Hi Eric, I think I wasted your time... The Checksum in the EXE header is 3 bytes (high order byte always appears to be 0x00). So Im wondering if the algorithm is a truncated CRC32 (or variant), or a CRC-24 (or variant).
> I looked at the code. Gak. LOL... I was hoping you could spot something in the table that set off a flag. > Apropos your other message, this algorithm computes a 32-bit value. Yes - I think I read elsewhere that this is ZModem and the like, but not my Algorithm of interest... Sorry Again! Jeff On 6/21/07, Eric Hughes <[EMAIL PROTECTED]> wrote: > At 07:58 PM 6/20/2007, Jeffrey Walton wrote: > >I was hoping you could shed some light on the particular CRC in use by > >Win32 executables. I found the following reference, but my eye is not > >trained to spot CRC32 flavors based on tables... > > I looked at the code. Gak. > > Disclaimer 1: It's not clear on brief inspection that the computed value is > actually a CRC. It will only be a CRC if the precomputed table is > correct. That table is 64 rows of 4 entries of 32 bits each. The quickest > check, (a[0] == 0) and (a[1] xor a[2] == a[3]), passes. > > I now assume in the foregoing that it computes a CRC. In hardware, CRC's > are ordinarily computed a bit at a time, with a fixed time per bit > (typically one clock cycle). This algorithm is computing them at a rate of > octet per iteration. It would be possible to compute the polynomial from > the table. Because of linearity, only 7 values should be necessary > (a[2^k], k \in 1..7). > > I could work out the modulus polynomial, but it would take me a few hours, > I'm guessing. > > Apropos your other message, this algorithm computes a 32-bit value. > > Eric --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the "Crypto++ Users" Google Group. To unsubscribe, send an email to [EMAIL PROTECTED] More information about Crypto++ and this group is available at http://www.cryptopp.com. -~----------~----~----~----~------~----~------~--~---
