Traxxas ALIAS

victzh. Can you post spi traces? Working with the CYRF is pretty easy. Throwing something together shouldn't be too hard. I can take a crack at it if you don't have time.

I couldn't work on it this weekend anyway, so no real rush. But it sounds pretty straight forward to implement from what you've said so far.

Yeah, the CYRF is different than any of the other modules in how encryption is typically done.
The SOP code and CRC seed are typically used (in conjunction with the channel). In the Devo protocol the data itself is also encrypted, but that really doesn't help much.

How does binding work with the TRAXXAS? Do you need to bind every time, or do you bind once and have it remember? Does the Tx wait for the Rx to become available before starting transmission?

Looking at the data you sent There are 2 channel configurations:

Channel 0x15 is used for Rx, 0x1a is used for Tx

CHANNEL 0x15: CRC=0x616a, SOP=dd 26 7c 50 66 cd 7c 50
CHANNEL 0x1a: CRC=0x2828, SPO=e2 f8 cc 91 3c 37 cc 91

The Rx reads the MFGID before doing anything, so it is likely that it is used for generation of at least some of the above parameters. In your case the MFGID is: e8 35 8f ae 67 fe

Before binding, we see that the Receiver sends:
03 e8 35 8f ae 67 fe 0e 00 01 02 00 01 0b 00 00 (which includes the MFGID)
Once it receives a packet back:
0b ff 07 ff 07 ff 07 ff 00 00 01 0a 7f 00 7f 7f
0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b
It transmits this:
04 02 00 01 0b 00 0a 07 10 00 00 00 01 0b 00 00

I believe that probably completes the handshake. Once that is finished, all communication happens entirely on channel 0x15
It then receives:
07 ff 07 ff 07 ff 07 ff 00 00 13 14 7f 00 7f 7f
07 07 07 07 07 07 07 07 07 07 07 07 07 07 07 07
And responds with the following which is likely temlemetry:
07 00 0a 06 10 01 00 00 00 00 00 00 00 00 00 00

CRC and SOP don't change for a given channel.

While we don't have a lot of information here, this protocol does not seem to use a key-hopping scheme (like DSM*). But we'll need a lot more info to be able to do much more.

Specifically, we'd want to see the Tx setup. what is the Tx MFGID?
Then it will likely be a case of emulating the Tx (or Rx) with the Devo radio/arduino and sending different packets during the binding phase, and see how the Tx/Rx respond.