ac 07ff02b3

reveng: no models found

F:>reveng -a 4 -w 8 -s 7f8200ac 7f8202ae 01830837

reveng: no models found

F:>reveng -c -w 8 -p 01 -i a8 7f8322

76 should be CF