- Posts: 2631
Global Drone, Skull Drone or GW008
15 Jan 2017 14:20 - 15 Jan 2017 14:23 #57978
by goebish
Replied by goebish on topic Global Drone, Skull Drone or GW008
I'm only looking for the one that has a "PAN" marking on the chip in the quad (looks like there are at least 3 different revisions of this quad ...) I'm not sure I'll be able to crack it, but that's a good challenge 
If yours is using a LT8910 in the Tx then I'm not interested, at least not for now.
If yours is using a LT8910 in the Tx then I'm not interested, at least not for now.
Please Log in or Create an account to join the conversation.
15 Jan 2017 14:53 #57985
by flarkopter
Replied by flarkopter on topic Global Drone, Skull Drone or GW008
They keep grinnin' at me...
Please Log in or Create an account to join the conversation.
15 Jan 2017 16:54 #57986
by goebish
Replied by goebish on topic Global Drone, Skull Drone or GW008
It would make a great addition to the top of my screens
Please Log in or Create an account to join the conversation.
16 Jan 2017 03:08 #58018
by Caerus
.... I'm not the only one that does that! I see 2 H8 mini's & a tiny whoop, but don't immediately recognize 1,3,4,5 & 7 from left to right. Do you mind naming them? I'm trying to find the best small/cheap multirotor's. I have no V2x2's for example. Unrelated, I know. I'll take it to RCGroups for a proper thread.
Replied by Caerus on topic Global Drone, Skull Drone or GW008
.... I'm not the only one that does that! I see 2 H8 mini's & a tiny whoop, but don't immediately recognize 1,3,4,5 & 7 from left to right. Do you mind naming them? I'm trying to find the best small/cheap multirotor's. I have no V2x2's for example. Unrelated, I know. I'll take it to RCGroups for a proper thread. Please Log in or Create an account to join the conversation.
09 Feb 2017 16:59 - 14 Feb 2017 05:11 #59003
by goebish
Replied by goebish on topic Global Drone, Skull Drone or GW008
I finally received the GW008 with "PAN" marking on the quad chip.
Unfortunately the RF is not compatible with Panchip XN297 ...
First I had a look with the SDR (HackRF+gnuradio), the Tx sends bind packets on 2402.2 MHz, this 200KHz offset might be a first issue if we have to emulate it with a nrf24l01.
... then I tried the usual tricks to try to capture some packets with a nrf24l01, but I only got noise.
Finally, I inspected the RF signal in inspectrum, looks like it's using 500kbps datarate, which the nrf24l01 can't do either, no wonder I only got noise.
...so I give up, nothing I can do for now. It might be possible to emulate it with the A7105 or CC2500, but I'm not sure and that would require a LOT of work (and, I forgot to tell, but the protocol is bi-directional), probably not worth it for only 1 protocol.
edit: it's using 1 Mbps bitrate actually, I've to learn how to make sense of inspectrum results
so there's still hope.
First I had a look with the SDR (HackRF+gnuradio), the Tx sends bind packets on 2402.2 MHz, this 200KHz offset might be a first issue if we have to emulate it with a nrf24l01.
... then I tried the usual tricks to try to capture some packets with a nrf24l01, but I only got noise.
Finally, I inspected the RF signal in inspectrum, looks like it's using 500kbps datarate, which the nrf24l01 can't do either, no wonder I only got noise.
...
edit: it's using 1 Mbps bitrate actually, I've to learn how to make sense of inspectrum results
so there's still hope. Please Log in or Create an account to join the conversation.
10 Feb 2017 15:08 - 10 Feb 2017 19:00 #59031
by goebish
Replied by goebish on topic Global Drone, Skull Drone or GW008
Haha, by using 0x710F55 as syncword instead of 0xC710F55, seems I get some data packets at 1 Mbps bitrate
The "peak" in data widget is the end of the syncword, then the address, then 3 (or 2 ?) moving bits which are probably a counter or ACK retry counter, then some data, then the CRC.
Frequencies (minus the 200 kHz offset):
- bind: 2402, bind stage exits only when quad is powered on, that either means ACK is enabled (this isn't implemented in the xn297 emulation layer yet
) or the quad sends back a normal packet, as the CX10 blue
- data: 2450, 2463, 2466, 2471 (yeah, I can see the bits changing while I move the sticks)
Now I'll try to make sense of that ...
The "peak" in data widget is the end of the syncword, then the address, then 3 (or 2 ?) moving bits which are probably a counter or ACK retry counter, then some data, then the CRC.
Frequencies (minus the 200 kHz offset):
- bind: 2402, bind stage exits only when quad is powered on, that either means ACK is enabled (this isn't implemented in the xn297 emulation layer yet
) or the quad sends back a normal packet, as the CX10 blue- data: 2450, 2463, 2466, 2471 (yeah, I can see the bits changing while I move the sticks
)Now I'll try to make sense of that ...
Please Log in or Create an account to join the conversation.
10 Feb 2017 15:14 #59033
by ajtank
Replied by ajtank on topic Global Drone, Skull Drone or GW008
Carry on Goebish, don't be beaten by that evil grin 
Please Log in or Create an account to join the conversation.
10 Feb 2017 23:46 - 11 Feb 2017 00:32 #59046
by goebish
Replied by goebish on topic Global Drone, Skull Drone or GW008
Some progress, I'm able to decode the address field (cc cc cc cc cc is very common):
Now, looks like the xn297L is used in enhanced mode packet format, with auto ACK (10 retries), I've to decode the 10 bit PCF and try to implement that, find which parts are bit reversed and scrambled, some bit shifting ... lots of fun
This is the first time I see a XN297 protocol that's using enhanced mode
I'm still not sure it can work, but I'll do my best.
Something is worrying me, I've not been able to receive packets with a nrf24l01, I wonder if this is because of this 200kHz shift ...
I hope it can work the other way round.
Now, looks like the xn297L is used in enhanced mode packet format, with auto ACK (10 retries), I've to decode the 10 bit PCF and try to implement that, find which parts are bit reversed and scrambled, some bit shifting ... lots of fun
This is the first time I see a XN297 protocol that's using enhanced mode
I'm still not sure it can work, but I'll do my best.
Something is worrying me, I've not been able to receive packets with a nrf24l01, I wonder if this is because of this 200kHz shift ...
I hope it can work the other way round.
Please Log in or Create an account to join the conversation.
14 Feb 2017 01:55 #59116
by goebish
Replied by goebish on topic Global Drone, Skull Drone or GW008
More progress, I have now as much information as if the SPI bus was exposed
Please Log in or Create an account to join the conversation.
Time to create page: 0.101 seconds
-
Home
-
Forum
-
Development
-
Protocol Development
- Global Drone, Skull Drone or GW008