Volantex V761-1 Firestar Mini protocol

XN297L, 1 Mbps, scrambled, no auto ack, no enhanced packet mode, tx only

bind (~3 seconds)
----
packet period: 15730 us
address: 34 43 10 10
freq: 0x28 
every 20 packets, frequency is set to 0x14 and address to the one in the first packets for 20 packets

packet:
00 01 02 03 04 05 06 07
6f 2c b1 93 1e 4b b7 b7

00: data address [0]
01: data address [1]
02: data address [2]
03: data address [3]
04: data freq [1]
05: data freq [2]
06: checksum ?, or 0xf0 when freq==0x14
07: checksum ? 

data
----
packet period: 7060 us
address: sent during bind
hops through 3 frequencies:
freq[0] = 0x14 // always same as one of bind freq ?
freq[1]&[2]: sent during bind

packet:
00 01 02 03 04 05 06 07
00 3E 3F 3F 20 C8 80 DB

00: throttle 0x00-0xfe
01: rudder 0x00-0x3f-0x79 (0x00-0x3f-0x7f ?)
02: elevator 0x00-0x3f-0x7f
03: 0x3f, fixed, aileron for 4ch craft ?
04: 0x20 or 0x1a *
05: 0x00 or 0x40 or 0x80 or 0xc0 *
    | 0x08 : beginner mode
    | 0x0a : mid mode
    | 0x0c : expert mode
06: 0x80, fixed
07: checksum ?

* add 0x40 to [5] every 3 packets, if [5]==0x4X then [4]=0x1A else [4]=0x20

unknowns:
- where does 0x14 frequency come from ? Is it a constant or calculated from txid or other channels ?
- what is 0xf0 in packet[6] during bind ?