New WLToys Protocol V977

The race to breaking this V977 protocol codes is really hotting up, the factory has agreed to release the codes for Deviation

www.rcgroups.com/forums/showpost.php?p=28265665&postcount=727

joeclone wrote: The race to breaking this V977 protocol codes is really hotting up, the factory has agreed to release the codes for Deviation

www.rcgroups.com/forums/showpost.php?p=28265665&postcount=727

Good news

Wow ~~ Very good news.

Pouah .. very nice reply .. can't wait .. thx

this has WL-V977 V966 V930 V988 RF code.

kenatoys.en.alibaba.com/product/18525960...LYBARLESS_HELIX.html

stevernew wrote: this has WL-V977 V966 V930 V988 RF code.

kenatoys.en.alibaba.com/product/18525960...LYBARLESS_HELIX.html

Yes .... good find.
If I am understand ... now the KN is working at 250kbit/s ... (instead of 1 Mbits/s). Ok It means, that they want to improve the range control for thei new quad V303 too

So the proper name is Ke Na? Interesting that it's published on Alibaba. Is it official? At least the name, kenatoys, seems to be.

Can someone confirm that they are the actual manufacturer ?

For me that's looking like a reseller, look at his other products, e.g.
kenatoys.en.alibaba.com/product/11547556...G_RC_QUADCOPTER.html

Which I know as Syma X3 here in germany.

kenatoys.en.alibaba.com/product/15230213...are_parts_China.html

Is a FBL70 ...

edit: They even sell a V911 ^^

edit 2: Someone chinese speaking can tell us what the words on one of the V911 pictures mean ? "Guan Dong Ke Na Xin Xi Ke Ji" (Guan Dong is the area, if I'm right). The comes this "KeNa" (toys) and then more ...

So I'd say they're just another relabeling company (like Rayline, Revell, ...), not the original manufacturer.
Anyway, nice finding, thanks for posting

edit3: Checking my collection of pictures of TX/RX Boards, in fact the Attop YD-117 (also found on the alibaba site) has its MCU on RX Board labeled with 'KN', same as the V930 and V988 RX Boards.

Feel free to proove me wrong

Hi btoschi,

"Guan Dong Ke Na Xin Xi Ke Ji" is just a company name,Guan Dong is China Guan Dong province,"Ke Na Xin Xi Ke Ji" is Ke Na New Technology Corporation.

Ke Na seems KN chip maker.

In the TX code, can find the word "KNDZ".

Ha, it is mean....

Try to translate this protocol code doc. into English

1, RF with BK2423, pin VDD,CE,CSN,CLK,MOSI,MISO,IRQ,GND
2, RF use : data pipe 0 , TX_ADDR with 5 byte, 2 byte CRC, 16 byte length , only TX mode, 250Kb/S( or 1MKb/S)
3, Binding process
Binding use 2.483GHz , 1MKb/S,
Binding TX_ADDR: bind_address[5] = {"KNDZK"};

Package 16 bytes:
Byte 0 : 'K' ---0x4B
Byte 1 : 'N' ---0x4E
Byte 2 : 'D' ---0x44
Byte 3 : 'Z' ---0x5A
Byte 4 : 0x00
Byte 5 : 0x07
Byte 6 : 0x05
Byte 7 : 0x04
Byte 8 : 0x08
Byte 9 : 0x18
Byte10 : 0x2d
Byte11 : 0x41
Byte12 : 0x00
Byte13 : 0x00
Byte14 : 0x00
Byte15 : 0x00 or 0x01 (Let RX recognize air rate, 0x00 => 250Kb/S, 0x01 => 1Mb/S

binding info. send every 2ms within 2sec. then start to send working code.

4, Working status
Working frequency 0~3 : 2.408G, 2.424G, 2.445G, 2.465G ; please make sure air rate setting at binding

byte15, use 250Kb/S or 1MKb/S.
Working TX_ADDR: work_address[5] = {0x00,0x07,0x05,0x04,0x4b};

data package format:(Length 16bytes)

elevator
aileron
throttle
rudder

Byte 0 : Throttle ADC high byte 0 -- 1023 (form 0 to 1023 ??)
Byte 1 : Throttle ADC low byte
Byte 2 : Aileron ADC high byte 0 -- 512(middle) -- 1023
Byte 3 : Aileron ADC low byte
Byte 4 : Elevator ADC high byte 0 -- 512(middle) -- 1023
Byte 5 : Elevator ADC low byte
Byte 6 : Rudder ADC high byte 0 -- 512(middle) -- 1023
Byte 7 : Rudder ADC low byte
Byte 8 : Throttle trim 0 -- 200
Byte 9 : Aileron trim 0 -- 100(middle) -- 200
Byte10 : Elevator trim 0 -- 100(middle) -- 200
Byte11 : Rudder trim 0 -- 100(middle) -- 200

Byte12 :
bit 0: DR , 0=DR / 1=DR
bit 1: Throttle Hold , 0= Normal , 1= Hold active
bit 2: 3D (Stunt?) 0= Normal , 1= 3D
bit 3: reserved , all 0
bit 4: reserved , all 0
bit 5: reserved , all 0
bit 6~7: Flight mode(Gyro setting), 00= 6G mode , 01= 3G mode


Byte13 :
bit 0: reserved , all 0
bit 1: reserved , all 0
bit 2~4: working frequency code 0,1,2,3 (ex: if using 2.408G, setting = 0)
bit 2~4: working frequency package count 1,2,3,4

Byte14~15 : reserved , all 0

5, Hopping method:

Change frequency every 10ms,every frequency send 4 package interval = 2ms , every package include
frequency package counter (1,2,3,4),package counter count only sending times, it should be clear/reset
when you change to next frequency.
10ms frequency change and 2ms package sending time must very accuracy; you can use 2ms timer to interrupt
transmission, change to next frequency when interrupt 5 times.

Thank you, it helped a lot! One thing is to read numbers with spare English words, another - proper translation. I regret that I can't read Chinese, but it is a very hard language to learn, in large part due to pronunciation and writing.

Hi, victzh

Hope it's useful for you.

and I lost something ...... sorry!

Byte12 :
bit 0: DR , 0=DR high (stable) / 1=DR low (agility)

Check the builds forum if you're brave! You have a chance to try it first.

It's in my repo, bitbucket.com/rivig/deviation, too early for pull request.

victzh wrote: Check the builds forum if you're brave! You have a chance to try it first.

Clap CLap bravo one more time Vitczh ...

Dear victzh,

I can`t find kn_nrf24l01.c in your repo.

Best,

Ansheng

Will fix in a minute.

Check again, please.

Ansheng, I should express gratitude for the SPI traces you provided me with. The protocol description is detailed, but not without errors and omissions. Traces helped me to clarify what was unclear otherwise.