Reverse engineering Motorola PMKN4012 DS2433 EEPROM dynamic bytes
Hello everyone,
I am researching a Motorola PMKN4012 USB programming cable.
The cable contains a DS2433 1-Wire EEPROM. I am trying to understand how Motorola generates some dynamic EEPROM bytes from the DS2433 ROM ID.
I have dumps from working original cables and found that two bytes in the EEPROM appear to depend on the 1-Wire ROM.
Sample 1:
DS2433 ROM:
23 34 1A CD 01 00 00 57
Family:
0x23
Serial:
341ACD010000
CRC8:
0x57
Dynamic EEPROM bytes:
Offset 0x44-0x45:
E8 E3
-----------------------------
Sample 2:
DS2433 ROM:
A3 B1 20 C0 00 00 50 15
Family:
0xA3
Serial:
B120C0000050
CRC8:
0x15
Dynamic EEPROM bytes:
Offset 0x44-0x45:
40 6D
I am trying to determine the algorithm used.
Possible inputs:
- DS2433 ROM ID
- serial number
- ROM CRC8
- hidden key / hash / checksum
Interesting offsets:
0x44-0x45
0x54-0x55
I have already tested a simple CRC16 idea, but I would like to find the real algorithm.
Does anyone have experience with Motorola PMKN4012 cables, DS2433 EEPROMs, or 1-Wire authentication schemes?
I can provide full DS2433 dumps and additional samples for analysis.
Thanks!