I've found the checksum/CRC is stored at 1A and again at the 3rd and 4th bytes from the end of the file, but I can't work out how it's calculated... whether it's just finding the right range, or an actual weird calculation, I dunno. :/
On one file, the 1s complement CRC-16 for the range starting from 4 bytes after the first checksum, with the final byte being the one two before the second checksum, was correct except for being backwards, but on the others, it's nowhere near.
Anyone got any ideas on what I'm doing wrong?