WLToys V912/V915/? protocols

The WLToys V915 & V912 (and possibly others) use the FlySky Protocol, and something like the WLToys extensions. The V915 is a scale heli with two "extensions" - lights & a "boost" mode. One of the four FlySky extensions toggles the lights, but the other three just kick the throttle into max output (hmm. I wonder if that's why my motor died on the second test flight). The V959 Tx doesn't do any better.

The V912 is a pod-and-boom heli with a mount and plugs on the Rx for the V959 extensions. I have no idea if they work with the V959 Tx (the people I've asked to check haven't), but they don't seem to work with the WLToys extensions (again, my requests for reports from interested parties haven't reported back).

So, what can I do to work this out? I have the V915 Tx, and will gladly donate it to someone to do the work. Or some guidance on what I need to do to do analyze the signals? Connect an A7105 Tx to an arduino, maybe?

There are two options:

* Sniff SPI traffic on an original TX where this functionality is prooved to be working. That's the way which is working 100% with one-directional protocols (like FlySky). You/we can easily find out which bit/channel a specific function is mapped to. If you have a logic analyzer (or are willing to buy a cheap one - be sure its Salae compatible) and provide us high-res images from the Transmitters PCB inside (both sides preferred, so we can see routing from Transmitter chip to MCU pins, which are the easiest part to hook up probes) we could guide you through the process. Analyzing SPI traces can be done by some ppl in this forum (including me), so that should be straightforward.

* Use deviation source code and try to map the extra channels to different bits/channel of output packet and see if that brings the desired results. Again you need to attach the specials to check that you've triggered it (and which function - WLToys gadgets have two). You'll need some coding skills and (more important) enough logic understanding to understand what you're trying there to get into the right direction. And there is some chance that this won't work out as expected (depends on if they've inventend something new, or going the old way).

I'd recommend the first way, but you'll need to get a logic analyzer for that.

I've attached pictures of the two sides, since I was trying to fix the flaky power switch (Works Like Toys had apparently forgotten to solder the power switch connections!), so I took some pictures and attached images. Please let me know if that's sufficient, as I've left the thing open on my desk for now.

The logic analyzer is a possibility, depending on what "inexpensive" means. I've overextended my hobby budget by quite a bit lately, so it needs to be really inexpensive. But I have no idea what "saleae compatible" means. My first thought is to build one (there are a number of them on instructables and the like), then I found this on ebay. If that will do, let me know and I'll order one.

Poking at the source code could take a lot of time. Maybe. There are only 4 channels, and assuming the current 4 bits, that's 16 bits that can be set. If they are independent, then that's only 16 things to check, and we already know 4. If they aren't independent, then that's potentially 65,536 things to check. I'm tempted to rewrite the code to copy channels 5-8 to the high order nibble of channels 1-4. Would make setting multiple switches more complicated, but also more flexible.

Unfortunately, I can't do the gadget checking on the V912 - I don't have one! I can check the V915, though.

Thanks!

The pictures are fine.
Interesting pins are SCS, SCK and SDIO, you can either hook up at the RF Board itself (pins may be long enough for SMD probes) or at MCU Pins 1-3 (Pin 1 is near the hole at one corner) - you can trace then easily on this 1-Layer PCB

Yes, this logic analyzer should be fine, I also have one of these along my Salae Logic, and both work fine with the software. Original one is of course much better quality and has good SMD probes shipped, but 150 US$ is way too expensive for "one sniffing session".
You'll also need SMD probes to attach, something like this , though you will most propably want something cheaper. Most cheapo grabbers I've found on US ebay (search SMD grabber) have one hole at the top where you have to solder a wire or a pin to attach jumper cable. If you can do this, you should go this way (or search long enough ).
I have used very similar ones before I finally got my Salae Logic.

..may take a while, but favorable. Quality is ok.
www.banggood.com/Test-Clamp-Wire-Hook-Te...alyzer-p-936424.html

Or just tin the tip of a breadboard wire and hook it on (top side of pcb /solderjoints).

Ok, logic analyzer and clips ordered. The least expensive clips I could find with US shipping were from Amazon Prime, so they'll be here later this week. The amusing part was the 5-star review from the guy who used them for tying flies.

Banggood had the logic analyzer in their US warehouse for less than the ebay prices. Now to see if they actually take the payment (they have a habit of bouncing my credit cards...).

Thanks again. Probably more questions when I get the kit.

Sigh. Well, the logic analyzer arrived today. Picture attached.



Now to wait on banggood to fix their mistake.

Just another update. It's taken them well over a week, but banggood will be refunding my money. They say I should see it in two or three weeks. Maybe their customer service department isn't misnamed, just mistranslated.

Meanwhile I've tried ordering another one. Should be here in about a week.

Strange thing - I'm living in germany and never had much trouble with Bangood's support.
I had some issues with wrong parts being sent - but after sending email with photos of received items I never had trouble (besides waiting 6+ weeks again) getting a re-sent of the item.
As such I must say that BG did a good job for me until now, where I had some serious trouble with TMart after receiving a totally damaged V262 - opening PayPal dispute was the only way to get money back :\.

Back to the topic: Did you try to attach your "special device" to the remote ? Maybe it can be used to do 2.4GHz sniffing ?

I think I' have better luck trying to throttle the flow of data than sniff it.It is, after all, a throttle.

My issue with them is lack of competence. Sent in the problem with the picture. Was asked to resend it to someone else because the web site goes to the wrong people. One day wasted. I did that, they sent back a request to show the shipping label, even though I made sure that was in the first picture. Another day wasted. They offered one at half price and keep the totally useless wrong thing, which was completely unacceptable. That took a day, but they're just being cheap. I pointed that out, so they offered either a refund or a new shipment, so I told them if they could ship it from the US, to do, otherwise refund it. They then said "We can't ship from the US, would you like a refund instead?" Yet another day wasted.

Ok, after a break dealing with various holiday things (including my rocking son buying me a 550-size hexacopter!), long shipping delays, and fixing broken hardware, I'm ready to take a crack at this.

I have the v915 bound to my Devo10, and working ok - except for those custom functions. I have the ability to create custom deviationTx builds. I have the v915 Tx opened and on my workbench - as pictured above. And I have a Salea-compatible logic analyzer, and a set of probes attached to it. I have the Salea software installed on my laptop, and it appears to recognize the analyzer.

I found the data sheet for the TG67957 in the middle of the first photo only to discover it's a graphics processor, so probably not interesting. The second photo has what looks like a WLToys A7105 Tx module, down to having the pins in the same order as the one in the module list .

At this point, I have one clue - I probably want to connect the probes to the five labelled pins on the A7105. Beyond that, no idea of what I should be setting in the Salea software.

Could someone lend me a clue, here?

It's an SPI protocol, so you need to add SPI decoder to your trace and name SPI wires accordingly. Then it will be able to decode your protocol. Then you set a trigger for fall at CS, start tracing (the frequency should not be too high, 4MHz is probably enough) and start your TX and press buttons. Then you'll have a trace - you need to save it and analyze.

I never traced A7105, so I don't have a high-level parser for it, but PB's repo has a Perl script somewhere. The problem with A7105 it that it uses 3-wire protocol which is close to SPI, but not a standard SPI - it uses single DATA wire instead of MISO/MOSI. So PB's decoder works with raw, undecoded trace.

Well, it appears that I've killed the V915 Tx in trying to get it to bind while the thing was open. That leaves this project equally dead. Thanks to everyone who provided help before this point.

Wasn't getting very far anyway - there are to many different labels on the signals. The set on the RF board doesn't match the set used in the salea software, which doesn't match the set used in the deviationTx docs, which doesn't match what you used here. The deviationTx stuff does provide a map from what it uses to what's on the board, but that doesn't help me figure out what Clock & Enable are. Or CS.

Finally, I'd like to get the sigrok software working. Is anyone here using that?

I use Saleae, I tried sigrok, the interface is not very clear to me. Besides, my decoding scripts work with Saleae.

Well, I got the sigrok software working on Windows. I'll probably be using that going forward, because 1) my using the Salea software violates their license, and 2) the sigrok software has more decoders and is designed so adding decoders is easy. If I ever try decoding WLToys A7105 stuff again, I'll look at porting the PBR's decoders to it.

Has this thread been resolved? I have been tinkering with a Salea and I have a V912 TX. I took a few samples at 4m/s and I'm pretty sure it's getting good data, because SPI looks like it's decoding. If you need a sample, what are the settings I should use and how much time is needed?

Let me know if I can help with this.

No, it's not resolved. My 915 Tx quit working, so progress stopped.

If victzh is still listening, maybe he can tell you what he needs to see to work out the code. I can certainly help test once things start moving again.

I am listening

Judging by the current code for FlySky it has extra 8*4=32 bits in the packet (8 channels, high nibble of each channel is free for use). Current code uses 4 such flag bits, so we have 28 possible bits.

It's insane to build 28 versions of Deviations to test it, but what we really can do is to "spread" a channel over these bits to turn them on individually.

Then you connect a switch to a channel, select mixer so that it feeds the Deviation with a number of bit to turn on and the by adjusting the mixer value you can find a bit responsible for an action.

No soldering, just 32 tryouts.

You need a working helicopter for this, though. I don't have one.

Sounds like you don't even need a working Tx to test it.

I've got a 915, but that only has LEDs (which I believe connected to what's now on channel and a "boost" mode, no camera controls.

Sounds like what we want is for channel n (n >= 4, counting from 0);
value(channel[n - 4]) |= (value(channel[n]) & 0xf0) << 4
I don't think this can be backwards compatible. Possibly a pair of options?

Deal, do you have a 912? If so, tell me what Tx you are using and I'll provide a build with this mod for it after testing on the 915. Unless victzh beats me to a build, anyway.

I am using the Devo 7e.

For the testing I have a V912 with the ports, but I don't have anything plugged into them. I suppose I could rig the analyzer to see what happens, when.

I did capture the SPI data for about 10 seconds while pressing the buttons. I can upload if it would help.

The manual shows two multifunction buttons on the "ring" at the lower right corner of the TX. The top button is "Camera, Water Spray, Spray Bubbles rise in hanging basket, shells hit single". The bottom button is "Photography, Falling Basket, Play barrage".