Corona

Protocol decoding effort depends on several factors. I decoded several, and track development effort on many more, and in my opinion the hardest part is frequency hopping algorithm.

Packet structure is pretty straightforward to decode - record the SPI traffic while pulling the TX controls. Sometimes there are peculiarities - SLT packet, e.g. contains mixed bit width - 10-bit for mail channels, and 8-bit for 2 extra channels.

Frequency hopping can be of very varying difficulty - from table defined to pseudo-random number generator. The latter is the hardest as was encountered in DSMX case. It required efforts of a cryptographer to decode.

As Frsky algorithm is decoded (though it uses simplified pseudo-random algorithm) you can be lucky in it.

Also in my experience it makes more sense to connect your logic analyzer to receiver, not transmitter, because in this way you can see what channel the receiver anticipates the next packet and you can experiment with new TX ids not having dozens of actual transmitters.

Thanks vic.

I read Corona is fixed frequency without hopping, could this be correct?

It is sounding like a lot of work for little gain.

Bm

I don't know how popular is this Corona? If it is, may be it is reasonable. But yes, it is a lot of work.

Thanks FDR, good to know.

Bm

victzh wrote: I don't know how popular is this Corona? If it is, may be it is reasonable. But yes, it is a lot of work.

Not the most popular but i believe a lot of people use it and those that do usually have a few rx. I have at least 6.

I don't have a problem putting in the time, my biggest concern is do i have the skill? I think no, but with a little guidance and a lot of homework i may be able to do it.

I will get a bus pirate, could take 10 days to get here, and see how far i get.

Bm

Question

I can connect Corona module to Futaba, JR or Devo, which would be better when analyzing?

Bm

Edit: i would think Devo?

I have a Bus Pirate for sale if anyone is interested.

Can someone please tell me if Devo with stock firmware outputs ppm at trainer port?

TIA

Bm

corona

What is this? If you want us to analyze this, say so. If so, can you at least pass it through SPI filter so that the messages would be more sensible, and provide annotations about the circumstances: what did you trace - receiver or transmitter - is it from the very beginning or in the middle of the session, was it bound or not etc. etc.

see if this is better

victzh wrote: What is this? If you want us to analyze this, say so. If so, can you at least pass it through SPI filter so that the messages would be more sensible, and provide annotations about the circumstances: what did you trace - receiver or transmitter - is it from the very beginning or in the middle of the session, was it bound or not etc. etc.

This is what i have captured and analyzed with bus pirate, first attempt.

Will have to find out what spi filter is.

Trace is of rx after binding to tx, no sticks moving.

Bm

top of page

Any tips on what to do with this information would be most appreciated.

Bm

To trace a protocol you need a bit larger span. And something is not working in your connection with the device. Do you have graphical view, something like this: dumb.ro/lafront/screenshot1.png and can you verify that what you see resembles SPI - CSN goes down and up, SCK is active while CSN is down, the SPI decoder decodes it.

This trace is of rx powering up.

BP -> CC2500
MOSI -> pin20 SI
CLK -> pin1 SCLK
MISO -> pin2 SO
CS -> pin7 CSn

Are the grey lines in analysis errors?
They should be green white green white....?

i changed a setting and got this

The forum software reduces the pictures so I can not see clearly. The former one is too zoomed out to tell anything.

You should consult CC2500 datasheet, www.ti.com/lit/ds/swrs040c/swrs040c.pdf to see if what you're looking at resembles actual CC2500 commands. Section 10 describes the interface and Section 32 - registers.

Can this software (I worked with OLS long time ago) save SPI decoded trace in some text format?