which is MJX use protocol ?

i know .

i know modul 2.4ghz , that is small board .


i wait someone write code use arduino , And we can use TX flysky + modul to control F45

great

problem is modul f45 is BK 2421 , NRF24L01 and CC2500

@FDR - yea, you are right. But you can't tell anything about what RF chip it uses looking at TX antenna. The models themselves are expensive (for the quality of flight - 4ch, with separate tail motor), otherwise I would consider buying one.

Here are some pictures of the RX board and the TX.
One can easily spot CE pin and 16MHz xtal plus epoxy covered chip, which tells us that this is a BK2421 (on F45 V3 RX board and TX) - and my sniffed SPI traffic confirms that.

F45 RX rev. 3
top


bottom


F45 TX (with red text on stickers)




btw: Tried to post this with huge images before, which did not work as expected. What's the size limit for images in this forum ?

I see. And the pinout can be the same as for V202 TX. They use similar 8pin 2mm RF module. Do you have you new Logic Analyzer yet? And do you have V202 TX and did you try it (or V202 protocol on Devo)?

Still waiting for my new LA, same with the F45 TX :\

And I have no V202 in my fleet yet ...

I'll try with your aduino code first, trying to get the nRF hooked up to the arduino ...

With some information from Internet, that is modul BK 2421

however, modul BK2421 is range short. about 30m

i don't know where can buy modul range 1km

Come on, why do you need 1km for this? It stops to be visible at 300m at most. Buy nRF24L01+ with PA (if you can), it will solve majority of your problems.

Really, if you have a model that is visible at 1km and you can guide it, it costs so much you shouldn't save on transmitter. You shouldn't bother with Beken, go with nRF24L01+ with PA.

hi victzh

i play helicopter MJX F45 and i had upgrade full motor brushless

now , i often fly outdoor , so i need range > 100m. i have two fail heli when control > 100m .OH no


as you say : modul NRF 24L01 = BK2421 ,them is suitable ?

i had modul NRF 24l01 + PA .

I agree with Vitch, get a proper module and use an external antenna. This is mine and I get the same RF output from the modules as I get from the original module and antenna.

If you fly expensive models make sure you spend money on the TX!

Some update, I've got my F45 Transmitter (GR129) which perfectly binds with my faulty F45 RX Board (only power part/FETs broken).

Some SPI sniffing later (still using cheapo Scana Studio L.A.) I can confirm that the TX ID is in bytes 6-8 (byte 7-9 for not-coders ), my new TX has ID 5B CE D5 edit:Inspecting some more packets, it seems to be CE D5 00 (and thus one byte further in the payload) - 5B was the trim the previous owner had set ^^. Now it matches the V2x2 channel selection perfectly (base row 3, increment 0).

Channel hopping for this TX is:
which is nearly the same as V2x2 Sequence 03, besides 10 replaced by 0D and 20 replaced by 1D (all values are hex). edit: Looking at the code, this is the strange avoidance of channels dividable by 16. Thus its the very same as V2x2.

Regarding the binding process it looks to me that TX simply transmits this packet (including command byte for BK2421, thus payload is 16 bytes):
which looks just like the packet when being bound, besides C0 at the end and channels are all zero, and TX ID being only 2 bytes transmitted (maybe it is actually only 2 bytes ?).

Note that before triggering the actual bind process by pushing throttle up and down, it seems the TX transfers 16 bytes of uninitialized buffer (program bug?):which looks like the remains of these command from Beken init sequence:andplus zeroes most propably due to initial zeroing of memory at startup.

Digging further, the MJX V2 Protocol looks absolutely identical to V2x2.
I've tried to bind Arduino + nRF module to RX using your code but failed with that (disabled analog reads and used your auto-bind approach instead of throttle up/down).

I'm pretty sure I have not properly connected the nRF to my arduino mega (I have adjusted defines for CE/CSN), as I triple-checked arduino code and RX are programming the chip to send/listen on channel 8 (SPI cmd 0x25 0x08), so the initial bind procedure should work, and I even entered my original TX ID. There may be incoming traffic on RX side, but its not getting regularly packets ...

Any clues what I can check ? I do not own a spektral analyzer which I could use to check whether something is really sending data over the air ...

If you have something from V202 line, you can try Arduino code on it first to make sure it works. If you have already modded Devo, you can try to bind your RX to it using V202 protocol. If everything fails, connect Logic Analyzer to your Arduino and check that you actually issue correct commands - sometimes it appears to be the case.

The sequence transmitted in the very beginning appears to be garbage, V202 original transmitter does the same.

Okay, checked SPI on Arduino / nRF side, all fine there, besides that I found out that there is a little difference in init sequence: rx/tx addresses are not the same (these magic 6 bytes programmed into registers A, B and 10).

But even using MJX valueswon't bind Arduino with F45 Receiver.

I have no V2x2 equipment and I did not find spare RX/TX for a reasonable price in europe (banggood has a V959 to V222 upgrade kit for a fair price, but that takes ages to germany due to customs inspections).
I do own a Devo 8s, but still prepare to mod it (Waiting for modules, reading howtos, ...).

Yea, I understand. May be after New Year when I reunite with my development environment I will be able to take another look at the situation. Anyway, if you're serious about reverse engineering, buy a cheap clone of Saleae, it costs around $10 and functions exactly the same.

hi Coders

i want to see project when complete. If you can, post a video here ,test fly f45 ?

thank a lot and waitting.

victzh wrote: Yea, I understand. May be after New Year when I reunite with my development environment I will be able to take another look at the situation. Anyway, if you're serious about reverse engineering, buy a cheap clone of Saleae, it costs around $10 and functions exactly the same.

I am interested ... by such clone. Eventually, you got a link for such product ?

I took this one ...

www.aliexpress.com/item/USB-Saleae-24M-8...t-1-1/823339465.html

I don't know if it's a good clone or not ... Anyway in worst case, I didn't loose a lot ... I want to learn retro-engeniering in protocol implementation.

victzh wrote: Anyway, if you're serious about reverse engineering, buy a cheap clone of Saleae, it costs around $10 and functions exactly the same.

I have ordered a original Saleae Logic at end of November (they were out of stock then, but estimated to ship until Christmas from UK ... still not arrived) and ordered a cheap clone after a colleage told me that he's interested in such a thing, too, so I can easily sell it when the original arrives. That one should be already in germany, hope to get it this week ...

I'm also trying to get a V222 (original or rebranded) for not too much money, but that may take some time (Did not yet see used/defective ones).