Yi Zhan i6S capture

goebish wrote: Here's a test build, check "YZ i6S" format option in MT99xx protocol.
Flags are still not implemented, let's check if it binds and flies first.

Devo 7e
Devo 10
source

Also, I separated H7 and MT9916 into 2 sub-formats, that should fix the issues people had. I checked that the H7 works fine, please check the MT9916 if you can.
I removed the annoying protocol trim channels and rate is fixed to high.

goebish wrote: Oops, I noticed I had the checksum wrong, please try this one:

Devo 7e

goebish wrote: Ok, I see something in init:

3 W_REGISTER(19) 1E

This is a XN297L specific register, it's not the same than on non "L" XN297 (it was a multi byte register) according to the datasheet, bit 0 of this register controls scrambling and is enabled by default, it is disabled here (0x1e & 1 = 0)...
Maybe disabling scrambing makes the xn297 air compatible with the nrf24l01 and doesn't require emulation layer (whitening) anymore... or a modified emulation layer.

hexfet (and victzh, if you're still reading), do you have any thought on that ?

google translate:

Scrambling function is enabled, open the scrambling function for data to be sent by the whitening operation, thereby reducing the length of a long 0 data,
So that both ends of the transceiver can require scrambling function identically configured
1: Enable scrambling
0: Close scrambling

goebish wrote: I've not much hope, but let's try without XN297 emulation layer:
Devo 7e
(Obviously, H7 & MT9916 can't work with this version)

goebish wrote: So I guess I can't do much more without a xn297l to experiment with... any cheap machine that's using it ?
Or maybe you've a module in a stock TX you do not use anymore that you're willing to sacrifice in the name of science ?

I'm almost sure that scrambling can be disabled on the xn297 too, but we do not have a detailed datasheet for its DEMOD_CAL register

goebish wrote: What a ride ...

By tinkering with the 0x19 register on an actual xn297 I've been able to disable scrambling (write 0x00 instead of 0xa7 in the 4th byte, got this lucky guess after 3~4 attempts only...), then following travisgoodspeed and victzh steps, I've been able to sniff and decode the packets with a nrf24l01 (preamble+sync+payload)

"non scrambled" xn297 mode is almost directly compatible with the nrf24l01, at least if the nrf24 is the RX (with CRC disabled), in this mode the address is directly compatible, just that payload bytes are bit reversed (LSB first).

For TX mode emulation, we still have to forge packets as xn297 preamble is 4 bytes long instead of 1 (0x55, 0xf3, 0x1f, 0x55)

I still have to check CRC, shouldn't be difficult ...

That will require a few mods to the current xn297 layer to implement this "non scrambled" mode, but I'm pretty confident I should be able to make it work, looks simple enough