New SYMA protocol

More
01 Feb 2014 07:42 #19577 by SeByDocKy
New SYMA protocol was created by SeByDocKy
Hi,

SYMA just lunched some quads (X3, X4, X5C, X6 and X7). I got the new SYMA X4 in hand and unfortunatly, the RF chip is hidden behind a protection paste. Whatever I did some photos on both the TX and RX. Maybe the number of pins of the package, the associated quartz could help indirectly to indentify it ?. and I hope is one of the four RF chip supported by deviationx










Please Log in or Create an account to join the conversation.

More
01 Feb 2014 09:29 - 01 Feb 2014 09:30 #19579 by cstratton
Replied by cstratton on topic New SYMA protocol
I'd suspect the Bekin or Hope RFM73 devices which are interopetable with NRF24L01 but have additional registers.

The vertically mounted TX module should be easy to solder logic analyzer taps to, for chipset verification and protocol investigation.

You may want to see the yd717 and udi816 threads for background on the chipset, though the protocol may or may not have any similarities to either.
Last edit: 01 Feb 2014 09:30 by cstratton.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 09:55 #19580 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol

cstratton wrote: I'd suspect the Bekin or Hope RFM73 devices which are interopetable with NRF24L01 but have additional registers.

The vertically mounted TX module should be easy to solder logic analyzer taps to, for chipset verification and protocol investigation.

You may want to see the yd717 and udi816 threads for background on the chipset, though the protocol may or may not have any similarities to either.


I bought recently a logic analyser but I never used yet. So I can probably extract some log but I need some advices/help. For example, do I need to sniff both TX and RX part simultanously ? If I understand I need to in GND, VDD, CE, MOSI, SCK, CSN ? I am right ?

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 10:00 - 01 Feb 2014 10:23 #19581 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol

cstratton wrote: I'd suspect the Bekin or Hope RFM73 devices which are interopetable with NRF24L01 but have additional registers.



I think you are right and I guess it's more the Hope RFM73... I am reading the datasheet now and I see the 8 pins connections I observed on the daughter RX board of the SYMA X4 :)

www.hoperf.com/upload/rf/RFM73_Datasheet.pdf

EDIT... On the datasheet, the quartz need to be at 30Mhz... but in features they mentionning also 16 Mhz (p1) ....
Last edit: 01 Feb 2014 10:23 by SeByDocKy.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 12:12 #19585 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol
I took a photo of the backside of the TX. The red part is the RF daughter board which is connected to the main TX board. I guess, I have to plug logic analyser there
Attachments:

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 14:10 #19587 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol
I plugged on pins 1 & 2 on the RX chip and I measured 2.90V so it's seems to be the GND and VDD pins respectively of the RFM73 chip. So pins connextion information in this case is given by the section 3 (p6) of the datasheet

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 14:19 #19588 by cstratton
Replied by cstratton on topic New SYMA protocol
Unless you measured with a time domain instrument such as a scope, or followed the traces, I'd be hesitant to jump to the conclusion that you have the power, and not an average value of a signal.

But a logic analyzer, or at minimum some kind of unidirectional SPI capture rig, will be needed in the next step anyway.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 15:56 #19589 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol
Ok,

I soldered some small wires to each of the 7 pins in order to plug my logic analyser....



Do I need to plug the VDD pin in one of the saleae channel ?
Attachments:

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 15:59 #19590 by cstratton
Replied by cstratton on topic New SYMA protocol
Not if you are sure it is the Vdd. But connecting everything would be a way to find out.

You do need a ground connection to the actual ground - but can probably verify that back to the battery.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 16:13 #19591 by hexfet
Replied by hexfet on topic New SYMA protocol
That is the same module I pulled out of the YD717 transmitter. Pinout is here .

It's either a Beken 2421 or Hope RF73. The datasheets are identical - even the chip id number.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 16:45 #19596 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol

cstratton wrote: Not if you are sure it is the Vdd. But connecting everything would be a way to find out.

You do need a ground connection to the actual ground - but can probably verify that back to the battery.


Well I am measuring +3.4V volt on those 2 pins ... but I will double check the ground pin with the battery one

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 16:46 #19597 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol

hexfet wrote: That is the same module I pulled out of the YD717 transmitter. Pinout is here .

It's either a Beken 2421 or Hope RF73. The datasheets are identical - even the chip id number.


Yes your pinout seems to be identical... to the one I am faced

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 17:00 #19601 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol
Ok I checked the GND pin with the battery pole and it's ok, it's the good one







Here is my logic analyser (a chinese copy). I didn't installed yet the software but I guess I need to connect channel 1 to GND and the other ones to CH2, CH3 etc .... (except CH8). I am right ?
Attachments:

Please Log in or Create an account to join the conversation.

  • rbe2012
  • rbe2012's Avatar
  • Offline
  • So much to do, so little time...
More
01 Feb 2014 19:18 #19610 by rbe2012
Replied by rbe2012 on topic New SYMA protocol
I am not sure if ch1 has its own ground - but it would surprise me. My own logic analyzer looks quite as yours and the two pins labeled with GND are connected internally. So I would try to connect GND to the ground and the signals to chX. To exclude that I am wrong you could use ch2-8 and the GND not belonging to ch1.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 20:36 #19623 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol

rbe2012 wrote: I am not sure if ch1 has its own ground - but it would surprise me. My own logic analyzer looks quite as yours and the two pins labeled with GND are connected internally. So I would try to connect GND to the ground and the signals to chX. To exclude that I am wrong you could use ch2-8 and the GND not belonging to ch1.


I connected the GND of the TX to 1 of the two GND pins of the analyser. I plugged all other TX pin (5 left) to channel 1 to 5 of the analyser (displayed channel 0 to 4 on software.

Channel 0 = CE
Channel 1 = CSN
Channel 2 = MOSI
Channel 3 = SCK
Channel 4 = MISO


Now it's the first time, I am using the saleae 1.1.18. I choosed 16Mhz as simpling rate(since the quartz is 16 Mhz) and by default 1M of sample are retrieved.

I selected 250M of sample to be sure to see everything ....
I start first the quad... then start sampling then start the TX, arm the
the quad (up and down throtle stick) and that give a throttle

Attachments:

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 20:43 - 01 Feb 2014 20:53 #19624 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol
Ok I save a firt CSV file ....

Hope some specialist can understand this file ...

EDIT ... Can't upload a file of 1.45M :(
Last edit: 01 Feb 2014 20:53 by SeByDocKy.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 20:59 - 01 Feb 2014 21:02 #19626 by PhracturedBlue
Replied by PhracturedBlue on topic New SYMA protocol
No you can't. zip it up 1st. Ifit still doesn't fit, post it somewhere like dropbox and provide a link.

With Saleae it is best to setup a SPI analyzyer and then write that out

press '+' on 'Analyzers' (at the right)
Select SPI
Select the proper channels

then you should see hex values above each transaction.
you can now click the gear on 'SPI' and Export the values.

From your screenshot, I think something is wrong. Channel 2 could be clock or data, but there isn't enough going on on any other channel to make me think you have both. in that case, saving your Saleae session and zippingthat up would probably be better than the CSV file.
Last edit: 01 Feb 2014 21:02 by PhracturedBlue.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 21:24 #19629 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol
Ok,

I tried to relabel channels as you explained to me ... Hope it's ok

Here is a link of 500M of samples

www.wetransfer.com/downloads/cde223c42f4...0140201212121/c163f3

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 21:36 #19632 by PhracturedBlue
Replied by PhracturedBlue on topic New SYMA protocol
Can you provide the salea session file (Options->Save Session) It is a lot easier to quickly look at that way then to be stuck using csv.

Please Log in or Create an account to join the conversation.

More
01 Feb 2014 21:38 #19633 by SeByDocKy
Replied by SeByDocKy on topic New SYMA protocol

PhracturedBlue wrote: Can you provide the salea session file (Options->Save Session) It is a lot easier to quickly look at that way then to be stuck using csv.



Oops sorry :)

Here the zipped session :)

www.wetransfer.com/downloads/e0974d8a928...0140201213706/6b189c

Please Log in or Create an account to join the conversation.

Time to create page: 0.215 seconds
Powered by Kunena Forum