Reverse-Engineering a CRC Algorithm (2010)

[_Microft]

https://www.cosc.canterbury.ac.nz/greg.ewing/essays/CRC-Reverse-Engineering.html

[dale_glass]

The mysterious 4 extra bytes might be the CRC itself.

In some systems, when calculating the CRC of a file that embeds the CRC itself, you use a fixed value like all zeroes in the part of the message that would contain the CRC. For instance, the IPv4 checksum:

"The checksum field is the 16-bit ones' complement of the ones' complement sum of all 16-bit words in the header. For purposes of computing the checksum, the value of the checksum field is zero."

[_Microft → dale_glass]

I had the same idea when reaching that part, as calculating the checksum with zeroed out bytes at the checksum position is not that unusual.

[osamagirl69]

This is a wonderful story, I love the writing style. Learned a ton about CRCs and enjoyed the journey too.

I also love the site as a whole -- it looks to be hand written html (proofs too!) without even so much as a css stylesheet.

[palletjack]

There's a tool for this called reveng. https://reveng.sourceforge.io/

[schemescape]

The author dismisses finding the actual CRC routine pretty quickly, but debugging the app to find the relevant routine would be my first approach.