Trouble in Checksum calculation

[Samuel_Dinz]

Hi all,

I am working with a vehicle and performing reverse engineering. I referred to few dbc file where I found the first byte as crc and not sure how the value is calculated in CAN. I tried few online CRC calculators but nothing matches with the byte I obtained from vehicle CAN channels.

CAN bytes read from vehicle is as below: 

64  60  0A  00 06 00 04 80

00  61  0A  00 06 00 04 80

AC 62  0A  00 06 00 04 80

C8  63 0A  00 06 00 04 80
DB 64  0A  00 06 00 04 80

I could see 2nd byte gets incremented so that is an counter ,as per my understanding first Byte might be a checksum Not sure how to obtain this value as I tried multiple CRC calculation none matches the first Byte. Any idea how to resolve them??

[Hooovahh]

The OEM can choose to have any calculation they'd like for this.  The most common ones are the SAE J1850 but as you've already discovered this isn't the case with this one.  It is possible this is the Autosar Profile 1A E2E.  I talk a bit about the calculation for this in a blog post here.  In that configuration the counter goes up from 0 to 14, not 0 to 15 like you'd expect for 4 bits.  So if you go from 6E to 60 then you might be using that.  If that is the case then you need to understand that the CRC actually includes the CAN Arbitration ID, or the ID of the frame in the calculation.  Again your example doesn't show the ID so I can't be sure if this is being used or not.

If it isn't either of these it could be all kinds of custom things going on.

[Samuel_Dinz]

Hello Hooovahh, 

Really appreciate your quick response!!!


I captured the below data from vehicle 

Line 15026: 12:37:35:9615 Rx 1 0x130 s 8  E6 60 6A 00 06 00 04 80
Line 15054: 12:37:35:9813 Rx 1 0x130 s 8  82 61 6A 00 06 00 04 80
Line 15081: 12:37:36:0015 Rx 1 0x130 s 8  2E 62 6A 00 06 00 04 80
Line 15107: 12:37:36:0215 Rx 1 0x130 s 8  4A 63 6A 00 06 00 04 80
Line 15134: 12:37:36:0414 Rx 1 0x130 s 8  59 64 6A 00 06 00 04 80
Line 15162: 12:37:36:0615 Rx 1 0x130 s 8  F1 65 66 00 06 00 04 80
Line 15191: 12:37:36:0814 Rx 1 0x130 s 8  FC 66 62 00 06 00 04 80
Line 15214: 12:37:36:1014 Rx 1 0x130 s 8  E1 67 5F 00 06 00 04 80
Line 15239: 12:37:36:1214 Rx 1 0x130 s 8  90 68 5C 00 06 00 04 80
Line 15264: 12:37:36:1413 Rx 1 0x130 s 8  55 69 58 00 06 00 04 80
Line 15296: 12:37:36:1615 Rx 1 0x130 s 8  C1 6A 55 00 06 00 04 80
Line 15324: 12:37:36:1813 Rx 1 0x130 s 8  C3 6B 53 00 06 00 04 80
Line 15351: 12:37:36:2014 Rx 1 0x130 s 8  C6 6C 4F 00 06 00 04 80
Line 15376: 12:37:36:2213 Rx 1 0x130 s 8  65 6D 4D 00 06 00 04 80
Line 15404: 12:37:36:2414 Rx 1 0x130 s 8  68 6E 49 00 06 00 04 80
Line 15437: 12:37:36:2614 Rx 1 0x130 s 8  07 6F 47 00 06 00 04 80
Line 15467: 12:37:36:2815 Rx 1 0x130 s 8  76 60 44 00 06 00 04 80
Line 15490: 12:37:36:3013 Rx 1 0x130 s 8  74 61 42 00 06 00 04 80
Line 15517: 12:37:36:3213 Rx 1 0x130 s 8  B8 62 3F 00 06 00 04 80
Line 15545: 12:37:36:3414 Rx 1 0x130 s 8  28 63 3E 00 06 00 04 80
Line 15575: 12:37:36:3614 Rx 1 0x130 s 8  6E 64 3B 00 06 00 04 80
Line 15607: 12:37:36:3813 Rx 1 0x130 s 8  CD 65 39 00 06 00 04 80
Line 15634: 12:37:36:4016 Rx 1 0x130 s 8  6A 66 37 00 06 00 04 80
Line 15659: 12:37:36:4215 Rx 1 0x130 s 8  C9 67 35 00 06 00 04 80
Line 15686: 12:37:36:4415 Rx 1 0x130 s 8  7F 68 34 00 06 00 04 80
Line 15715: 12:37:36:4616 Rx 1 0x130 s 8  7D 69 32 00 06 00 04 80
Line 15744: 12:37:36:4814 Rx 1 0x130 s 8  16 6A 30 00 06 00 04 80
Line 15768: 12:37:36:5014 Rx 1 0x130 s 8   A3 6B 2E 00 06 00 04 80

In the above log we have ID =0X130 and counter has incremented from 60- 6F (0-15) ,so does Autosar E2E can be applied here? 

[Hooovahh]

No sorry this doesn't appear to be the Autosar method I linked to earlier. I also tried different summing and 2's compliments, adding or removing the ID, and different SAE standards that I've seen. I do hope you can figure out what this is so others can be on the lookout for whatever calculation or method it is using.

[Samuel_Dinz]

Hello Hooovahh,

---

Was able to Crack it ,missing part was the Data id which suppose to be added as the last  byte ( excluding crc byte we will have 6 byte data + 1 byte counter + 1 byte data ID) after few iteration I found out it is data id =0x31 in my case .it's working fine now. Used Polynomial 0x2f as per autosar e2e document.

[Hooovahh]

Very interesting, thank you for figuring this out.  If you didn't know there is some custom code for the XNet hardware that is undocumented that can help with this.  I talk about it in Part 10, and more in Part 17. Basically it is a way for the XNet hardware to perform the calculation and send out the data it wants without having to calculate the CRC for each frame in LabVIEW.

If you are using any XNet hardware I can help in adding the functionality to allow a byte to be added to the start or the end of the CRC calculation to support this.

[Hooovahh]

After reading through the documentation better I was able to update my examples and blog post to mention the Profile 1 and Profile 2 differences and build it into the code.  Version 5 as mentioned in Part 17 of the blog post has been updated to support these changes.  Thanks again for the help and hopefully the community will find this information helpful.