Star Trek Air Hogs

Hi Guys,
One of my friend has purchased an Air Hogs Star Trek. He asked me to look at the remote.
All chips are under epoxy so no way to know what they are.
The SPI bus is accessible so I've made a couple of dumps. Here is a power up with RX on: drive.google.com/file/d/1nTalIYr6mgkvVaB...xOY/view?usp=sharing
The registers used while transmitting/receiving look compatible with the nrf24l01 but some of the registers used during init are not. They do not match either xn297 or xn297l datasheets.
I've tried to listen with the nrf on the TX address without luck, same if I use the XN297 and XN297L preambules...
If you have any ideas please shoot.
Thanks, Pascal

Haven't seen that before. The nRF24L01 datasheet includes the note "Addresses 18 to 1B are reserved for test purposes, altering them will make the chip malfunction.", though the capture shows writes to 1F also. Maybe try the nRF24L01 with those register accesses left in? I've not seen a real nRF under epoxy though.

I've made some progress.
Despite what's being written in the registers the speed is 250k and the 5 bytes address is sent in clear text. I'm able to receive the packets using the nrf24l01.
But the payload has an overlay. So far we've seen xor being applied so I'll try the same approach and see if it does work over multiple different packets.
Pascal

Here is the xor out table for the 14 bytes being transmitted: 0x80, 0x44, 0x64, 0x75, 0x6C, 0x71, 0x2A, 0x36, 0x7C, 0xF1, 0x6E, 0x52, 0x09, 0x9D .

The CRC has the std polynome with an init set to 0. It is calculated on the xored payload then the crc value is xored (0x60DE) and appended at the end of the payload ready to be sent over the air.
I should now be able to send data to the quad. I hope the xor table is the same ie independant of the payload length since the quad sends 11 bytes and not 14 bytes (TX).
Pascal

By the way, I've figured out the speed and sync word using SDR.
I've decided to do this protocol before the v911s since the packet structure was already known so easier to get in this world.
Pascal

Protocol available on multi: github.com/pascallanger/DIY-Multiprotoco...NCC1701_nrf24l01.ino
9 TX IDs are available in the code. The RX is using a pseudo random ID as well so not a big deal...

Enjoy, Pascal

I've added "Wrap" on CH5. I don't know what it really does apart from dimming the lights...
I've also added crash detection through the telemetry. On ersky9X/OpentTX you can play a sound on a telemetry event which is a siren on the original TX.
Pascal

Sorry, I forgot to check the TX and RX IDs while processing incoming packets... You should update your code...
Pascal

Es gibt ja von Air Hogs noch mehr Star Trek Modelle ausser die Enterprise.

Würde das Protokoll NCC1701 auch mit anderen Modellen von Air Hogs funktionieren oder nicht??


Air Hogs has even more Star Trek models than the Enterprise.

Would the NCC1701 protocol also work with other Air Hog models or not?

No idea. I only had access to the NCC1701...