Yi Zhan i6S capture

goebish wrote: Work in progress, it's almost working, just that CRC is a bit more difficult than I expected... as I did one year ago for scrambled mode, I've to brute force crc xorout for every payload size... so emulation layer should be ready tonight

goebish wrote: Note that I can't make more tests myself because the xn297 (non L) I'm using can't do 250Kbps
Only 1 & 2Mbps ...

goebish wrote: Haha !

I think I got a winner by feeding crc reveng with MSB payload and LSB crc pairs !

$ reveng -w 16 -s 000069 def356 000011f0 deadd54b deadbee62d deadbeef946d deadbeef00bad0f00d00eeab
width=16  poly=0x1021  init=0x4d66  refin=true  refout=true  xorout=0xffff  check=0x4746  name=(none)
width=16  poly=0x1021  init=0xbd79  refin=true  refout=true  xorout=0x07f0  check=0x4746  name=(none)

seems the same init and xorout values are working for different payload lengths


Clap clap

Now to get that working with scrambled and unscrambled modes then I should be able to remove the 2 hardcoded xorout tables, that should free up something like 208 bytes of memory

goebish wrote: oops, my last build was still transmitting in scrambled mode, please try this one

Devo 10

goebish wrote: It's working, scrambled, unscrambled, with crc enabled or disabled ... without requiring xorout tables anymore
Maybe we could get rid of the scrambling table too, I keep that as a future exercise.

... that was a lot of fun, this is the kind of stuff that would deserve a blog article (sniffing, decoding / unscrambling, crc cracking ...), but I'm just too lazy to write on a blog

Back to the i6S protocol now...

I swapped aileron and elevator channels and reversed rudder.
Please test, then I'll check the flags.

Devo 7e
Devo 10
source

It's currently using your stock tx id, but it should work with an arbitrary id as well, we'll check later, but your tx id / rf channels matches with what I have for H7 / MT9916.