which is MJX use protocol ?

hello coders

helicopter MJX currently developing quite fast and stable, but I want to replace the TX of it because the design is not good

I do not know which protocol is used MJX ? Flysky A7105 nRF24L01 , cc2500 ... maybe are not them

please help me . please

Maybe nobody knows? Maybe you've better to ask to MJX ( www.mjxtoys.com/contact.asp ).

thank domcar
I detected it use xtal 26mhz .I guess is cc2500 , because i see pin xtal is 8 and 10 .

Maybe protocol CC2500

You're confusing radio chip with protocol. Several different models can have same RF chip but different protocols. So if RF chip is CC2500 it does not mean that the protocol for the model is available.

Actually there is no documentation either, just the fact that something has changed.
The documentation (i.e. the user manual) is refreshed only on official releases...

cc2500 of skytec protocol, someone try use for mjx ?

I have sniffed some SPI traffic on a broken MJX F45 - the init sequence at bootup is for Beken BK2421, it looks just like deviationtx code (v202_init() in file protocol/v202_nrf24l01.c) - I think this is the init sequence shown in the datasheet, though I'm not absolutely sure about that.

I haven't digged too deep into the format, but payload looks like this:First one is sync code, last one is Checksum.

Channel hopping sequence (this is programmed using cmd 25 xx after receiving/sending)(and restarts over)

I was not able to capture anything meaningful of the pairing sequence due to my cheapo Scana Logic, which has really limited RAM onboard.

Not too sure if that helps, but anyone more firm with the protocols should be able to figure out which protocol it can be, and which ones are ruled out by this.

Note that I'll get a much better logic analyzer around christmas (I hope) and I have the old RX board here (logic part okay, motors won't start) for further testing.

Buy a Saleae clone, they're nothing more that Cypress CY7C68013A with some discretes, so they're extremely cheap.

I doubt that the first one is a sync code, underlying packet structure of nRF24L01 does not require such code. It can be some semi-static flags, e.g. V202 passes different flags during binding and if you press extra buttons on TX.

Also, somewhere there is a TX id. It can be inside the packet, or can be just the address used by nRF24L01. In the latter case there should be a separate address for binding.

Frequency hopping depends on TX id, so you need to decipher it as well.

On a second thought, I took a look at the following things - packet size, frequency hopping length, packet typical layout - these telling 40 40 40 and 00 00 00 bytes. It is V202, with modified frequency hopping generation. Your TX id is most probably 0x43, 0x3A, 0x01. Take a look at V202 protocol's sent_packet function. Layout is the same as yours.

To figure out the correspondence between TX id and frequency hopping sequence you need to use the transmitter program modified to gather this information - it should reset the receiver, switch to new TX id, issue binding packets and logic analyzer should trace what frequencies this TX id makes the receiver to listen to. I used an Arduino code for this, if you want it, you can have it.

@btoschi, how's the progress? Need help?

Hi,

I was away last week and still waiting for my new logic analyzer.
Also I need to lend the MJX's TX from my colleague as I sniffed traffic when repairing it (actually the RX board had to be replaced - seems FETs or something were broken, at least motors did not spin up and servoes did not react after binding, even though MCU did work fine and servoes DID move on init. Strange thing, new board fixed that). Besides that my kids are keeping me busy, thus it will take some time to advance.

Still have the damaged RX board, so I won't need the heli itself, but unless I know how to bind I'll need the original TX (also checking eBay, but that takes a while...)

Do you know whether I can use a nRF board for testing (have two of them for arduino fun) or if I need to buy a Beken board for that?

Arduino code would be great, as that saves me time I'd spent on bugfixing my code

Check out bitbucket.org/rivig/v202 , it a code for real controller, which I used when reversed V202. It reads 4 analog signals - 4 sticks. It is a base setup of what I usually do with new protocol (so far I've done 2 totally myself - V202 and SLT, and Esky and Hisky I am bringing to shape). I also modify this code if I need to find out the frequency hopping pattern. I created a separate repo for it: bitbucket.org/rivig/tactic_slt which contains similar SPI decoding scripts, the TX code, and the sniffer. The sniffer requires some programmable logic, but it is not relevant for this protocol - I mainly shared it so you can use the structure, not the specific sniffing part.

Beken and nRF are more or less equivalent, you can use either. The code I wrote for Arduino shows how to test for and initialize a Beken.

Hello bitoschi

Mean is F45 used modul 2.4ghz BK2421 ?


when you complete, you can share few picture here ? I want use arduino to control PPM .
thanks

hi betoshi

can you answer me ?

Hard to tell. As far as I can tell gathering it from various sourcces, MJX changed their protocol from nRF24L01 (Beken is a clone of it) to CC2500. But may be I'm wrong, as I don't have any MJX models, can't tell first hand.

Hi all,
sorry, I'm quiet busy right now.
Job is demanding, so are the kids

I've won a MJX F45 TX on eBay for some bucks and waiting for it to arrive, which will let me dig into the bind sequence when I have some spare time left.

I can definately confirm that F645 TX/RX revision 3 does use Beken chip as I have sniffed SPI traffic on both ends when I had TX and heli here, and the init sequence is for Beken (plus it has CE pin). Not too sure about older revision TX/RX as I had heard that these are not compatible, but that may be even the case with a slightly modified bind sequence with same RF chip ...

I have (possibly interesting) Photographs of some RX/TX units plus analysis of the hardware for some RC models, which I'd like to share sometime, though I don't know where to upload and where to share (Many are not too useful for this forum as they are WiFi, or even custom 2.4Ghz protocol using a special SoC for communication on both ends...).

Regarding CC2500 - it seems that's the chip used with the old protocol (F45 V1, X100) - one can see 26MHz xtals on these RF boards (just google for images). All newer models (F45 V2,V3, F46, F47, F48, ...) seem to be using the new BK2421 based protocol (tells the internet, not confirmed).

www.topstoys.com/mjx-f45019-receiver-pcb...ersion-2-p-3554.html

john wrote: www.topstoys.com/mjx-f45019-receiver-pcb...ersion-2-p-3554.html

No, these boards are not 2.4GHz ones. 2.4GHz RF chip is a small QFN - Quad Flat No leads, any of them - CC2500, nRF24L01 etc.