Deviating a JoySway

I changed the title of the post as I was really confused too. You just want to reverse the Joysway protocol so you can connect your Devo to the Joysway Rx. As is common, they are using an off-the-shelp a7105 module, which means that this will be easy to start working on. I'm not sure if you've done protocol work before or not, but you'll need an SPI sniffer to get started. I really recommend a Saleae sniffer (or similar if the price is too high. I won't recommend one of the Chinese knockoffs, since I really like my Saleae and try to get them business, but get whatever you can). The ability to do stream captures at 24MHz is really helpful for protocol work vs many other SPI which have a small capture buffer..

Anyhow, from the picture you provided, the pins should be:The GPIO1 and GPIO2 pins are connected to vias to the underside of the board and may go to the header too. I'd just solder up all the pins to a logic analyzer since they tend to have 8 ports.

With the A7105, they could use 3-wire or 4-wire SPI (I've never seen 4-wire used as yet). If they use 4-wire, orne of the GPIO pins will be MISO. the A7105 also supports 4-bit commands, which break most SPI analyzers, so I'd need the raw capture data to extract those if they are used.

I have nice utilities to convert Saleae traces from each of the protocols into an easily readable format, which I use to make sense of the logs.

We need to capture the following (each as a separate trace ideally, but it can be in one if you keep track of the order)
1) power on and binding
2) throttle (0 - 100 - 0)
3) elevator (50 - 0 - 50 - 100 - 0)
4) aileron (50 - 0 - 50 - 100 - 0)
5) rudder (50 - 0 - 50 - 100 -0)
6) any buttons/switches on the Tx, one at a time

It is often useful to capture the binding several times (with minutes between each occurrence) to see if channel selection is constant.

You may know all this already, but I'm giving you the whole thing in case you haven't done it before.

You will also need an A7105 module in your Devo Tx, be it the MultiModule or one of the add-on boards.

It may be a 4-layer board. otherwise those vias make no sense. I really don't know. With a multimeter you can try to check it.
you can usually run saleae at 8MHz for capture and it'll work fine., if it looks like the clock edges are being missed, go to 16MHz.

What I do is to use a wire-wrap tool to put a half-length wrap on the bottom of the board, and then plug in the module.it will still seat ell enough, and I have non-destructive wires for each pin on the header.
Or I just use wire-wrap wire and solder to the top. you aren't likely to damage the board just heating up each joint and dropping a 30AWG wire onto it. It is also pretty easy to remove when done.

I don't know which clips you have, but the official Saleae clips are very good, and I can usually put them on the bottom of the board and still plug it in

But really easy with Deviation