Global Drone, Skull Drone or GW008

I'm only looking for the one that has a "PAN" marking on the chip in the quad (looks like there are at least 3 different revisions of this quad ...) I'm not sure I'll be able to crack it, but that's a good challenge

If yours is using a LT8910 in the Tx then I'm not interested, at least not for now.

Don't hold your breath anyway, I just finished working on the CX35, now I started to work on the CX10D. Then next on the list are CX10WD, H20H then H20 mini / H30 mini.
... and I still have to work on AFHDS 2A telemetry, I should really give more priority to this one, I know a lot of people are waiting for it ...

Sorry, the LT8910 is not emulated by Deviation (yet).

Still you can post a capture of the LT8910 Tx if you've a logic analyzer, actually we can emulate the LT8900 (with some limitations though, eg no whitening), but the LT8910 has extra bitrates that are not compatible with the nrf24l01+, with some luck this machine is using a compatible bitrate ...

It would make a great addition to the top of my screens

from left to right

Floureon H101 (Silverxxx'd, awesome 3D trainer!)
EAchine H8 mini (Silverxxx'd)
Fayee FY319
EAchine H8 mini 3D
Blade Inductrix (tiny whoop)
EAchine H7
EAchine H8 mini (stock)
WLtoys V272
San Huan 6025-1 MiniX 3CH Helicopter (infrared)
... the CX10 has fallen behind the desk, under a ton of mess, that's probably the smallest I have.

I finally received the GW008 with "PAN" marking on the quad chip.

Unfortunately the RF is not compatible with Panchip XN297 ...

First I had a look with the SDR (HackRF+gnuradio), the Tx sends bind packets on 2402.2 MHz, this 200KHz offset might be a first issue if we have to emulate it with a nrf24l01.



... then I tried the usual tricks to try to capture some packets with a nrf24l01, but I only got noise.

Finally, I inspected the RF signal in inspectrum, looks like it's using 500kbps datarate, which the nrf24l01 can't do either, no wonder I only got noise.



... so I give up, nothing I can do for now. It might be possible to emulate it with the A7105 or CC2500, but I'm not sure and that would require a LOT of work (and, I forgot to tell, but the protocol is bi-directional), probably not worth it for only 1 protocol.

edit: it's using 1 Mbps bitrate actually, I've to learn how to make sense of inspectrum results so there's still hope.

ajtank wrote: Caerus's photo showed that the transmitter chip was XNS104. According to Panchip info here , the RF charcteristics of the chip should be compatible with XN297L.

Thanks for the product manual, I had another try, but I can't detect the XN297 syncword (0xC710F55) with SDR.
Maybe the firmware is using some "unusual" settings for the xn297 modulator. If the RF chip pins were broken out I could probably have a better understanding, but unfortunately they're not ( 内部绑线连接 ).

Haha, by using 0x710F55 as syncword instead of 0xC710F55, seems I get some data packets at 1 Mbps bitrate



The "peak" in data widget is the end of the syncword, then the address, then 3 (or 2 ?) moving bits which are probably a counter or ACK retry counter, then some data, then the CRC.

Frequencies (minus the 200 kHz offset):

- bind: 2402, bind stage exits only when quad is powered on, that either means ACK is enabled (this isn't implemented in the xn297 emulation layer yet ) or the quad sends back a normal packet, as the CX10 blue
- data: 2450, 2463, 2466, 2471 (yeah, I can see the bits changing while I move the sticks )

Now I'll try to make sense of that ...

Some progress, I'm able to decode the address field (cc cc cc cc cc is very common):



Now, looks like the xn297L is used in enhanced mode packet format, with auto ACK (10 retries), I've to decode the 10 bit PCF and try to implement that, find which parts are bit reversed and scrambled, some bit shifting ... lots of fun
This is the first time I see a XN297 protocol that's using enhanced mode



I'm still not sure it can work, but I'll do my best.

Something is worrying me, I've not been able to receive packets with a nrf24l01, I wonder if this is because of this 200kHz shift ...
I hope it can work the other way round.

More progress, I have now as much information as if the SPI bus was exposed