- Posts: 4402
MLINK protocol analysis, CRC ?
- PhracturedBlue
- Offline
Please Log in or Create an account to join the conversation.
- heligator
- Topic Author
- Offline
- Posts: 13
- inc-lsb-full: sweeps the LSB over the full range (and a bit more) from 0x800 to 0x8ff for the well known servo channels 4, 5, 7, 13
- inc-msb1: sweeps the MSB from 0x100 to 0xb00 (after this the LSB toggles from 00 to 01)
- inc-msb2: to continue it, sweeps the MSB from 0x900 to 0xf00
- inc-col1/2/3: sweep all servo channels that are in the same column
From time to time some bytes seem to get lost. Even the index counter gets out of sync after half a Megabyte or so.
Please Log in or Create an account to join the conversation.
- heligator
- Topic Author
- Offline
- Posts: 13
I have checked binding with a second TX. It looks like each TX has an individual DATA_CODE (DSSS "chip") and RF channel list (FHSS table). The DATA_CODE and channel list is sent during binding on RF channel one. Even in 'France mode' where only lower channels are used, the same channel list is transfered during binding. In binding data 'Fast response mode' and 'France mode' and can be recognized by some flag bytes.
During binding, I assume the RX stores the binding data. Multiple RX (without telemetry) can be bound to a single TX. When switched on (in normal mode), the TX simply broadcasts its data whether or not there are RX's.
Please Log in or Create an account to join the conversation.
- kreidler
- Offline
- Posts: 157
If you switch the Tx to 'Fast Response Mode' a Rx bound before will not work anymore. New bind is required.
How do you checked this issue with the DATA_CODE? Have you used an additional HFMG module or have you used a different Tx? The modules do have a different version numbering which might be transmitted. Besides the new SmartTX these are the actual firmware numbers:
- M-Link HF-Module HFMGx 0.41
- M-Link HF-Module HFM3 u. HFMx V2 0.43
- M-Link HF-Module HFM4 u. Cockpit SX 0.44
Yes, you can bind multiple RX to a single TX. MPX does not have a model match yet (but they have some kind of a patent for this feature).
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
Thanks heligator for the data it looks good. Now to see if I can actually make anything meaningful from it.
One note: your new format of writing the channel and index, doesn't actually work. It appears you are just counting as far as the index goes, but every once in a while you miss the channel change and then your index is wrong. The code I use to reformat the packets checks the channel sequence and finds and fixes this though, so it isn't an issue for me.
I think there is enough data now to figure out the algorithm. Now the question is whether I'm capable of actually doing it...
Please Log in or Create an account to join the conversation.
- heligator
- Topic Author
- Offline
- Posts: 13
Anyway, before implementing MLINK protocol the checksum issue needs to be resolved. If this checksum was intentionally implemented as a security feature to protect the MLINK protocol, it will be very hard to decode. Hope, that this was only meant to provide data integrity.
Please Log in or Create an account to join the conversation.
- th9xer
- Offline
- Posts: 18
www.deviationtx.com/forum/protocol-devel...cks-oh-wise-pb#20754
I'll leave it to the mods to sort my potential cross posting mess, sorry.
Cam.
Please Log in or Create an account to join the conversation.
- th9xer
- Offline
- Posts: 18
Will post the Perl script once it's had a bit more tweaking. At first glance it doesn't appear as though the relationship between the initial CRC register value and the RF channel number is a stationary one, any one channel seems to switch between two initial CRC register values.
Cam.
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
Please Log in or Create an account to join the conversation.
- th9xer
- Offline
- Posts: 18
In this case it's 3b:
01 07 91 07 91 07 91 -- 8a (3b-0001)
To input this into reveng rearrange it as 3b 01 07 91 07 91 07 91 8a so channel first, then the packet, then the checksum.
Off indoor flying now, will continue with the script and post it upon my return. It's a bit slow mind due to the many calls to reveng but quick enough not to warrant integrating the code of the script into reveng etc.
Cam.
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
It uses index rather than channel number, and I just mapped each index to the proper init value.
It uses the format I posted my data in
#!/usr/bin/perl
use strict;
use warnings;
use Digest::CRC qw(crc8);
my @map = (0xf1, 0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9, 0x19, 0x99, 0x59,
0xd9, 0x39, 0xb9, 0x79, 0xf9, 0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65,
0xe5, 0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5, 0x0d, 0x8d, 0x4d,
0xcd, 0x2d, 0xad, 0x6d, 0xed, 0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d,
0xfd, 0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3, 0x13, 0x93, 0x53,
0xd3, 0x33, 0xb3, 0x73, 0xf3, 0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b,
0xeb, 0x1b, 0x9b, 0x5b, 0xdb, 0x3b);
while(<>) {
chomp;
#my($chksum, $idx, $data, $chan) = (/^(..) -- (....): (.. .. .. .. .. .. ..) \((..)\)/);
my($data, $chksum, $chan, $idx) = (/^(.. .. .. .. .. .. ..) -- (..) \((..)\s*-\s*(....)/);
next if(! defined $idx);
my @vals = map {hex($_)} split(/ /, $data);
my $valstr = join("", map {chr($_)} @vals);
$chksum = hex($chksum);
$chan = hex($chan);
my $tstcrc = Digest::CRC::crc($valstr, 8, $map[$idx], 0, 1, 0x31, 1, 0);
printf "$data: %02x : %02x\n", $chksum, $tstcrc;
}
my @chan_order = (
21, 59, 35, 43, 9, 65, 33, 71, 7, 77, 9, 41, 31, 45, 19, 71, 15, 51, 33, 47, 11, 63,
17, 73, 13, 57, 39, 59, 3, 65, 13, 75, 5, 79, 5, 55, 23, 61, 31, 79, 37, 63, 11, 55,
23, 45, 3, 77, 25, 57, 19, 67, 37, 49, 27, 75, 15, 67, 17, 53, 35, 51, 29, 53, 7, 73,
41, 69, 29, 61, 27, 43, 21, 69, 25, 47, 39, 49);
Thanks th9xer!
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
crc -- index: data (chan#)
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
sub crc8_le {
my($_result, @d) = @_;
my $poly = 0x8c; #x^9 + x^5 + x^4 + 1
my $result = 0;
foreach (0 .. 7) {
$result = ($result << 1) | ($_result & 0x01);
$_result >>= 1;
}
foreach (@d) {
$result = $result ^ $_;
foreach my $j ( 0 .. 7) {
if($result & 0x01) {
$result = ($result >> 1) ^ $poly;
} else {
$result = $result >> 1;
}
}
}
return $result & 0xff;
}
Please Log in or Create an account to join the conversation.
- th9xer
- Offline
- Posts: 18
What did you use to generate the channel to init table, another little script ?
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
Please Log in or Create an account to join the conversation.
- th9xer
- Offline
- Posts: 18
So the data the CRC is calculated on doesn't include any channel or index reference then, the channel is just used to set the initial CRC register. I suppose including the channel data is irrelevant as it never changes given the window we are looking at, so including will just give a different init table.
Another one gets closer to biting the dust then.
Cam.
Please Log in or Create an account to join the conversation.
- heligator
- Topic Author
- Offline
- Posts: 13
In the next days I'm going to sort captured data and write down my insights in binding sequence and packet timing. For that we see the overall picture of this protocol, so we can implement it into Deviation.
Please Log in or Create an account to join the conversation.
- PhracturedBlue
- Offline
- Posts: 4402
Please Log in or Create an account to join the conversation.
- th9xer
- Offline
- Posts: 18
@heligator Thanks for the thanks, but yourself and PB are more to credit I think. I just stumbled across reveng and the rest was history, dumb Google luck.
Although it's use has passed attached is my perl script for the reference of others.
Cam.
Please Log in or Create an account to join the conversation.
- FriedSky
- Offline
- Posts: 15
heligator wrote: In the next days I'm going to sort captured data and write down my insights in binding sequence and packet timing. For that we see the overall picture of this protocol, so we can implement it into Deviation.
@heligator
Please can I ask which Tx / Rx setup you are using for your testing.
I have a Royal Pro 7 which i'm doing some multiprotocol stuff with ATM.
Please Log in or Create an account to join the conversation.
- Home
- Forum
- Development
- Protocol Development
- MLINK protocol analysis, CRC ?