|
Title: Siemens/Continental tricore Checksum EEprom Post by: Auto-elect on January 16, 2022, 08:54:21 AM Hello,
want to know the type of EEprom CRC algo used in Siemens/Continental TC176X CPU tricores. I didn't find too much info, but what I noticed while using the RET software (I analyzed dozens of dumps): * there are not many blocks that have a valid CRC (3 at most according to the dumps I tested). * the size of the data covered by the crc is quite large 0x1600 bytes. considering the size, I think the algo must be a CRC 32, but they only take half of it (16 bits). It remains to determine the initial value, and the exact size of the data. Here is an example (file attached): Sid 305. 00001800 70 39 00 00 01 00 3B 4D 6F AF F3 AD E4 1E B7 32 00001900 .................................................................... . .................................................................... . .................................................................... . .................................................................... . .................................................................... . ....... ............................................................. 00002DF0 00 00 00 00 00 00 00 00 31 0F 82 B3 8F C6 FF FF In this example there is only one block with valid CRC Block ID 00003970 Size : 0x1600 bytes : 0x1800---0x02DFF CRC : 82 B3 I tried several CRC 32 and CRC16 algorithms,but without success, If anyone has any info please share. Title: Re: Siemens/Continental tricore Checksum EEprom Post by: terminator on January 19, 2022, 12:15:19 PM I believe it's not Siemens algo but Infineon and depends on CPU model.
Title: Re: Siemens/Continental tricore Checksum EEprom Post by: Wommesz on January 20, 2022, 11:51:29 AM Maybe this is the one?
https://github.com/bri3d/VW_Flash/blob/9d7a0f3bfed48b2c88e2d5cfa4b714e9560a46b7/lib/checksum.py#L46 Title: Re: Siemens/Continental tricore Checksum EEprom Post by: d3irb on January 20, 2022, 12:31:19 PM Maybe this is the one? https://github.com/bri3d/VW_Flash/blob/9d7a0f3bfed48b2c88e2d5cfa4b714e9560a46b7/lib/checksum.py#L46 Probably not, this might be a starting place but this is for flash data (program memory) block security headers. Usually they do something completely different for E2P / DFlash. In Simos18 it's a really overcomplicated turducken of stacked CRC16s, but this older stuff looks different. |