New SYMA protocol

SeByDocKy
Topic Author
Offline

01 Feb 2014 07:42 #19577 by SeByDocKy

New SYMA protocol was created by SeByDocKy

Hi,

SYMA just lunched some quads (X3, X4, X5C, X6 and X7). I got the new SYMA X4 in hand and unfortunatly, the RF chip is hidden behind a protection paste. Whatever I did some photos on both the TX and RX. Maybe the number of pins of the package, the associated quartz could help indirectly to indentify it ?. and I hope is one of the four RF chip supported by deviationx

Please Log in or Create an account to join the conversation.

cstratton
Offline

01 Feb 2014 09:29 - 01 Feb 2014 09:30 #19579 by cstratton

Replied by cstratton on topic New SYMA protocol

I'd suspect the Bekin or Hope RFM73 devices which are interopetable with NRF24L01 but have additional registers.

The vertically mounted TX module should be easy to solder logic analyzer taps to, for chipset verification and protocol investigation.

You may want to see the yd717 and udi816 threads for background on the chipset, though the protocol may or may not have any similarities to either.

Last edit: 01 Feb 2014 09:30 by cstratton.

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 09:55 #19580 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

cstratton wrote: I'd suspect the Bekin or Hope RFM73 devices which are interopetable with NRF24L01 but have additional registers.

The vertically mounted TX module should be easy to solder logic analyzer taps to, for chipset verification and protocol investigation.

You may want to see the yd717 and udi816 threads for background on the chipset, though the protocol may or may not have any similarities to either.

I bought recently a logic analyser but I never used yet. So I can probably extract some log but I need some advices/help. For example, do I need to sniff both TX and RX part simultanously ? If I understand I need to in GND, VDD, CE, MOSI, SCK, CSN ? I am right ?

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 10:00 - 01 Feb 2014 10:23 #19581 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

cstratton wrote: I'd suspect the Bekin or Hope RFM73 devices which are interopetable with NRF24L01 but have additional registers.

I think you are right and I guess it's more the Hope RFM73... I am reading the datasheet now and I see the 8 pins connections I observed on the daughter RX board of the SYMA X4

www.hoperf.com/upload/rf/RFM73_Datasheet.pdf

EDIT... On the datasheet, the quartz need to be at 30Mhz... but in features they mentionning also 16 Mhz (p1) ....

Last edit: 01 Feb 2014 10:23 by SeByDocKy.

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 12:12 #19585 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

I took a photo of the backside of the TX. The red part is the RF daughter board which is connected to the main TX board. I guess, I have to plug logic analyser there

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 14:10 #19587 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

I plugged on pins 1 & 2 on the RX chip and I measured 2.90V so it's seems to be the GND and VDD pins respectively of the RFM73 chip. So pins connextion information in this case is given by the section 3 (p6) of the datasheet

Please Log in or Create an account to join the conversation.

cstratton
Offline

01 Feb 2014 14:19 #19588 by cstratton

Replied by cstratton on topic New SYMA protocol

Unless you measured with a time domain instrument such as a scope, or followed the traces, I'd be hesitant to jump to the conclusion that you have the power, and not an average value of a signal.

But a logic analyzer, or at minimum some kind of unidirectional SPI capture rig, will be needed in the next step anyway.

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 15:56 #19589 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

Ok,

I soldered some small wires to each of the 7 pins in order to plug my logic analyser....

Do I need to plug the VDD pin in one of the saleae channel ?

Please Log in or Create an account to join the conversation.

cstratton
Offline

01 Feb 2014 15:59 #19590 by cstratton

Replied by cstratton on topic New SYMA protocol

Not if you are sure it is the Vdd. But connecting everything would be a way to find out.

You do need a ground connection to the actual ground - but can probably verify that back to the battery.

Please Log in or Create an account to join the conversation.

hexfet
Offline

01 Feb 2014 16:13 #19591 by hexfet

Replied by hexfet on topic New SYMA protocol

That is the same module I pulled out of the YD717 transmitter. Pinout is here .

It's either a Beken 2421 or Hope RF73. The datasheets are identical - even the chip id number.

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 16:45 #19596 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

cstratton wrote: Not if you are sure it is the Vdd. But connecting everything would be a way to find out.

You do need a ground connection to the actual ground - but can probably verify that back to the battery.

Well I am measuring +3.4V volt on those 2 pins ... but I will double check the ground pin with the battery one

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 16:46 #19597 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

hexfet wrote: That is the same module I pulled out of the YD717 transmitter. Pinout is here .

It's either a Beken 2421 or Hope RF73. The datasheets are identical - even the chip id number.

Yes your pinout seems to be identical... to the one I am faced

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 17:00 #19601 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

Ok I checked the GND pin with the battery pole and it's ok, it's the good one

Here is my logic analyser (a chinese copy). I didn't installed yet the software but I guess I need to connect channel 1 to GND and the other ones to CH2, CH3 etc .... (except CH8). I am right ?

Please Log in or Create an account to join the conversation.

rbe2012
Offline
So much to do, so little time...

01 Feb 2014 19:18 #19610 by rbe2012

Replied by rbe2012 on topic New SYMA protocol

I am not sure if ch1 has its own ground - but it would surprise me. My own logic analyzer looks quite as yours and the two pins labeled with GND are connected internally. So I would try to connect GND to the ground and the signals to chX. To exclude that I am wrong you could use ch2-8 and the GND not belonging to ch1.

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 20:36 #19623 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

rbe2012 wrote: I am not sure if ch1 has its own ground - but it would surprise me. My own logic analyzer looks quite as yours and the two pins labeled with GND are connected internally. So I would try to connect GND to the ground and the signals to chX. To exclude that I am wrong you could use ch2-8 and the GND not belonging to ch1.

I connected the GND of the TX to 1 of the two GND pins of the analyser. I plugged all other TX pin (5 left) to channel 1 to 5 of the analyser (displayed channel 0 to 4 on software.

Channel 0 = CE
Channel 1 = CSN
Channel 2 = MOSI
Channel 3 = SCK
Channel 4 = MISO

Now it's the first time, I am using the saleae 1.1.18. I choosed 16Mhz as simpling rate(since the quartz is 16 Mhz) and by default 1M of sample are retrieved.

I selected 250M of sample to be sure to see everything ....
I start first the quad... then start sampling then start the TX, arm the
the quad (up and down throtle stick) and that give a throttle

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 20:43 - 01 Feb 2014 20:53 #19624 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

Ok I save a firt CSV file ....

Hope some specialist can understand this file ...

EDIT ... Can't upload a file of 1.45M

Last edit: 01 Feb 2014 20:53 by SeByDocKy.

Please Log in or Create an account to join the conversation.

PhracturedBlue
Offline

01 Feb 2014 20:59 - 01 Feb 2014 21:02 #19626 by PhracturedBlue

Replied by PhracturedBlue on topic New SYMA protocol

No you can't. zip it up 1st. Ifit still doesn't fit, post it somewhere like dropbox and provide a link.

With Saleae it is best to setup a SPI analyzyer and then write that out

press '+' on 'Analyzers' (at the right)
Select SPI
Select the proper channels

then you should see hex values above each transaction.
you can now click the gear on 'SPI' and Export the values.

From your screenshot, I think something is wrong. Channel 2 could be clock or data, but there isn't enough going on on any other channel to make me think you have both. in that case, saving your Saleae session and zippingthat up would probably be better than the CSV file.

Last edit: 01 Feb 2014 21:02 by PhracturedBlue.

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 21:24 #19629 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

Ok,

I tried to relabel channels as you explained to me ... Hope it's ok

Here is a link of 500M of samples

www.wetransfer.com/downloads/cde223c42f4...0140201212121/c163f3

Please Log in or Create an account to join the conversation.

PhracturedBlue
Offline

01 Feb 2014 21:36 #19632 by PhracturedBlue

Replied by PhracturedBlue on topic New SYMA protocol

Can you provide the salea session file (Options->Save Session) It is a lot easier to quickly look at that way then to be stuck using csv.

Please Log in or Create an account to join the conversation.

SeByDocKy
Topic Author
Offline

01 Feb 2014 21:38 #19633 by SeByDocKy

Replied by SeByDocKy on topic New SYMA protocol

PhracturedBlue wrote: Can you provide the salea session file (Options->Save Session) It is a lot easier to quickly look at that way then to be stuck using csv.

Oops sorry

Here the zipped session

www.wetransfer.com/downloads/e0974d8a928...0140201213706/6b189c

Please Log in or Create an account to join the conversation.

Time to create page: 0.225 seconds

Force desktop display

New SYMA protocol

Attachments:

Attachments:

Attachments:

Attachments:

Attachments: