vickyg2003 wrote:I'm interested in the logic (plain english) as to what you did in your program to crack this. I don't expect to ever be able to do this on my own.
Here is the source code for my program:
http://www.hifi-remote.com/forums/dload ... e_id=14701
Basically, my approach was to load all the data into the program and then try to find a formula where the generated data matches one of the checksum bits. Obviously, if you only look at 1 entry there are infinite possibilities but when you look at all the data, there are only a few possibilities. The way to imagine what I did is to look at the Binary tab in my MCE.xls spreadsheet and view the checksum bits, one column at a time, so the more rows of data you have, it narrows the possible formula options. Then, look at the signal data.
First, assume that there is only 1 bit used for the checksum, so basically see if any of the vertical columns of data bits matches any of the vertical columns of checksum bits.
Next, assume that 2 bits are used, so try all the possible 2-bit combinations to see if any of them generate results that will match any of the checksum bit columns.
Next try 3 bits, then 4, then 5, etc, all the way up to 16 bits.
To do this, I created a file of all the data bits and their corresponding checksum, then I loaded this into a table in the program. Then I created a second table for the checksums where each column is a row.
I created 16 indexes and set them all to zero for starters. Then I looped through values 1 thru 16 for the #16 index. For each loop pass, if the index is not zero, I use the value in the index to grab a data bit and add it to a running total. At the end, I divide the total by 2 and grab the remainder (this is how I "XOR" the bits in COBOL).
Next, I increment the #15 (ie, going from 0 to 1) and then loop #16 from value 2 (ie, #15 plus 1) thru 16. Then I increment #15 again, and loop #16 from 3 thru 16. Etc, etc until #15 exceeds value 16, then I increment #14 by 1 and set #15 to 2 (ie, #14 plus 1), and loop #16 from 3 thru 16. And so it goes on.
At the lowest level of the loop, I calculate a proposed checksum value for every row of data and then compare this to the 5 checksum values (vertical columns) that I have and if there's a match, I report it.
When I was just using the mouse data, I got several possibilities for each checksum bit, but when I introduced the keyboard data too, the number of possibilities for each drastically reduced.
vickyg2003 wrote:I never would have thought to reuse bits....
What do you mean by "reuse bits"? Are you referring to the fact that a data bit might be used in more than one checksum bit? If so, that is how it usually is. I was heavily involved in cracking the checksum for the 4DTV signals, way back when, and creating an executor that would generate the checksum, and in that case, bits are certainly reused.
vickyg2003 wrote:Anyway I tried these values for UP with the calculated checksum
1111000 0000000 00
1111010 0000000 00
1111011 0000000 00
1111001 0000000 00
They have been arranged in order of how far they will travel in that 1 second interval
If this were you, what would you do next?
I'm not clear on what you're trying to do here, could you elaborate?
