MP3Car.com - View Single Post - Renault "Tuner List" Head Unit/CD changer hacking

Ale · 02-12-2006, 06:01 AM

Quote: Originally Posted by Putput

When the frame starts with 3D it calculates the FCS perfectly, only when it starts with 3F it goes wrong. When I change the 3F to 3D the result is ok again, so maybe the 3F could be a glitch?

I have load the data in excel and with a small function in VBA i calculated the CRC, and can confirm that the frame that start with 3F results in wrong CRC, changing it with 3D it's OK.
the function accept a range of cell like =MyXor(B3:P3), if you include the crc in the range, when the result is zero the received data is correct (the last xor operation is between the calculated crc and the received one)
Here is the function:

Code:

Function MyXor(MyInput1 As Range)
crc = 0

For I = 1 To MyInput1.Cells.Count
    crc = Val("&h" & MyInput1.Cells(1, I)) Xor crc
Next I
MyXor = Hex$(crc)
End Function

So the byte in the frame:
0 : 3Dh, start frame
1 : nn a sequence number, cycling from 00h,01h...FFh,00h,01h

I have found error (3F) also in the sequence number and changing it with the next expect value, fix the CRC error.

I think that there is a software(buffer overrun) or hardware(threshold of the receiver) bug...

02-12-2006, 06:01 AM	#50
Ale Newbie Join Date: Feb 2006 Location: Italy Posts: 42	Quote: Originally Posted by Putput When the frame starts with 3D it calculates the FCS perfectly, only when it starts with 3F it goes wrong. When I change the 3F to 3D the result is ok again, so maybe the 3F could be a glitch? I have load the data in excel and with a small function in VBA i calculated the CRC, and can confirm that the frame that start with 3F results in wrong CRC, changing it with 3D it's OK. the function accept a range of cell like =MyXor(B3:P3), if you include the crc in the range, when the result is zero the received data is correct (the last xor operation is between the calculated crc and the received one) Here is the function: Code: Function MyXor(MyInput1 As Range) crc = 0 For I = 1 To MyInput1.Cells.Count crc = Val("&h" & MyInput1.Cells(1, I)) Xor crc Next I MyXor = Hex$(crc) End Function So the byte in the frame: 0 : 3Dh, start frame 1 : nn a sequence number, cycling from 00h,01h...FFh,00h,01h I have found error (3F) also in the sequence number and changing it with the next expect value, fix the CRC error. I think that there is a software(buffer overrun) or hardware(threshold of the receiver) bug...