×

Notice

The forum is in read only mode.
  1. Forum
  3. Development
  5. Protocol Development
  7. JD 395 cx-10

JD 395 cx-10

More
09 May 2015 09:09 #32288 by Durete
Replied by Durete on topic JD 395 cx-10
Success!!!! :woohoo:
Tested with CX-10 Green board and JXD 395. Both works perfect, not any glitch or lost packet, simply perfect!
BTW, I tested also rates and flip mode and both works perfect.

Congrats Victzh, this is great!!!
More
09 May 2015 09:28 #32289 by goebish
Replied by goebish on topic JD 395 cx-10
Cool !
I'll try to implement the Eachine 3D X4 protocol ( bit.ly/1DXAWda ) as it is a one way protocol :)
More
09 May 2015 09:35 #32290 by Durete
Replied by Durete on topic JD 395 cx-10
Yep, I think this is a great DeviationTX moment :) Because last times almost all cheap RC quadcopters are using XN297.
With Victzh's fantastic work, we can implement a lot of new interesting protocols. :)
More
09 May 2015 12:04 #32293 by Neilyboy
Replied by Neilyboy on topic JD 395 cx-10
You sir are amazing.I'll try today!
Excellent work !
Neil
More
09 May 2015 12:47 - 09 May 2015 20:07 #32295 by goebish
Replied by goebish on topic JD 395 cx-10
Before I start working on the Eachine X4 3D I've a question for victzh :) Do you think the "scrambling table" (xn297_scramble[]) is fixed or depends of the values thrown into the debug registers at startup on the xn297 ?
Same question for polynomial, initial and xorout.

edit: forget this post, I tried and it works :)
Last edit: 09 May 2015 20:07 by goebish.
More
09 May 2015 15:17 #32301 by hexfet
Replied by hexfet on topic JD 395 cx-10
Very nice work! I second the request for a blog post :)
More
09 May 2015 17:58 #32304 by SeByDocKy
Replied by SeByDocKy on topic JD 395 cx-10
Amazing ....:)
More
09 May 2015 19:27 #32306 by victzh
Replied by victzh on topic JD 395 cx-10
Thanks! It was a nice journey - I started it April 22 as can be seen by first file dates.

I am trying to document it, may be a list of my mistakes can be useful for somebody ;-)
More
09 May 2015 20:05 - 09 May 2015 20:08 #32308 by goebish
Replied by goebish on topic JD 395 cx-10
Victzh, you're a god !
I just used your xn297 emulation layer to write some code to bind the EAchine X4 3D and it works !!!
Last edit: 09 May 2015 20:08 by goebish.
More
09 May 2015 20:11 #32310 by victzh
Replied by victzh on topic JD 395 cx-10
Nice! Mind you, the code can change - I may be put it in a separate file (may be .inc for textual inclusion - it's needed only by modules and I don't want to burden Devo 7E already tight space).

Also, the situation with checksums is not very clear. It seems to be working, but some packets can mismatch it - I never explored it in depth. I've seen radio traces that does not match this checksum algorithm - they may be artifacts of decoding, or may be real.
More
09 May 2015 20:13 #32311 by goebish
Replied by goebish on topic JD 395 cx-10
No problem, I just wanted to test, I'll wait that you finish before committing anything :)
More
09 May 2015 20:37 #32313 by victzh
Replied by victzh on topic JD 395 cx-10
BTW, answering your question about scrambling sequence - it's fixed, it covers both address, no matter the size (from 3 to 5 bytes) and then the message. The code in the emulation layer (as you probably figured by now) handles all of this for you. You just need to call some functions instead of calling native nRF24 ones. Also, note that the main body of message is bit-reversed - it gave me extra headache decoding it :-)
More
15 May 2015 07:29 #32603 by Durete
Replied by Durete on topic JD 395 cx-10
I captured SPI traces from my JXD 395 TX to bring some help to full reversing protocol:

www.dropbox.com/s/v7xq8d6pywl1nmd/JXD395.rar?dl=0
More
15 May 2015 08:52 - 15 May 2015 11:16 #32604 by goebish
Replied by goebish on topic JD 395 cx-10
This is what we have so far:
Seems only packet[1] and packet[2] has something to do with frequencies sequence,
TXID: E3 04 xx xx -> rf channels: 06 24 31 40 (cx-10 green pcb)
TXID: 0B 06 xx xx -> rf channels: 0E 16 33 40 (cx-10 green pcb)
TXID: FF 08 xx xx -> rf channels: 12 25 35 40 (cx-10 green pcb)
TXID: 87 10 xx xx -> rf channels: 0A 1E 2D 41 (don't remember)
TXID: 79 05 xx xx -> rf channels: 0C 1D 32 40 (JD 395)
TXID: EF 07 xx xx -> rf channels: 12 24 34 40 (cx-10 blue pcb, not exactly the same protocol but txid / channels seems to follow a similar pattern)

That's not enough for me to crack it, but a pattern is starting to emerge :)
rf channel 1 = (packet[1] & 0x0F) + 0x03
rf channel 2 = (packet[1] >> 4) + 0x16
rf channel 3 = (packet[2] & 0x0F) + 0x2D
rf channel 4 = (packet[2] >> 4) + 0x40

we may have to make captures on the RX side with more TXIDs on TX side.
Last edit: 15 May 2015 11:16 by goebish.
More
15 May 2015 09:50 - 15 May 2015 15:33 #32606 by Durete
Replied by Durete on topic JD 395 cx-10
A new capture from my almost destroyed CX-10 green TX :evil:
I don't now if you can extract some valid info, because can't complete the bind process without the sticks :P



Removed capture
Attachments:
Last edit: 15 May 2015 15:33 by Durete. Reason: Removed invalid capture
More
15 May 2015 09:53 - 15 May 2015 10:55 #32607 by goebish
Replied by goebish on topic JD 395 cx-10
Thanks, but no bind, no hopping sequence

(pas de bras, pas de chocolat :P)
Last edit: 15 May 2015 10:55 by goebish.
More
15 May 2015 09:56 #32608 by Durete
Replied by Durete on topic JD 395 cx-10
Ok, I will try something....
More
15 May 2015 10:15 #32609 by Durete
Replied by Durete on topic JD 395 cx-10
Please, take a look. I think this time I finished the bind process.

www.dropbox.com/s/8xclcd675x4msxe/CX-10%20Green2.rar?dl=0
More
15 May 2015 10:19 #32610 by goebish
Replied by goebish on topic JD 395 cx-10
Thanks, added to the list (#3), it follows the pattern :)
More
15 May 2015 10:22 #32611 by Durete
Replied by Durete on topic JD 395 cx-10
Come on guys! More captures :lol:
  1. Forum
  3. Development
  5. Protocol Development
  7. JD 395 cx-10
Time to create page: 0.493 seconds
Powered by Kunena Forum
Force desktop display