Reverse Engineering Cyclic Redundancy Codes | Hacker News Reader

Reverse Engineering Cyclic Redundancy Codes

hackaday.com

38 pointssohkamyung10 comments

So maybe someone else can help me understand, but I do not know why you would want to "spoof" CRCs. CRCs are not a cryptographic hash algorithm, and CRCS are meant to correct errors in transmission. If I were to MITM, I would simply recalculate the CRC after changing the transmission.

>I would simply recalculate the CRC

This is how you figure out which CRC to use in order to "simply" recalculate it.

Usually you are doing this because you want to interface with a closed-source device where only the messages are known, or if you want to check a closed-source device for vulnerabilities.

I agree with you on that, however the article says "The CRC RevEng code can also manipulate a message to generate a desired CRC value."

That is what I am confused on. Why would you need a desired CRC value?

Maybe there are CRC values that signal hashes, and are used as such. So instead of looking at a message, it'll look at the CRC instead. This gives you the ability to not have to know the full message, but leverage this with part/none of it.

Another reason might be for QA testing, or for fuzzing purposes.

You don't always know the implementation details, but this type of control allows one to get more understanding of those details, by seeing how the software under test reacts. This stuff is not wildly uncommon in low-grade IoT devices, or high-end devices with a low level of security maturity.

The article in this post talks about figuring out the parameters for an unknown CRC, based on sample data.

Somewhat relatedly, I have an article talking about modifying a file to generate a particular CRC, assuming that the parameters are known. https://www.nayuki.io/page/forcing-a-files-crc-to-any-value

Very cool indeed, but I wish the blog post would go more in detail about how the program works instead of just that it exists.

The CRC RevEng readme file has some interesting references cited, including "Reversing CRC – Theory and Practice"

http://reveng.sourceforge.net/readme.htm

PDF of the paper is here: https://sar.informatik.hu-berlin.de/research/publications/SA...

A CRC is the remainder or residue after division (by the CRC generating polynomial).

So you are given a dividend (the message) and a remainder (the CRC). What is the divisor (the CRC polynomial)? From one example dividend/remainder you can come up with several possible divisors, but you have already greatly narrowed the field. With more examples you can eliminate the false positives.

That's what it says in the article, I just think the interesting part is HOW the number of possibilities are narrowed down efficiently.

Pretty interesting! The tool they use is CRC RevEng - apparently one of the things it does it try known CRCs, and they give this unique catalog of known CRCs:

http://reveng.sourceforge.net/crc-catalogue/

Reply on news.ycombinator.com