WLToys Q303

WLToys Q303
-----------

XN297L, unscrambled, 250kbps, no AA, 1 way 
packet interval: 1500 µs

bind address: CC CC CC CC CC
bind channel: 0x02

                ID ID ID ID
bind packet: AA AE 89 97 87 00 00 00 00 00 

                 ID ID ID ID
data address: 55 AE 89 97 87

ID             RF Channels
AE 89 97 87    48 4A 4C 4E
RF[i] = 0x46 + i*2 + (ID[0] & 3)

             00 01 02 03 04 05 06 07 08 09
data packet: 55 7D 1F 40 01 EE 10 10 03 40

channels: 0-1000, 10 bits, packed into 5 bytes
struct channels
{
    uint aileron:10;
    uint elevator:10;
    uint throttle:10;
    uint rudder:10;
}__attribute__((packed));

00:  0x55
01:    aileron >> 2             // 8 bits
02:   (aileron & 0x03) << 6     // 2 bits
    | (elevator >> 4)           // 6 bits
03:   (elevator & 0x0f) << 4    // 4 bits
    | (throttle >> 6)           // 4 bits
04:   (throttle & 0x3f) << 2    // 6 bits 
    | (rudder >> 8)             // 2 bits
05:    rudder & 0xff            // 8 bits
06:  0x10 // trim(s) ?
07:  0x10 // trim(s) ?
08:   0x03 = high rate (0-3)
    | 0x40 = altitude hold
    | 0x80 = RTH
09:   0x40 // always set
    | 0x20 = gimbal up
    | 0x04 = gimbal down
    | 0x08 = headless
    | 0x80 = flip
    | 0x10 = snapshot
    | 0x01 = video

Cheerson CX35
-------------
Almost same protocol, except scrambled, 1Mbps bitrate, 3000µs packet interval and different flags
ID: 24 37 46 89    RF: 14 17 1A 1D 
RF[i] = 0x14 + i*3 + (ID[0] & 3) // to be checked