Any progress on the wire protocol / checksum?

[itpeters]

Hi,

I stumbled across your work while trying to understand the Navien RS485 wire protocol. I have an ESP32 with TTL-RS485 converter connected to my Navien, and I've been watching some of the packets going back and forth.

From reading your work, it sounds like you believe the checksum to be CRC-8 of the entire packet (from the 0xF7 frame start through the end of the data), with the initial value dictated by the byte at offset 0x02 (either 0x62 or 0x4B) and (I'm assuming) polynomial 0x07.

I'm able to reproduce the first example you list:

>>> hex(crc.crc_poly(bytes.fromhex("F7 05 50 50 90 22 42 00 00 25 49 5C 5B 53 00 00 00 00 00 00 88 C2 00 20 02 00 00 00 21 03 99 08 00 02 00 00 00 00 00 00"), 8, poly=0x07, crc=0x62))
'0x87'

I'm not having the same success with your second example:

>>> hex(crc.crc_poly(bytes.fromhex("F7 05 50 50 90 22 42 00 00 25 14 5F 4C 4C 00 00 00 00 00 00 88 C2 00 20 02 00 00 00 21 03 9A 08 00 02 00 00 00 00 00 00"), 8, poly=0x07, crc=0x62))
'0xf3'

Your work showed this with a checksum of 0xD8.

I'm also not having any luck with the packets that I captured coming from my water heater. For example, I grabbed F7 05 50 50 90 22 42 00 08 25 47 62 62 3E 00 00 00 00 00 00 08 9D 00 20 02 02 00 00 07 00 28 00 00 02 00 00 00 00 00 00 8A but when I try to recreate the checksum I get something different:

>>> hex(crc.crc_poly(bytes.fromhex("F7 05 50 50 90 22 42 00 08 25 47 62 62 3E 00 00 00 00 00 00 08 9D 00 20 02 02 00 00 07 00 28 00 00 02 00 00 00 00 00 00"), 8, poly=0x07, crc=0x62))
'0x4d'

I was just curious if you see anything I'm doing wrong or misunderstanding, or if you have any more insights since you last put this up.

Thanks!

[htumanyan]

Hello!
First of all, thank you so much for the attention and efforts! More of us try, sooner we get it reversed. I should admit I was a bit distracted for a few months, not making much progress. However, here is the reverse engineered CRC calculation code in case if it is helpful - this was on my list to document but never got a chance to - would very much appreciate any help.

undefined likely_crc_calc(byte *buffer,uint len,ushort seed)

{
ushort uVar1;
undefined *puVar2;
byte *pbVar3;

puVar2 = PTR_DAT_08031d7c;
if ((int)len < 2) {
*(undefined2 *)PTR_DAT_08031d7c = 0;
}
else {
*(undefined2 *)PTR_DAT_08031d7c = 0xff;
*(byte **)(puVar2 + 4) = buffer;
while (pbVar3 = *(byte **)(puVar2 + 4), pbVar3 < buffer + ((len & 0xffff) - 1)) {
uVar1 = *(short *)puVar2 << 1;
*(ushort *)puVar2 = uVar1;
if (0xff < uVar1) {
*(ushort *)puVar2 = uVar1 & 0xff ^ seed;
}
*(byte **)(puVar2 + 8) = pbVar3;
*(ushort *)puVar2 = *(ushort *)puVar2 ^ (ushort)*pbVar3;
(byte **)(puVar2 + 4) = pbVar3 + 1;
}
}
return (char)(undefined2 *)puVar2;
}

[htumanyan]

Hello, I finally got a chance to spend a few hours on this and figured out the checksum algorithm in case if you are still interested. Take a look at newly checked in /src/checksum.cpp and let me know if it makes sense (or not ;) )