Find how a checksum is computed

I have some file which are in cleartext except for the checksum that is appended to the end.
As I have to modify the content of these files I must learn how the checksum  is calculated.
But though it is a simple algorithm (Even if the computer is slowed down  to 1/1000 of it's normal speed it is calculated instantly) I didn't manage to find it.
I can generate files that only differ on 2 or 3 bytes (plus the checksum).
Is there any tool to do this kind of work? Or a way to proceed?
YonelAsked:
Who is Participating?
 
jhanceConnect With a Mentor Commented:
Thanks.

Answer.
0
 
jhanceCommented:
In general a checksum is some calculation based on the contents of a data file or data stream to aid in error detection.  Checksums are not all that good at detecting errors and other means, like CRCs are much better.

Basically, it goes like this.

Say I have a file with the following in it:

ABCD

to compute an 8-bit checksum, we add the numeric values of the characters (shown in hexadecimal):

0x41 + 0x42 + 0x43 + 0x44 = 0x010A (or 266 indecimal).  Since we want an 8-bit only checksum, we just lop off the upper 8 bits and that leaves us with 0x0A.  So an 8-bit checksum for ABCD is 0x0A (or 10 in decimal).

The problem is that there are as many ways of computing a checksum as you can imagine.  You can do 8, 16, 24, 32, etc., bits of checksum.  You can truncate the upper bits or you can fold them back in.  It just depends.  A bit of detective work on your data file and some calculations will probably yield its secrets.
0
 
YonelAuthor Commented:
Adjusted points to 80
0
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

 
YonelAuthor Commented:
I'm sorry but, though I used the word checksum, that's not a sum. If it was so byte1 +byte2 +... I would have something like checksumbyte - byte1 - byte2- ... = 0. Which is not the case.
In fact the checksum is 2 byte-long and seems to be computed using XOR with a mask that varies.(That's what I didn't manage to unserstand)
Could this be a CRC algorithm? Where can I find a description of it so that I can test whether it's the one that's used in my files.
0
 
ozoCommented:
It could be a 2 byte-long sum, but if it looks like an xor, it's prpbably a CRC.
Does an xor of a given bit in the input always xor the same bits in the output?
the mask that varies would probably look like it shifts whenever the input but shifts, and when a 1 bit is shifted out, a certain mask is xord back in.
0
 
jhanceCommented:
I mentioned that already.  Based on what you've said there is no way of telling.  

I'll point out that you asked what a checksum is and I've told you that.  I've also told you how one can be calculated.

You have given no details about your particular checksum.  
0
 
dbruntonCommented:
To test for a simple additive checksum create two small files with contents as shown.

file 1

AB


file 2

BA


If your program gives the same number on these files then it is probably a checksum.  Anything else could be a strange checksum or a CRC.  CRCs can vary, there are  numerous ways of doing the calculation.  For sample CRC code and applications go to simtel and do a search.
0
 
YonelAuthor Commented:
jhance, sorry but I can't take such an answer that says "it had already been said".

What describes ozo is truly what I get. So, as it seems to be a well known algorithm that procuces it, I'll take the answer telling me it's NAME(CRC?). (and optionally how it works or where I can find the information.)
0
 
PC_User321Commented:
0
 
PC_User321Commented:
There are many dfferent CRCs in use, and you can also invent your own.

If yours is a standard one then it could be CRC-16 or X25 standard.

If the reference above does not help, then you should, as another question, post several example of files with correct check bytes and invite the experts to work out the algorithm.  Or better still, give us the program that creates the checksummed file so that we can create our own examples.

0
 
PC_User321Commented:
http://www.efg2.com/lab/Mathematics/CRC.htm

This program is an very easy way to check CRC-16.  You download the program and run it.  The source code is available, too.
0
 
PC_User321Commented:
I should have said _generate_ CRC
0
 
YonelAuthor Commented:
Ok. My program generates CRC-16.
I've understood how it works and thank everybody.

I would like jhance to post an answer so that I can give him the points as he thought of CRCs before the others.
0
All Courses

From novice to tech pro — start learning today.