Topic created on: April 29, 2007 11:06 CDT by timsheung .

I'm trying to reverse-engineer the data transmitted by my "Personal Response System (PRS)" unit; my goal is to eventually be able to modify the data inside it, and to make a duplicate of it.
But I've tried very hard thinking about the logic of generating the checksum followed by the transmitted message.

The transmitted data has been decoded, which contains firstly a 30-bit of student number (from 0-999999999), followed by a 4-bit of answer (from 0-9), then a 2-bit of confidence level (00 or 01 or 10), and after that there is a 16-bit of unknown data is included in the message.

Can any one suggest a possible approach to find a checksum algorithm that suits my case?

e.g.1
   student no.: "05198175"
        answer: "0000"
confidence lv.: "00"
the data would become:
0000 0001 0011 1101 0100 0101 0111 11 0000 00  1001 1101 0010 1010 00001
|___________________________________| |__| |_| |_________________| |___|
   30-bit student no. (bin --> dec,   ans. con.  16-bit checksum    end
     which then yields "5198175")          lv.                      bit

e.g.2
   student no.: "05198175"
        answer: "0001"
confidence lv.: "01"
the data would become:
0000 0001 0011 1101 0100 0101 0111 11 0001 01  1001 1101 0010 1111 00001
|___________________________________| |__| |_| |_________________| |___|
   30-bit student no. (bin --> dec,   ans. con.  16-bit checksum    end
     which then yields "5198175")          lv.                      bit

e.g.3
   student no.: "05177602"
        answer: "0000"
confidence lv.: "00"
the data would become:
0000 0001 0011 1100 0000 0100 0000 10 0000 00  1001 1000 1100 1110 00001
|___________________________________| |__| |_| |_________________| |___|
   30-bit student no. (bin --> dec,   ans. con.  16-bit checksum    end
     which then yields "5198175")          lv.                      bit

Known infomation:
1. The PRS handset contains a 8-bit Microcontroller.
2. The 16-bit checksum will accumulate when the answer bits accumulates.
   (from "0000"-->"0001",it will change chksum
    from "1001 1101 0010 1010" to "1001 1101 0010 1110")
3. The checksum may only be obtained by shifting, addition or subtraction,
   but no division.
4. I have tried to sum up each byte or each 2-bytes into a 16-bit
   variable, both big and little-endian, and seems does not match the
   checksum.
5. I have actually got 10 sets of data, which can be listed if anyone needs
   further explanation of the above.

Reference:
PRS info -- http://www.interwritelearning.com/products/prs/infrared/detail.html