Lishtoys L6052

Anybody have any idea what protocol this thing is running and if it can be hacked?

Seems to be a lot of interest in this Alias QC clone right now (including me!).
I'm thinking of pulling the trigger on one of these while I wait for the slow boat to bring my 7E to me and to know that it can be hacked would seal the deal.

Also, thank you for all of your hard work, it really makes it a good experience for noobs like myself!

I have just purchased one of these things, is anyone else working on these or any news?

I dont have the equipment but I wouldnt mind buying the stuff to do data catches (whatever you guy's call it). Would that get the ball rolling [after my quad get's here from the slow boat]?

I purchased the L6052 [because of price] but I'm an electrical engineer by trade and, like I say tho I've never done it before I'm sure I can do what's needed to get the data to make it work.(I'm a hardware guy, coding is NOT my area of expertise lol)


Really hate the stock toy Tx! Anyone else working on it?

It's coming to me from China (GearBest), I expect it in 2-3 weeks. I will evaluate feasibility and would be grateful if you can post detailed photos of RX and TX boards near the radio chip if you already have it.

I've just got the thing, I dont recognize the chip on it, It's not a module, it's integrated right into the main rx board. That's definitely something I could take care of tho if need be (making a stand alone board to strip the parts off the stock rx board and make a tiny radio only board, I dont know if this is a common iC or not).



only parts on the back


radio iC



and the radio iC on the quad's main board

The chip is enhanced version of LT8900. In the thread www.deviationtx.com/forum/protocol-devel...-h1-a-k-a-mini-ninja people tried to implement protocol on nRF24L01+, as far as I understand without success. Theoretically it should be possible, but there are many small differences between LT8900 and nRF24L01 so it's still not there.

I've got my L6052 sometime ago and pretty happy with it. It's a bit tame, and some people are disappointed comparing it to the first version, but I found that it's OK for indoors flying.

I plan to solder to the TX and look at the protocol and at what our colleagues from mentioned thread achieved. So far I can tell that the protocol is bidirectional - the TX feels when the battery is discharged and signals you not to attempt to do flips.

I have the datasheet for LT8900, this forum doesn't like PDFs attached.

victzh wrote: I have the datasheet for LT8900, this forum doesn't like PDFs attached.

Wold you mind emailing it to me? I can only find Chinese versions using google translate that come out making no sense what-so-ever...
dan [at] killerlumens [dot] com

thx!

Sent.

BTW, were you lucky to find what MCU they used?

Yes I was, I have it written down back at my desk. It's some 20pin SOP package.

Let me rephrase that, I haven't figured out exactly what it is but I have the markings from it... I did some trace tracing too, trying to figure out how it talks to the stick gimbals, looks like it's talking to them over SPI, is that the typical way?

No, gimbals are most often just a couple of pots, so they can reuse the MOSI/MISO as ADC connections because if Chip Select is inactive, SPI releases them to high impedance state.

I soldered to my TX and trying to decode the protocol. I also plan first to use nRF24L01 to RECEIVE this protocol, not send it. There are many pitfalls and small details probably not well documented in datasheet, e.g. the code for L6052 and Eachine H1 initializes registers they did not bother to document. And initialize them similarly! It may be a programmer shortcut (I witnessed this), bug in the code, or some valid but undocumented registers.

OK, some preliminary results of protocol analysis - not good.

For the sake of enhancing the distance they used low data rate - 62.5Kbps, an ability of the new LT8910 modification of LT8900. My beloved nRF24L01+ does not have this data rate, so it is useless.

I am trying to make sense of multitude of CC2500 registers, it seems to be much more flexible and can match this data rate closely (not exactly). There are many other aspects of the signal that can be mismatched, so don't hold your breath

The MCU is a ST micro STM8S003F3P6

datasheet:
www.st.com/st-web-ui/static/active/en/re...sheet/DM00024550.pdf

www.aliexpress.com/item/Free-shipping-5P...F3P6/2042993481.html

Just an update- I just finished up installing a spare protoX FC / frame PCB in my L6052. Was far from easy but seemed easier than any other way to go about making it devo compatible.




I went with the protoX frame for a few reasons (over the v636 board), one because I had it (and have an A7105 installed) and two because I wanted the protoX's built in batt monitor telemetry!