1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
|
#!/usr/bin/env python3
"""
Pattern Analysis Tool for MEL Protocol Checksums
Looks for mathematical relationships and patterns in the checksum data
"""
import sys
import struct
from collections import defaultdict
def parse_hex(hex_str: str):
"""Parse hex string to bytes"""
return [int(hex_str[i:i+2], 16) for i in range(0, len(hex_str), 2)]
def find_changing_bytes(filename: str):
"""Find which bytes change between consecutive entries"""
with open(filename, 'r') as f:
lines = [line.strip() for line in f if line.strip()]
if len(lines) < 2:
return
print(f"Analyzing byte changes in {filename}")
print("=" * 50)
# Parse first two entries
bytes1 = parse_hex(lines[0])
bytes2 = parse_hex(lines[1])
print("Changes between first two entries:")
for i, (b1, b2) in enumerate(zip(bytes1, bytes2)):
if b1 != b2:
print(f" Byte {i:2d}: 0x{b1:02x} → 0x{b2:02x} (diff: {b2-b1:+d})")
# Look at sequence field specifically (byte 6 based on your data)
print(f"\nSequence progression (byte 6):")
for i in range(min(20, len(lines))):
bytes_data = parse_hex(lines[i])
seq = bytes_data[6] if len(bytes_data) > 6 else 0
checksum = bytes_data[-2] | (bytes_data[-1] << 8) if len(bytes_data) >= 2 else 0
print(f" Entry {i:2d}: seq=0x{seq:02x}, checksum=0x{checksum:04x}")
def analyze_checksum_patterns(filename: str):
"""Analyze patterns in checksum values"""
with open(filename, 'r') as f:
lines = [line.strip() for line in f if line.strip()]
print(f"Checksum Pattern Analysis for {filename}")
print("=" * 50)
checksums = []
sequences = []
payload_sums = []
for line in lines:
bytes_data = parse_hex(line)
payload = bytes_data[:-2]
checksum = bytes_data[-2] | (bytes_data[-1] << 8)
sequence = bytes_data[6] if len(bytes_data) > 6 else 0
checksums.append(checksum)
sequences.append(sequence)
payload_sums.append(sum(payload))
# Look for arithmetic progression in checksums
print("Checksum differences (first 20):")
for i in range(1, min(20, len(checksums))):
diff = checksums[i] - checksums[i-1]
print(f" {i-1:2d}→{i:2d}: {diff:+5d} (0x{diff & 0xFFFF:04x})")
# Check for correlation with payload sum
print(f"\nPayload sum vs Checksum correlation:")
for i in range(min(10, len(checksums))):
print(f" Entry {i}: sum={payload_sums[i]:5d}, checksum={checksums[i]:5d}, "
f"ratio={checksums[i]/payload_sums[i] if payload_sums[i] != 0 else 'N/A':.3f}")
def test_bitwise_operations(filename: str):
"""Test various bitwise operations that might be used"""
with open(filename, 'r') as f:
first_line = f.readline().strip()
bytes_data = parse_hex(first_line)
payload = bytes_data[:-2]
expected = bytes_data[-2] | (bytes_data[-1] << 8)
print(f"Testing bitwise operations on first entry:")
print(f"Expected checksum: 0x{expected:04x}")
print("=" * 40)
# Sum with bit operations
s = sum(payload)
tests = [
("Sum", s & 0xFFFF),
("Sum >> 1", (s >> 1) & 0xFFFF),
("Sum << 1", (s << 1) & 0xFFFF),
("Sum rotated right", ((s >> 8) | (s << 8)) & 0xFFFF),
("Sum rotated left", ((s << 8) | (s >> 8)) & 0xFFFF),
("Sum XOR 0xFFFF", (s ^ 0xFFFF) & 0xFFFF),
("Sum XOR 0x5555", (s ^ 0x5555) & 0xFFFF),
("Sum XOR 0xAAAA", (s ^ 0xAAAA) & 0xFFFF),
("~Sum", (~s) & 0xFFFF),
("~Sum + 1", (~s + 1) & 0xFFFF),
("0x10000 - Sum", (0x10000 - s) & 0xFFFF),
("0xFFFF - Sum", (0xFFFF - s) & 0xFFFF),
]
for name, result in tests:
match = "✓" if result == expected else "✗"
print(f" {match} {name:20s}: 0x{result:04x}")
def analyze_multiple_files(filenames):
"""Compare patterns across multiple files"""
print("Multi-file Pattern Analysis")
print("=" * 50)
all_data = {}
for filename in filenames:
try:
with open(filename, 'r') as f:
lines = [line.strip() for line in f if line.strip()]
# Get first entry from each file
if lines:
bytes_data = parse_hex(lines[0])
payload = bytes_data[:-2]
checksum = bytes_data[-2] | (bytes_data[-1] << 8)
all_data[filename] = {
'payload': payload,
'checksum': checksum,
'payload_sum': sum(payload),
'first_hex': lines[0]
}
except FileNotFoundError:
print(f"Warning: File {filename} not found")
continue
print("Comparison of first entries:")
for filename, data in all_data.items():
print(f"\n{filename}:")
print(f" Checksum: 0x{data['checksum']:04x}")
print(f" Payload sum: {data['payload_sum']}")
print(f" First hex: {data['first_hex'][:40]}...")
# Look for common differences
checksums = [data['checksum'] for data in all_data.values()]
sums = [data['payload_sum'] for data in all_data.values()]
if len(checksums) > 1:
print(f"\nDifferences between files:")
filenames_list = list(all_data.keys())
for i in range(len(filenames_list)):
for j in range(i+1, len(filenames_list)):
f1, f2 = filenames_list[i], filenames_list[j]
check_diff = all_data[f2]['checksum'] - all_data[f1]['checksum']
sum_diff = all_data[f2]['payload_sum'] - all_data[f1]['payload_sum']
print(f" {f1} vs {f2}:")
print(f" Checksum diff: {check_diff:+d}")
print(f" Sum diff: {sum_diff:+d}")
def find_magic_constants(filename: str):
"""Try to find magic constants used in the checksum calculation"""
with open(filename, 'r') as f:
lines = [line.strip() for line in f if line.strip()]
print("Searching for magic constants...")
print("=" * 40)
# Test first few entries
for i, line in enumerate(lines[:5]):
bytes_data = parse_hex(line)
payload = bytes_data[:-2]
expected = bytes_data[-2] | (bytes_data[-1] << 8)
payload_sum = sum(payload)
print(f"\nEntry {i}:")
print(f" Expected: 0x{expected:04x} ({expected})")
print(f" Sum: 0x{payload_sum:04x} ({payload_sum})")
# Try to find what constant when added/subtracted/XORed gives the expected result
magic_add = (expected - payload_sum) & 0xFFFF
magic_sub = (payload_sum - expected) & 0xFFFF
magic_xor = expected ^ payload_sum
print(f" Magic add: 0x{magic_add:04x} (sum + this = expected)")
print(f" Magic sub: 0x{magic_sub:04x} (sum - this = expected)")
print(f" Magic XOR: 0x{magic_xor:04x} (sum ^ this = expected)")
def main():
if len(sys.argv) < 2:
print("Usage:")
print(" python pattern_finder.py <file1> [file2] [file3] ...")
print("\nThis tool will:")
print(" - Find changing bytes between entries")
print(" - Analyze checksum patterns")
print(" - Test bitwise operations")
print(" - Compare multiple files")
print(" - Search for magic constants")
sys.exit(1)
filenames = sys.argv[1:]
# Single file analysis
main_file = filenames[0]
print("PATTERN ANALYSIS REPORT")
print("=" * 60)
find_changing_bytes(main_file)
print()
analyze_checksum_patterns(main_file)
print()
test_bitwise_operations(main_file)
print()
find_magic_constants(main_file)
print()
# Multi-file analysis if multiple files provided
if len(filenames) > 1:
analyze_multiple_files(filenames)
if __name__ == "__main__":
main()
|
