CRC Patch Finder
Result
CRC Patch Finder
About the CRC Patch Finder
The patch finder searches for a two-byte value that, when inserted at the end of your data (or at a chosen offset), makes the CRC of the patched data equal a target value you specify. It brute-forces all 65,536 two-byte combinations against the algorithm and input data currently configured in the calculator above.
This is useful for CRC-forcing scenarios such as reverse engineering firmware update mechanisms, crafting test vectors for a checksum-validated protocol, or verifying that a file format's integrity check can be produced deliberately. Change the algorithm or input data in the calculator to search a different CRC model.
Frequently asked questions
What is a CRC patch finder?
A CRC patch finder searches for bytes that, when written into your data, make the CRC of the modified data equal a checksum you choose. Instead of recalculating a stored checksum, it lets you keep the original checksum and change the data to match it — which is what a format that validates its own CRC requires.
How do I fix a checksum after editing a save file or firmware image?
Load the edited data into the calculator, select the CRC model the format uses, then enter the original checksum as the target value. The patch finder returns the two-byte patch that restores that checksum, and you write those bytes at the reported offset. If the format stores its CRC in a header field you can also simply recalculate it, but a patch is the only option when the checksum itself cannot be changed.
How many bytes does the patch finder need to hit a target CRC?
Two bytes are enough for any CRC-8 or CRC-16 model and for most practical CRC-32 cases, because the search covers all 65,536 two-byte combinations. A 32-bit CRC has more possible values than a two-byte patch can reach, so if no combination matches, add a third free byte to your data or move the patch offset and search again.
Does the patch finder work with any CRC algorithm?
Yes. It uses whatever width, polynomial, initial value, reflection settings, and final XOR are configured in the calculator above, so it works with any of the published catalog models and with custom parameter sets for proprietary protocols.
Is CRC patching the same as breaking a checksum?
No. CRC is an error-detection code, not a cryptographic signature — it is designed to catch accidental corruption and was never intended to resist deliberate modification. Finding patch bytes is straightforward arithmetic on the CRC register, which is why integrity against tampering needs a cryptographic hash or a MAC rather than a CRC.