Flysky AFHDS 2A, protocol as used i10, i6, iT4,

I learned IDA Pro a little bit for fun, and used the fs-ia6b receiver firmware as the example. Nothing serious, but i did a lot of boring droid work on it, given some fancy name for subs, figured out peripheral register uses. Maybe interresting. This receiver is stm32, the tx is freescale kinetis, booth are cortexM0-s.

sorry, IDA is too good

@goebish
Box is packet , tomorrow i ship it with dhl to you.
i send the tracking Number with Private Message to You.

greetings Alex

If it still interresting, the "broken" ida db maybe recreated from the original binary in the previous zip and the idc dump.
(arm little, v6m, thumb2, ram 0x20000000, size 0x1000, rom 0x08000000, size 0x8000)

File offset is 0, the loading address is same as the ROM start. Let the automatic analyzer do the job first, then load the script. ARM processors have an arm mode(32bit) and the thumb-2 mode(16-32bit instructions), switchable runtime, but cortex M-s are thumb-2 only. If you see only 32bit instruction, than its garbage. IDA will/must mark thumb-2 sections with some virtual segment register bit. In the bin file the first 4 byte is where the stack pointer set initially, somewhere end of the ram, the second 4 byte where the execution start. It points to 0x08000281, means start at 0x08000280 with thumb-2 instrucion set.

Two RCG members worked on the tx firmware. ThomHpl published the ida db, but it's an older format, i can't open it, maybe he can help. Dave Borthwick is the other jedi, we don't know what kind of tools he used, but he can recompile the dissassembly!!! They are in this thread:
FlySky FS-i6 8 channels firmware patch!
Benb0jangles keep the collection of files:
FlySky-i6-Mod-

I played with the tx firmware too, tried generating library signatures against the kinetis SDK with different compilers, no succes

Hello,

Box is on its Way to You.
Parts:
TGY-i10
RX 10 Channel
Temp. Sensor
RPM Sensor
Volt. Sensor
Wires ,Battery and other small Parts.
-> if you get stressed by the Sunshade on Display, then rip it off . I is only 2 sided glue Tape

The TX has the latest Firmware from H.K.
The RX has latest Firmware from FlySky ( may be here some new IDs for Future Alt. Sensor at the Protocol, At TX there are some Menu Points to Calibrate the ALT or Vario Sensor )

i hope it helps to get it to work on Deviation.
I have a 2nd set here to make Bug checking later , if there some Test Versions at some Point.

greetings Alex

no problem

my 2 ct. for Info
at I10 TX ( Carson,Flysky,Turnigy )
The TX request on Binding the Version Number from the RX. If the Number is lower then the Version from the TX ,it warns and with ok at Menu it makes an Firmware update over the Air on the RX.
You cant get back to a lower Version with the I10 ( Message: Your Firmware Version is newer .......... )
You can re flash the Firmware with the I10 manual at the Menu Point RX but not downgrade
The RX Firmware is included into the TX Firmware.

some Things for info if some crazy Data comes up on the communication TX <-> RX

greetings Alex

Hello ,
no. There is no Interface to do it.
- no TX Module with PPM in to get an other Brand TX to the new 2A Protocol
- no External Telemetry Display
-> and after the Update is done, you have to Rebind the RX

here is a List of the supported Protocols ( TX / RX )
www.rc-network.de/forum/showthread.php/4...ewfull=1#post3623905

Some does 2A without Telemetry and the AFHDS2 is only for a small Number of RX

The older Protocols can be switched at the Menu of the I10 TX, so the older RX (Flysky,Tunigy, .... -> the Ver. of RX with one Big Antenna <- ). Which is already available from Deviation, Named Frsky (AFHDS)

greetings Alex

EDIT:
-> You can Downgrade the I10 ( i done it for Test with my Carson i10 ) but then the RX Channel Numbers are wrong. Here can be a Trap for rebuilding the Protocol , all the I10´s have a special country Code ( and some seller seller have its one Code) at the end of the Firmware File.
-> You can not change the Country or Seller Code to one other .
-> The Firmware for the TX is a EXE File for Windows and it checks the Transmitter Serial Code ( Country or Seller )

Here at Downloads ( right side ), the last file at the list. It is only for the Carson I10.
www.carson-modelsport.com/de/produkte/fe...htm?sArtNr=500501002

Or the Tunigy one , you can find it at H.K.

Ok, nice