From d3293afdab85bf3e3fab82a38d9694748dd7de37 Mon Sep 17 00:00:00 2001 From: Raphael Coeffic Date: Fri, 23 Oct 2026 12:02:20 +0200 Subject: [PATCH] HoTT, XN297 emu: compute the hop and CRC xorout tables (-1.2 KB) (#1199) * HoTT: compute the hop table from the hop value (-1 KB) The 16 hop tables are generated from the 16 bit value sent in packet[0..1]: the C library rand() LCG (low 16 bits: x = x * 0x4E6D + 0x3039) seeded with it drives forward Fisher-Yates shuffles, first of the order of the 5 bands of 15 channels, then of the channels of each band, hop i being in the band at position i%5. This gives back the 16 tables bit for bit, and for any seed a 75 channel permutation with the same band structure. * XN297 emu: compute the CRC xorout instead of the 4 tables The XN297 CRC is CRC-16/CCITT with init 0xFFFF and xorout 0xFFFF over the unscrambled address, pcf and payload, sent scrambled. The emulation computes it from 0xB5D2 over the bits as sent, so the xorout for a CRC over n bits is CRC(init 0xFFFF^0xB5D2) of n scramble (or zero) bits, xor 0xFFFF, xor the 16 scramble bits at the CRC. The scramble bits come from the LFSR behind xn297_scramble[] (1110001, then s[i] = s[i-7] ^ s[i-3]), which also covers the last enhanced entries, past the end of that table. It is the generator Goebish gave for the scramble sequence in a comment on https://mcumix.blogspot.com/2016/07/reverse-engineering-24ghz-rf-chip-xn297.html (seed 0x71, feedback bit 6 ^ bit 2, MSB first). All the entries of the 4 tables are given back but two: entry 0 (3 byte address, no payload) was a 0 placeholder, and scrambled entry 1 (3 byte address, 1 byte payload) was 0x3448 where the formula gives 0xE348. --- Multiprotocol/HOTT_cc2500.ino | 51 +++++++++++------- Multiprotocol/XN297Dump_nrf24l01.ino | 12 ++--- Multiprotocol/XN297_EMU.ino | 80 +++++++++++----------------- Multiprotocol/iface_xn297.h | 1 + 4 files changed, 66 insertions(+), 78 deletions(-) diff --git a/Multiprotocol/HOTT_cc2500.ino b/Multiprotocol/HOTT_cc2500.ino index d6c9be3c..4dd029c0 100644 --- a/Multiprotocol/HOTT_cc2500.ino +++ b/Multiprotocol/HOTT_cc2500.ino @@ -117,24 +117,36 @@ static void __attribute__((unused)) HOTT_tune_freq() } } -const uint8_t PROGMEM HOTT_hop[][HOTT_NUM_RF_CHANNELS]= - { { 48, 37, 16, 62, 9, 50, 42, 22, 68, 0, 55, 35, 21, 74, 1, 56, 31, 20, 70, 11, 45, 32, 24, 71, 8, 54, 38, 26, 61, 13, 53, 30, 15, 65, 7, 52, 34, 28, 60, 3, 47, 39, 18, 69, 2, 49, 44, 23, 72, 5, 51, 43, 19, 64, 12, 46, 33, 17, 67, 6, 58, 36, 29, 73, 14, 57, 41, 25, 63, 4, 59, 40, 27, 66, 10 }, - { 50, 23, 5, 34, 67, 53, 22, 12, 39, 62, 51, 21, 10, 33, 63, 59, 16, 1, 43, 66, 49, 19, 8, 30, 71, 47, 24, 2, 35, 68, 45, 25, 14, 41, 74, 55, 18, 4, 32, 61, 54, 17, 11, 31, 72, 52, 28, 6, 38, 65, 46, 15, 9, 40, 60, 48, 26, 3, 37, 70, 58, 29, 0, 36, 64, 56, 20, 7, 42, 69, 57, 27, 13, 44, 73 }, - { 73, 51, 39, 18, 9, 64, 56, 34, 16, 12, 66, 58, 36, 25, 11, 61, 47, 40, 15, 8, 71, 50, 43, 20, 6, 62, 54, 42, 19, 3, 63, 46, 44, 29, 14, 72, 49, 33, 22, 5, 69, 57, 30, 21, 10, 70, 45, 35, 26, 7, 65, 59, 31, 28, 1, 67, 48, 32, 24, 0, 60, 55, 41, 17, 2, 74, 52, 38, 27, 4, 68, 53, 37, 23, 13 }, - { 52, 60, 40, 21, 14, 50, 72, 41, 23, 13, 59, 61, 39, 16, 6, 58, 66, 33, 17, 5, 55, 64, 43, 20, 12, 54, 74, 35, 29, 3, 46, 63, 37, 22, 10, 48, 65, 31, 27, 9, 49, 73, 38, 24, 11, 56, 70, 32, 15, 1, 51, 71, 44, 18, 8, 45, 67, 36, 25, 7, 57, 62, 34, 28, 2, 53, 69, 42, 19, 4, 47, 68, 30, 26, 0 }, - { 50, 16, 34, 6, 71, 51, 24, 40, 7, 68, 57, 27, 33, 14, 70, 55, 26, 30, 5, 74, 47, 28, 44, 11, 67, 49, 15, 32, 9, 61, 52, 22, 37, 13, 66, 59, 18, 42, 3, 62, 46, 29, 31, 12, 60, 48, 19, 38, 1, 72, 58, 17, 36, 4, 64, 53, 21, 39, 0, 63, 56, 20, 41, 2, 65, 45, 25, 35, 10, 69, 54, 23, 43, 8, 73 }, - { 55, 38, 12, 62, 23, 52, 44, 3, 66, 18, 54, 36, 10, 74, 16, 56, 42, 9, 70, 17, 58, 33, 5, 69, 20, 50, 40, 1, 63, 24, 53, 37, 13, 65, 15, 48, 34, 4, 61, 22, 57, 31, 6, 64, 26, 46, 35, 11, 72, 21, 47, 30, 7, 68, 29, 45, 32, 8, 60, 19, 49, 43, 2, 67, 27, 51, 39, 0, 71, 28, 59, 41, 14, 73, 25 }, - { 70, 32, 18, 10, 58, 69, 38, 22, 2, 54, 67, 36, 19, 12, 57, 62, 34, 20, 14, 52, 63, 41, 15, 3, 51, 73, 42, 28, 6, 48, 60, 43, 29, 5, 45, 64, 31, 17, 4, 56, 65, 35, 26, 13, 53, 61, 37, 23, 1, 49, 68, 40, 16, 9, 47, 71, 39, 25, 7, 50, 66, 33, 24, 8, 59, 72, 44, 27, 11, 46, 74, 30, 21, 0, 55 }, - { 6, 45, 71, 27, 44, 10, 46, 74, 22, 32, 0, 55, 69, 21, 33, 4, 50, 66, 18, 38, 7, 57, 62, 19, 36, 1, 48, 70, 20, 40, 8, 47, 68, 15, 43, 2, 58, 61, 26, 42, 3, 56, 72, 23, 34, 14, 54, 67, 16, 37, 5, 59, 64, 24, 30, 12, 52, 65, 25, 39, 13, 49, 73, 17, 31, 9, 53, 60, 28, 35, 11, 51, 63, 29, 41 }, - { 31, 65, 50, 20, 13, 37, 66, 45, 23, 5, 32, 69, 54, 19, 7, 39, 74, 52, 27, 1, 42, 64, 53, 22, 4, 43, 70, 58, 16, 3, 40, 71, 57, 17, 0, 35, 63, 56, 18, 9, 44, 72, 51, 21, 6, 33, 67, 46, 25, 11, 30, 73, 55, 15, 8, 36, 62, 48, 24, 10, 41, 60, 49, 29, 14, 34, 61, 47, 26, 2, 38, 68, 59, 28, 12 }, - { 67, 22, 49, 36, 13, 64, 28, 57, 37, 6, 65, 29, 46, 39, 3, 70, 26, 45, 35, 1, 62, 24, 58, 34, 10, 68, 19, 53, 33, 4, 66, 21, 52, 31, 7, 74, 18, 47, 32, 5, 61, 16, 51, 38, 8, 72, 23, 55, 30, 12, 73, 17, 59, 44, 0, 60, 15, 50, 43, 14, 63, 27, 48, 42, 11, 71, 20, 54, 41, 9, 69, 25, 56, 40, 2 }, - { 19, 38, 14, 66, 57, 18, 44, 7, 74, 48, 23, 30, 6, 71, 58, 26, 32, 5, 61, 46, 20, 34, 0, 68, 45, 24, 36, 1, 70, 50, 27, 33, 10, 63, 52, 16, 42, 9, 65, 51, 15, 41, 11, 64, 53, 22, 37, 3, 60, 56, 28, 35, 4, 67, 49, 17, 39, 13, 69, 54, 25, 43, 2, 73, 55, 21, 31, 8, 62, 47, 29, 40, 12, 72, 59 }, - { 4, 52, 64, 28, 44, 14, 46, 74, 16, 32, 11, 50, 68, 27, 36, 0, 47, 70, 26, 34, 13, 57, 61, 18, 38, 6, 56, 62, 19, 40, 5, 58, 67, 17, 31, 12, 54, 63, 22, 33, 3, 53, 72, 21, 41, 10, 48, 66, 15, 35, 7, 45, 60, 20, 37, 9, 51, 69, 25, 42, 2, 59, 71, 24, 39, 1, 55, 65, 23, 30, 8, 49, 73, 29, 43 }, - { 44, 66, 19, 1, 56, 35, 62, 20, 4, 54, 39, 70, 24, 5, 55, 31, 74, 26, 12, 58, 32, 60, 17, 10, 45, 37, 63, 22, 3, 50, 33, 64, 16, 7, 51, 34, 61, 21, 8, 48, 38, 68, 29, 0, 46, 36, 72, 28, 14, 49, 42, 69, 25, 6, 57, 43, 65, 18, 2, 52, 30, 71, 23, 13, 47, 41, 67, 15, 9, 53, 40, 73, 27, 11, 59 }, - { 12, 16, 36, 46, 69, 6, 20, 44, 58, 62, 11, 19, 34, 48, 71, 1, 18, 42, 50, 74, 3, 25, 31, 47, 65, 0, 24, 33, 45, 72, 2, 23, 35, 56, 64, 10, 22, 38, 49, 63, 7, 26, 37, 51, 70, 14, 21, 30, 53, 67, 5, 15, 40, 52, 66, 9, 17, 39, 55, 60, 13, 27, 41, 54, 73, 4, 28, 32, 57, 61, 8, 29, 43, 59, 68 }, - { 63, 42, 18, 2, 57, 71, 34, 22, 10, 48, 67, 36, 25, 4, 46, 60, 31, 28, 6, 47, 74, 37, 15, 0, 55, 65, 32, 24, 12, 56, 66, 40, 27, 14, 52, 62, 38, 19, 3, 50, 73, 33, 29, 11, 53, 61, 35, 16, 7, 58, 72, 41, 26, 5, 59, 69, 30, 20, 9, 51, 68, 44, 23, 1, 49, 70, 39, 17, 8, 54, 64, 43, 21, 13, 45 }, - { 52, 1, 71, 17, 36, 47, 7, 64, 26, 32, 53, 5, 60, 20, 42, 57, 2, 66, 18, 34, 56, 4, 63, 24, 35, 46, 13, 72, 22, 30, 48, 0, 67, 21, 39, 50, 3, 74, 16, 31, 59, 14, 61, 23, 37, 45, 6, 65, 19, 44, 51, 11, 62, 27, 41, 55, 9, 68, 15, 38, 58, 8, 70, 29, 40, 54, 10, 69, 28, 33, 49, 12, 73, 25, 43 } - }; +// Hop table from the value sent in packet[0..1]: the C library rand() (low 16 +// bits) seeded with it drives forward Fisher-Yates shuffles, first of the order +// of the 5 bands of 15 channels, then of the channels of each band. Hop i is in +// the band at position i%5 of that order. +static uint16_t __attribute__((unused)) HOTT_rand(uint16_t *seed) +{ + *seed = *seed * 0x4E6D + 0x3039; + return *seed; +} + +static void __attribute__((unused)) HOTT_hop_init(uint16_t seed) +{ + uint8_t order[5], tmp, j; + for(uint8_t i=0; i<5; i++) + order[i] = i; + for(uint8_t i=0; i<5; i++) + { + j = i + HOTT_rand(&seed) % (5-i); + tmp = order[i]; order[i] = order[j]; order[j] = tmp; + } + for(uint8_t i=0; i>8; - for(uint8_t i=0; i> 8) == packet[i + 1] && (crcxored & 0xff) == packet[i + 2]) { packet_length=i+1; @@ -112,7 +108,7 @@ static boolean __attribute__((unused)) XN297Dump_process_packet(void) scramble=false; return true; } - crcxored = crc ^ pgm_read_word(&xn297_crc_xorout_scrambled[i+1 - 3]); + crcxored = crc ^ XN297_crc_xorout(true, 8 * (i+1)); if( (crcxored >> 8) == packet[i + 1] && (crcxored & 0xff) == packet[i + 2]) { packet_length=i+1; @@ -135,7 +131,7 @@ static boolean __attribute__((unused)) XN297Dump_process_packet(void) crcxored=(packet[i+1]<<10)|(packet[i+2]<<2)|(packet[i+3]>>6) ; if(i>=3) { - if((crc ^ pgm_read_word(&xn297_crc_xorout_scrambled_enhanced[i - 3])) == crcxored) + if((crc ^ XN297_crc_xorout(true, 8 * i + 10)) == crcxored) { // Found a valid CRC for the enhanced payload mode packet_length=i; scramble=true; @@ -144,7 +140,7 @@ static boolean __attribute__((unused)) XN297Dump_process_packet(void) memcpy(packet_un,packet_sc,packet_length+2); // unscramble packet break; } - if((crc ^ pgm_read_word(&xn297_crc_xorout_enhanced[i - 3])) == crcxored) + if((crc ^ XN297_crc_xorout(false, 8 * i + 10)) == crcxored) { // Found a valid CRC for the enhanced payload mode packet_length=i; scramble=false; diff --git a/Multiprotocol/XN297_EMU.ino b/Multiprotocol/XN297_EMU.ino index bb0163c4..56a7085a 100644 --- a/Multiprotocol/XN297_EMU.ino +++ b/Multiprotocol/XN297_EMU.ino @@ -14,44 +14,30 @@ const uint8_t xn297_scramble[] = { 0x1B, 0x5D, 0x19, 0x10, 0x24, 0xD3, 0xDC, 0x3F, 0x8E, 0xC5, 0x2F, 0xAA, 0x16, 0xF3, 0x95 }; -// scrambled, standard mode crc xorout table -const uint16_t PROGMEM xn297_crc_xorout_scrambled[] = { - 0x0000, 0x3448, 0x9BA7, 0x8BBB, 0x85E1, 0x3E8C, - 0x451E, 0x18E6, 0x6B24, 0xE7AB, 0x3828, 0x814B, - 0xD461, 0xF494, 0x2503, 0x691D, 0xFE8B, 0x9BA7, - 0x8B17, 0x2920, 0x8B5F, 0x61B1, 0xD391, 0x7401, - 0x2138, 0x129F, 0xB3A0, 0x2988, 0x23CA, 0xC0CB, - 0x0C6C, 0xB329, 0xA0A1, 0x0A16, 0xA9D0 }; - -// unscrambled, standard mode crc xorout table -const uint16_t PROGMEM xn297_crc_xorout[] = { - 0x0000, 0x3D5F, 0xA6F1, 0x3A23, 0xAA16, 0x1CAF, - 0x62B2, 0xE0EB, 0x0821, 0xBE07, 0x5F1A, 0xAF15, - 0x4F0A, 0xAD24, 0x5E48, 0xED34, 0x068C, 0xF2C9, - 0x1852, 0xDF36, 0x129D, 0xB17C, 0xD5F5, 0x70D7, - 0xB798, 0x5133, 0x67DB, 0xD94E, 0x0A5B, 0xE445, - 0xE6A5, 0x26E7, 0xBDAB, 0xC379, 0x8E20 }; - -// scrambled enhanced mode crc xorout table -const uint16_t PROGMEM xn297_crc_xorout_scrambled_enhanced[] = { - 0x0000, 0x7EBF, 0x3ECE, 0x07A4, 0xCA52, 0x343B, - 0x53F8, 0x8CD0, 0x9EAC, 0xD0C0, 0x150D, 0x5186, - 0xD251, 0xA46F, 0x8435, 0xFA2E, 0x7EBD, 0x3C7D, - 0x94E0, 0x3D5F, 0xA685, 0x4E47, 0xF045, 0xB483, - 0x7A1F, 0xDEA2, 0x9642, 0xBF4B, 0x032F, 0x01D2, - 0xDC86, 0x92A5, 0x183A, 0xB760, 0xA953 }; - -// unscrambled enhanced mode crc xorout table -// unused so far -#ifdef XN297DUMP_NRF24L01_INO -const uint16_t xn297_crc_xorout_enhanced[] = { - 0x0000, 0x8BE6, 0xD8EC, 0xB87A, 0x42DC, 0xAA89, - 0x83AF, 0x10E4, 0xE83E, 0x5C29, 0xAC76, 0x1C69, - 0xA4B2, 0x5961, 0xB4D3, 0x2A50, 0xCB27, 0x5128, - 0x7CDB, 0x7A14, 0xD5D2, 0x57D7, 0xE31D, 0xCE42, - 0x648D, 0xBF2D, 0x653B, 0x190C, 0x9117, 0x9A97, - 0xABFC, 0xE68E, 0x0DE7, 0x28A2, 0x1965 }; -#endif +// XN297 CRC: CRC-16/CCITT (init 0xFFFF, xorout 0xFFFF) over the unscrambled +// address, pcf and payload, sent scrambled. The emulation computes it from 0xB5D2 +// over the bits as sent: the xorout is the difference for a CRC over 'bits' bits, +// the CRC of the scramble bits plus the scramble of the CRC bits. +static uint16_t __attribute__((unused)) XN297_crc_xorout(bool scramble, uint16_t bits) +{ + uint16_t xorout = 0xFFFF ^ 0xB5D2; + uint8_t lfsr = 0x71, s; // scramble bits (xn297_scramble[]): 1110001, then s[i] = s[i-7] ^ s[i-3] + for(uint16_t i = 0; i < bits + 16; i++) + { + s = scramble ? lfsr >> 6 : 0; + lfsr = ((lfsr << 1) | (((lfsr >> 6) ^ (lfsr >> 2)) & 1)) & 0x7F; + if(i < bits) + { + if((xorout >> 15) ^ s) + xorout = (xorout << 1) ^ 0x1021; + else + xorout <<= 1; + } + else + xorout ^= (uint16_t)s << (bits + 15 - i); + } + return ~xorout; +} static bool __attribute__((unused)) XN297_Configure(bool crc_en, bool scramble_en, bool bitrate, bool force_nrf) { @@ -296,10 +282,7 @@ static void __attribute__((unused)) XN297_WritePayload(uint8_t* msg, uint8_t len crc = 0xb5d2; for (uint8_t i = offset; i < last; ++i) crc16_update( buf[i], 8); - if(xn297_scramble_enabled) - crc ^= pgm_read_word(&xn297_crc_xorout_scrambled[xn297_addr_len - 3 + len]); - else - crc ^= pgm_read_word(&xn297_crc_xorout[xn297_addr_len - 3 + len]); + crc ^= XN297_crc_xorout(xn297_scramble_enabled, 8 * (xn297_addr_len + len)); buf[last++] = crc >> 8; buf[last++] = crc & 0xff; } @@ -366,9 +349,9 @@ static void __attribute__((unused)) XN297_WriteEnhancedPayload(uint8_t* msg, uin crc16_update( buf[i], 8); crc16_update( buf[last] & 0xc0, 2); if (xn297_scramble_enabled) - crc ^= pgm_read_word(&xn297_crc_xorout_scrambled_enhanced[xn297_addr_len-3+len]); + crc ^= XN297_crc_xorout(true, 8 * (xn297_addr_len + len) + 10); //else - // crc ^= pgm_read_word(&xn297_crc_xorout_enhanced[xn297_addr_len - 3 + len]); + // crc ^= XN297_crc_xorout(false, 8 * (xn297_addr_len + len) + 10); buf[last++] |= (crc >> 8) >> 2; buf[last++] = ((crc >> 8) << 6) | ((crc & 0xff) >> 2); @@ -446,10 +429,7 @@ static bool __attribute__((unused)) XN297_ReadPayload(uint8_t* msg, uint8_t len) for (uint8_t i = 0; i < len; ++i) crc16_update( buf[i], 8); //xorout - if(xn297_scramble_enabled) - crc ^= pgm_read_word(&xn297_crc_xorout_scrambled[xn297_addr_len - 3 + len]); - else - crc ^= pgm_read_word(&xn297_crc_xorout[xn297_addr_len - 3 + len]); + crc ^= XN297_crc_xorout(xn297_scramble_enabled, 8 * (xn297_addr_len + len)); //test if( (crc >> 8) == buf[len] && (crc & 0xff) == buf[len+1]) return true; // CRC OK @@ -492,10 +472,10 @@ static uint8_t __attribute__((unused)) XN297_ReadEnhancedPayload(uint8_t* msg, u crc16_update( buffer[pcf_size+1] & 0xc0, 2); //xorout if (xn297_scramble_enabled) - crc ^= pgm_read_word(&xn297_crc_xorout_scrambled_enhanced[xn297_addr_len-3+pcf_size]); + crc ^= XN297_crc_xorout(true, 8 * (xn297_addr_len + pcf_size) + 10); #ifdef XN297DUMP_NRF24L01_INO else - crc ^= pgm_read_word(&xn297_crc_xorout_enhanced[xn297_addr_len - 3 + pcf_size]); + crc ^= XN297_crc_xorout(false, 8 * (xn297_addr_len + pcf_size) + 10); #endif uint16_t crcxored=(buffer[pcf_size+1]<<10)|(buffer[pcf_size+2]<<2)|(buffer[pcf_size+3]>>6) ; if( crc == crcxored) diff --git a/Multiprotocol/iface_xn297.h b/Multiprotocol/iface_xn297.h index 0be2d81e..653252bd 100644 --- a/Multiprotocol/iface_xn297.h +++ b/Multiprotocol/iface_xn297.h @@ -41,6 +41,7 @@ static void __attribute__((unused)) XN297_RFChannel(uint8_t); static void __attribute__((unused)) XN297_SetPower(); static void __attribute__((unused)) XN297_SetFreqOffset(); static bool __attribute__((unused)) XN297_IsPacketSent(); +static uint16_t __attribute__((unused)) XN297_crc_xorout(bool, uint16_t); #endif