Pages: [1]
Author Topic: Siemens/Continental tricore Checksum EEprom  (Read 3509 times)
Auto-elect
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 3


« on: January 16, 2022, 08:54:21 AM »

Hello,
want to know the type of EEprom  CRC algo used in Siemens/Continental TC176X CPU tricores.
 I didn't find too much info, but what I noticed while using the RET software (I analyzed dozens of dumps):

 * there are not many blocks that have a valid CRC (3 at most according to the dumps I tested).
 * the size of the data covered by the crc is quite large 0x1600 bytes.
considering the size, I think the algo must be a CRC 32, but they only take half of it (16 bits).

 It remains to determine the initial value, and the exact size of the data.


 Here is an example (file attached): Sid 305.

00001800      70 39 00 00 01 00 3B 4D    6F AF  F3 AD E4 1E B7 32   
00001900      ....................................................................
.                    ....................................................................
.                     ....................................................................
.                    ....................................................................
.                    ....................................................................
.                    ....... .............................................................
00002DF0       00 00 00 00 00 00 00 00   31 0F 82 B3 8F C6 FF FF 

In this example there is only one block with valid CRC

Block ID 00003970
Size : 0x1600 bytes  : 0x1800---0x02DFF
CRC : 82 B3

I tried several CRC 32 and CRC16 algorithms,but without success,
 If anyone has any info please share.

« Last Edit: January 16, 2022, 08:58:00 AM by Auto-elect » Logged
terminator
Sr. Member
****

Karma: +15/-4
Offline Offline

Posts: 425


« Reply #1 on: January 19, 2022, 12:15:19 PM »

I believe it's not Siemens algo but Infineon and depends on CPU model.
Logged
Wommesz
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 12


« Reply #2 on: January 20, 2022, 11:51:29 AM »

Maybe this is the one?
https://github.com/bri3d/VW_Flash/blob/9d7a0f3bfed48b2c88e2d5cfa4b714e9560a46b7/lib/checksum.py#L46
Logged
d3irb
Full Member
***

Karma: +134/-1
Offline Offline

Posts: 195


« Reply #3 on: January 20, 2022, 12:31:19 PM »


Probably not, this might be a starting place but this is for flash data (program memory) block security headers. Usually they do something completely different for E2P / DFlash. In Simos18 it's a really overcomplicated turducken of stacked CRC16s, but this older stuff looks different.
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.015 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)