Close

CRC-8 MAXIM

A project log for ES-200 Electric Scooter Unlocker

Our streets are becoming litter with high technology joy. These forgotten scooter must be reverse engineer and given the love they deserve.

mr-spriggsMr. Spriggs 12/13/2019 at 18:350 Comments

Today John Lee sent me a nice link to a scooter hacking forum. The short of it is I got a nice hint to how the data structure is built. The last  byte of the data packet is CRC-8 Maxim. So to alter any packet to test other configs on the scooter you have to calculate the CRC byte for the end.

Here are some test examples I made from the know packets that I have.

Polynomial Calculator 

https://crccalc.com

Data input: A612021014

Results

Algorithm

Result

Check

Poly

Init

RefIn

RefOut

XorOut

CRC-8/MAXIM

0xCF

0xA1

0x31

0x00

True

True

0x00

Data input: A612021514

Results:

Algorithm

Result

Check

Poly

Init

RefIn

RefOut

XorOut

CRC-8/MAXIM

0x30

0xA1

0x31

0x00

True

True

0x00

Data input: A612021114

Results:

Algorithm

Result

Check

Poly

Init

RefIn

RefOut

XorOut

CRC-8/MAXIM

0x0B

0xA1

0x31

0x00

True

True

0x00

So I can now build a CRC calculation function and create new packets to test there different Hex numbers and there functions.

Discussions