Mould King 33043 Super F Quad - HS6200 RF chip

SPI sniffed: AE A6 60 A8 98 56 AA 40 CB
received by nrf: 2E 53 5B A5 F5 7C 53 FC 9A

for now I have 3 raw packets:

Control power up:
address: 55 42 9C 8F C9
Payload sent (9 bytes): AE A6 60 A8 98 56 AA 40 CB
32 bytes received: 55 55 27 97 29 AD D2 FA BE 29 FE 4D 5A DE 3B FB 7E BB DD DD AA 39 CA 71 CD 66 AF 9E EE 72 CD 28

Landing:
address: AE A6 60 A8 98
Payload sent (9 bytes): 00 80 40 80 80 40 40 00 BF
32 bytes received: AE AE 25 C0 3A BD C6 F6 B5 5C DE 77 59 50 EF 7E FA EF EB DA 1F 71 AB 22 5A 51 CD 34 BD D2 A8 DD

Full throttle
address: AE A6 60 A8 98
Payload sent (9 bytes): FF 80 40 80 80 40 40 00 BF
32 bytes received: AE AE 25 BF BA BD C6 F6 B5 5C DE 48 D8 F2 2F 7F FA 77 FF FD FF FF 77 FE F7 F5 2A 33 6E C8 55 52

conclusions for now:
guard bytes = first address byte
flight address is sent as power up payload
flight first payload byte refers to throttle

Yes, it seems perfect.

const byte xor_table[9] = {0x80,0xf5,0x3b,0x0d,0x6d,0x2a,0xf9,0xbc,0x51};

Hi Goebish, If you look at my LT8900 emulation, the bit shifting of the buffer is implemented. You can give it the number of bits you want which is just 1 in your case if I'm correct (LT8900 is anything between 4 to 18bits).

Hi.

I was traveling.

Now I'm working on another project, but I'm warm to resume Nrf->HS6200 hobby asap. sorry

goebish wrote: Looks like someone has ordered a MK 33043 for me (you know who you are, thanks ), so I should be able to continue the work on that in a few weeks

Good news for me!