WLToys Q303

I apologize! After swapping a discrete NRF24L01+ module it binds !!!! Throttle and Elev are working. Rudder and Aileron seem inverted. Camera gimbal is ok. Altitude hold seems ok too. I cannot take it out for a flight test so here are just some quick findings.
Good job Goebish you have made it !

Now I am thinking about swapping the chip on the 4-in-1 module but this tiny QFN seems a bit too challenging.

I just retested with several other modules:
the one from BG per your suggestion: ok
another three modules from 3 different Chinese sellers: ok
Sadly only the 4-in-1 does not work
I am not 100% sure if this is related to the chip itself or the layout of the 4-in-1, only can tell after I swap the genuine chip bought from Arrow USA.

New build is good. The left and right are now normal. Perhaps Seby can also try with his Devo 7e.
I shall speak to the 4-in-1 seller about the issue. I know it is not a scientific conclusion but the marking on the 4-in-1 chip is weird compared to the other working chips.
Are the E010 and Q303 the only known models using 250kbps?

I may not be able to capture the receiver so soon. Appreciate if Seby has time to help. FYI I now got the 3rd Q303 stock transmitter.

Is there a chance that there are several variants even for the fake chip? It makes me feel too lucky to have picked 3 good modules from 3 different Chinese sellers.
Looking further from your link I noticed the famous Si24R1
a) has incompatible NO_ACK bit
b) has higher transmit power output and hence higher current consumption

Is it possible for you to build me some quick Arduino sketches to test the modules? Well it is solely for my interest as I just started to learn a bit about programming.

If the fakes are mainly Si24R1 then the easiest way is to set the Tx to a constant carrier mode and check the power output and current consumption. Anyway it is just for interest.
It will bring more benefit to the community if the 4-in-1 seller can disclose what chip he has actually used.

The D7E build works fine for me too ...
with a BG standalond nRF24L01+ module

goebish wrote: The benefit he could bring would be to ensure he sources genuine Nordic ICs instead of trying to save 50 cents per module
Though we are just lucky that xn297 emulation works so well with a nrf24l01 because they're not strictly using the same modulation parameters, and they can't be changed on the nrf24l01 and clones.

There's already a patch in Deviation to fix the AA issue of those chips (not possible with every protocols tho), but for this other particular issue there's nothing much that I can do ...

I chatted with the seller and he denied the use of alternate chips to jeopardize his business. However he also could not be 100% sure that the chips he sourced were genuine or not. He is going to purchase a new batch of chips and test the YD717 protocol as reported here.

In the hackaday comment the Nordic employee said " The issue with the counterfeit devices is that when they enabled “Dynamic Payload Length” (EN_DPL) in the “FEATURE” register, one bit get’s activated in the on-air payload (the NO_ACK bit) This bit should be active high (according to the Nordic datasheet), but it’s actually implemented the other way around. When EN_DPL is activated, the NO_ACK bit get reversed in the real nRF-devices."

In the nRF23L01+ datasheet, "An ACK packet can contain an optional payload from PRX to PTX. In order to use this feature, the
Dynamic Payload Length (DPL) feature must be enabled. "

As far as I know none of the deviation nRF protocols return a payload in the ACK packets. So a possible workaround is to change those protocols to not enable DPL. The counterfeit chips may not behave as expected, but this might allow AA to work. No way for me to test this till next week.

Without a payload the auto-acknowledge really doesn't add anything to the protocols. After binding the only effect is to limit the range of the protocol. During binding it is nice to know for sure there's a quad out there responding, but probably not absolutely necessary. A more drastic workaround would be rework the protocols to eliminate AA.

I have replaced the chip on the 4-in-1 with a new one sourced from USA and it still cannot bind. Only separate NRF24L01 module can bind. Any other thoughts?

Yes, I tried this too. It can bind every quad I got except Q303.

I desoldered the USA chip off the 4-in-1 and mounted it on a separate module. It binds. This is really weird.