Traxxas TQ

mfg_id: 7a b3 92 43 23 fd

sopcode:  {0xEF, 0x64, 0xB0, 0x2A, 0xD2, 0x8F, 0xB1, 0x2A},

"Idle" packet:				01 00 02 fb 02 f5 02 ee 00 00 00 00 02 ee 00 00

"Trigger somewhat pulled" packet:	01 00 02 f6 03 19 02 ee 00 00 00 00 02 ee 00 00

mfg_id: 7a b3 92 43 23 fd

While idling(With no receiver on, at least), it appears to alternate between two SOP code/CRC seed sets every once in a while:
	sopcode:  {0xEF, 0x64, 0xB0, 0x2A, 0xD2, 0x8F, 0xB1, 0x2A},
	crcseed: 0x27fe

	sopcode: {0x97,0xE5,0x14,0x72,0x7F,0x1A,0x14,0x72},
	crcseed: 0xa5a5

When in "bind" mode, it uses this SOP code/CRC seed:
	Binding sopcode: {0x3C, 0x37, 0xCC, 0x91, 0xE2, 0xF8, 0xCC, 0x91}
	Binding crcseed: 0x5a5a
	
	The transmitter appears to wait for the receiver to initiate binding, not the other way around.
	The transmitter never sent anything while in binding mode, only continuously checked for received packets.

"Idle" packet:					01 00 02 fb 02 f5 02 ee 00 00 00 00 02 ee 00 00

"Trigger somewhat pulled" packet:		01 00 02 f6 03 19 02 ee 00 00 00 00 02 ee 00 00

"Steering right" packet:			01 00 03 dc 02 f8 02 ee 00 00 00 00 02 ee 00 00

"Steering left" packet:				01 00 01 f5 02 f8 02 ee 00 00 00 00 02 ee 00 00

Trim adjusts steering output, as expected.



WIP Packet architecture:	aaaa cccc bbbb eeee dddd gggg ffff hhhh

	aaaa
		Packet type and/or "channel" ID?
			Never seen anything except 0x0100 here, but I only have one transmitter/receiver pair.
	bbbb
		Channel 1
			Range: Unknown, seems centered on ~0x02f5, probably roughly the same as Channel 2.
			Used for: Throttle
			
			Higher value is forward, lower value is reverse.
	cccc
		Channel 2
			Range: Seems to be roughly 0x01f5 - 0x03dc, center is ~0x02fb
			Used for: Steering
			
			Higher value is right, lower value is left.
	dddd
		Channel 3?
			Never seen anything except 0x0000 here
			Transmitter has an unpopulated "Channel 3" input marked on it's PCB, haven't tried hooking anything up to it yet.
	eeee
		Channel 4?
			Never seen anything except 0x02ee here
	ffff
		Channel 5?
			Never seen anything except 0x02ee here
	gggg
		Channel 6?
			Never seen anything except 0x0000 here
	hhhh
		Channel 7 or unused checksum?
			Never seen anything except 0x0000 here.
			This being channel 7 would not match the pattern of all the other channels, might be an unused checksum field?