- Posts: 109
New WLToys Protocol V977
- phantom8
- Topic Author
- Offline
Any gurus interested in getting one and add deviation support for it? The V977 costs around $100, while other models are cheaper. I'm planning to buy a V977. I can also buy a Saleae 16 and perform data logging if it helps.
Please Log in or Create an account to join the conversation.
- SeByDocKy
- Offline
- Posts: 1016
phantom8 wrote: I can also buy a Saleae 16 and perform data logging if it helps.
I think it's the best option. I am feeling that this new protocol is a variation of either the V2x2 or the Hisky. I am sure that victzh can hack it very fast if you can sniff SPI via salae log
Please Log in or Create an account to join the conversation.
- victzh
- Offline
- Posts: 1386
GND, VCC, CE, CSN, SCK, MOSI, MISO, IRQ
We're interested only in GND (obvious), CSN, SCK, MOSI, and MISO.
So if they did not use any nasty tricks, it seems very realistic.
BTW, what is the difference between all these new models? With this numbering scheme it is very hard to tell who's brushless, who's bigger (and what size exactly).
Please Log in or Create an account to join the conversation.
- victzh
- Offline
- Posts: 1386
www.rcgroups.com/forums/showthread.php?t=2068827
Please Log in or Create an account to join the conversation.
- phantom8
- Topic Author
- Offline
- Posts: 109
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
I've never had a need for more than 8 pins when doing SPI for RC protocols. 8-pins willallow you to snoop both ends of an SPI bus at once if needed (though you'd miss the CE pin, which is generally not an issue).
Nothing wrong with a Salea16, but it is overkill for SPI work. On the other hand, the ability to capture very long samples (minutes worth) is really valuable, and makes the Salea design superior to a trigger/sample based system.
Please Log in or Create an account to join the conversation.
- victzh
- Offline
- Posts: 1386
You should be able to buy or borrow a second transmitter (at least, the more the merrier) to watch the differences in packets.
You will need to mock up the TX part of the protocol in controllable environment where you need to modify the implementation fast and possibly add feedback from the RX (I needed it once, but there was almost no way around). PB uses Raspberry PI based setup, I use Arduino - both have faster turnaround than Devo and can be connected easily to other hardware.
Saleae16 is definitely an overkill for SPI, I agree with PB.
Please Log in or Create an account to join the conversation.
- phantom8
- Topic Author
- Offline
- Posts: 109
@victzh, I do have several Arduino boards. I was using them for home automation and still have a couple spare. I may need your help to set it up tough. Is the 2nd transmitter a must for protocol implementation? I only got one and don't know anyone around has another.
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
Examples:
Devo: required a few transmitters due to variations between the 6/8/10 (this is the 1st one we did, so we probably could have gotten by without it if we knew more)
DSM: required multiple transmitters and multiple Rx to figure out the challenge/response
J6Pro: only needed one transmitter
Flysky: required multiple tx to determine robust txid and frequency hopping
Hubsan: only needed one tx. A 2nd was used for confirmation though
Frsky1/2: Only needed one tx (though it isn't actually done yet)
Skyartec: Only needed one Tx
Please Log in or Create an account to join the conversation.
- victzh
- Offline
- Posts: 1386
Initial implementation can be done with one TX definitely - you just replicate TX id/frequency hopping sequence (if any) from the TX you've got. So yes, it worth trying anyway!
Also, people developing these protocols copy each other, so many parts can be resolved by educated guess - comparing with the past.
I think that in currently implemented protocols there are all the tricks they have. You can devise, e.g. encoded protocol, but they try to save on models and model MCU does not have the space or the power to decode cryptographycally strong protocols.
Please Log in or Create an account to join the conversation.
- phantom8
- Topic Author
- Offline
- Posts: 109
Please Log in or Create an account to join the conversation.
- victzh
- Offline
- Posts: 1386
I can solder to such chips, I soldered once when there was a 2mm gap between RF chip and MCU. It took me several attempts of 2-4 hours each - I don't have special equipment, just FX-888 soldering iron and binocular magnifying glasses.
It's unpleasant, but is not required for the first step.
If you plan to enjoy V977 anyways it definitely worth a try to reverse it from the transmitter side first.
There is also a chance that the protocol is a variation of already existing one and this will be enough.
Please Log in or Create an account to join the conversation.
- phantom8
- Topic Author
- Offline
- Posts: 109
Please Log in or Create an account to join the conversation.
- victzh
- Offline
- Posts: 1386
Please Log in or Create an account to join the conversation.
- SeByDocKy
- Offline
- Posts: 1016
www.banggood.com/WLtoys-V966-V977-6CH-He...mitter-p-922666.html
Please Log in or Create an account to join the conversation.
- joeclone
- Offline
- Posts: 98
Please Log in or Create an account to join the conversation.
- SeByDocKy
- Offline
- Posts: 1016
joeclone wrote: Hey Victzh, Banggood has agreed to send you a V977 to do protocol cracking to work with Deviation, please keep us updated on how it goes.
Nice attitude from Jacky Thanks to him
Please Log in or Create an account to join the conversation.
- phantom8
- Topic Author
- Offline
- Posts: 109
joeclone wrote: Hey Victzh, Banggood has agreed to send you a V977 to do protocol cracking to work with Deviation, please keep us updated on how it goes.
That's great news. It should make cracking the protocol much easier. I've received the V977, but still waiting for the Saleae to arrive.
Please Log in or Create an account to join the conversation.
- victzh
- Offline
- Posts: 1386
The more reverse engineers, the merrier.
Please Log in or Create an account to join the conversation.
- SeByDocKy
- Offline
- Posts: 1016
victzh wrote: I'll definitely try hard, but it is often a collaborative effort - no one still knows what surprises we will face. For instance, I still can not recognize the signal of RCLogger's last Eye One Xtreme - it looks like SPI, but they use very weird version.
The more reverse engineers, the merrier.
You should male some YT tutorial
Please Log in or Create an account to join the conversation.
- Home
- Forum
- Development
- Protocol Development
- New WLToys Protocol V977