A deep technical walkthrough on reverse-engineering unknown CRC parameters from a black-box oracle. By exploiting the affine nature of CRCs and canceling initial/final XOR offsets with all-zero messages, single-bit basis messages can be used to probe the generator polynomial. The Berlekamp-Massey algorithm can recover the polynomial from LFSR output sequences, but a faster 4-message shortcut is also presented. The method recovers the generator polynomial, bit/byte order, and init/final XOR values. Working Python code is provided, with real-world validation against zlib CRC32, multiple CRC-16 variants, and CRC-32 from lammertbies.nl. Edge cases involving non-primitive polynomials (like CRC-X25) are handled using the extended Euclidean algorithm.
