- Posts: 13
X5C Clone using XN297L
- Toybomb
- Topic Author
- Offline
Recently I purchased this X5C-1 Clone ( world.taobao.com/item/527888255460.htm ) and was hoping to use it with a 9xr with Multiprotocol but none of them would bind with the quad (even after flashing the latest github firmware). So I opened the TX and found that it used an XN297 RF chip. Right now i've figured out the SPI pins and the part of the payload that is being sent over SPI. My challenge now is to get the nrf24L01 chip to talk to XN297, could anyone give some pointers or hints ?
What i've figured out from the TX when starting
W_REGISTER: RX_PW_P0 = 63
R_REGISTER: RX_PW_P0
FLUSH_TX
FLUSH_RX
W_REGISTER: STATUS = 70
W_REGISTER: BB_CAL = 209C67844C
W_REGISTER: RF_CAL = BCABBB61B09ADD
W_REGISTER: DEMOD_CAL = 03A7C4DF0B
W_REGISTER: TX_ADDR = 4AB399B5D2
W_REGISTER: RX_ADDR_P0 = 4AB399B5D2
W_REGISTER: EN_AA = 00
W_REGISTER: SETUP_AW = 03
W_REGISTER: SETUP_RETR = 00
W_REGISTER: RF_CH = 12
W_REGISTER: RF_SETUP = 07
W_REGISTER: RX_PW_P0 = 0C <- This corresponds with the payload size
W_REGISTER: RX_PW_P1 = 0C <- This corresponds with the payload size
W_REGISTER: ACTIVATE
W_REGISTER: DYNPD = 00
W_REGISTER: FEATURE = 00
ACTIVATE
W_REGISTER: CONFIG = 0E
Once its bound, it hops between channels 0x19, 0x28, and 0x05
Playing around with the sticks and buttons and monitoring changes to the SPI payload, i figured out below
AA BB CC DD EE FF GG HH II JJ KK LL - Payload
AA/BB/CC = Set to 00/ Dont know what this does yet.
DD = Throttle (0x00 - 0xFE) / Camera (0x01)
EE = Ail (0xA0 resting, 0x81 Left, 0xBE Right) / Lights + 0x40
FF = Ele (0x20 resting, 0x3E Up, 0x01 Down) / Flip + 0x40
GG = Rud (0x20 resting, 0x3E Left, 0x01 Right) / Video + 0x80
HH = Trim (Left [0x0 - 0x20], Right [0xFF - E0])
II = Speedup button (L/M/H - 0x40/0x80/0xC0)
JJ = Trim (Up [0x0 - 0x20], Down [0xFF - E0])
KKLL = CRC16 (Polynomial = 0x8408
Bind sequence sends a packet like this
0x2a 0x96 0xa9 0x25 0x24 0x00 0x00 0x00 0x9e 0x84 0x00 0x00
First 5 bytes tells it to switch the TX_ADDR
Attaching some of the dumps i took using Saleae Logic. Also afew dumps taken using Pulseview (To decode add SPI filter, configure CLK as D2, MISO as D1, MOSI as D0, CS# as D3, chip type xn297)
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
Remote 1 - Arm
Remote 2 - Arm
Remote 1 - Bind
Remote 2 - Bind
Remote 1 - D0:MOSI, D1:MISO, D2:CLK, D3:CS#
Remote 2 - D4:MOSI, D5MISO:, D6:CLK, D7:CS#
Please Log in or Create an account to join the conversation.
- goebish
- Offline
- I Void Warranties
- Posts: 2631
Please Log in or Create an account to join the conversation.
- goebish
- Offline
- I Void Warranties
- Posts: 2631
Are you sure of that ? because it looks like this is the only difference with hontai protocol, which is using poly = 0x8408KKLL = CRC16_X_25 (Polynomial = 0x1021, Initial Value = 0xFFFF, Final Xor Value = 0xFFFF www.sunshine2k.de/coding/javascript/crc/crc_js.html )
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
#define MOSI_pin 5 // MOSI-D5
#define SCK_pin 4 // SCK-D4
#define CS_pin 6 // CS-D6
#define CE_pin 3 // CE-D3
#define MISO_pin 7 // MISO-D7
static const uint8_t tx_rx_id[] = {0xD2,0xB5,0x99,0xB3,0x4A};
void setup() {
Serial.begin(115200);
printf_begin();
//RF module pins
pinMode(MOSI_pin, OUTPUT);
pinMode(SCK_pin, OUTPUT);
pinMode(CS_pin, OUTPUT);
pinMode(CE_pin, OUTPUT);
pinMode(MISO_pin, INPUT);
NRF24L01_Reset();
NRF24L01_Initialize();
NRF24L01_SetTxRxMode(RX_EN);
NRF24L01_SetTxRxMode(TX_EN);
delay(10);
XN297_SetTXAddr(tx_rx_id,5);
XN297_SetRXAddr(tx_rx_id,5);
NRF24L01_FlushTx();
NRF24L01_FlushRx();
NRF24L01_WriteReg(NRF24L01_07_STATUS, 0x70); // Clear data ready, data sent, and retransmit
NRF24L01_WriteReg(NRF24L01_01_EN_AA, 0x00); // No Auto Acknowledgment on all data pipes
NRF24L01_SetBitrate(NRF24L01_BR_250K); //NRF24L01_BR_1M / NRF24L01_BR_250K
NRF24L01_SetPower(3); // maximum rf power
NRF24L01_Activate(0x73);
NRF24L01_WriteReg(NRF24L01_04_SETUP_RETR, 0x00);
NRF24L01_WriteReg(NRF24L01_1C_DYNPD, 0x00); // Disable dynamic payload length on all pipes
NRF24L01_WriteReg(NRF24L01_1D_FEATURE, 0x00); // Set feature bits on
NRF24L01_Activate(0x73);
NRF24L01_WriteReg(NRF24L01_05_RF_CH, 0x0); //Bind to channel
NRF24L01_WriteReg(NRF24L01_07_STATUS, 0x70);
NRF24L01_FlushRx();
}
void loop() {
printf("Waiting for data...");
while(!(NRF24L01_ReadReg(NRF24L01_07_STATUS) & 0x40)) {}
XN297_ReadPayload(test_packet, 12+2);
printf("Got Data...");
}
Please Log in or Create an account to join the conversation.
- goebish
- Offline
- I Void Warranties
- Posts: 2631
Also, you don't set the nrf24 to RX mode
NRF24L01_SetTxRxMode(RX_EN);
XN297_Configure(_BV(NRF24L01_00_EN_CRC) | _BV(NRF24L01_00_CRCO) | _BV(NRF24L01_00_PWR_UP) | _BV(NRF24L01_00_PRIM_RX));
But you don't need to do that, I think you already have all the necessary informations to add the protocol as an Hontai sub-format.
Just try to change the crc polynomial first, with a bit of luck it will be working
edit: modified code.
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
I've made the changes and it still isn't reading data.
NRF24L01_Reset();
NRF24L01_Initialize();
NRF24L01_SetTxRxMode(RX_EN);
XN297_Configure(_BV(NRF24L01_00_EN_CRC) | _BV(NRF24L01_00_CRCO) | _BV(NRF24L01_00_PWR_UP) | _BV(NRF24L01_00_PRIM_RX));
delay(10);
XN297_SetRXAddr(tx_rx_id,5);
NRF24L01_FlushRx();
NRF24L01_WriteReg(NRF24L01_07_STATUS, 0x70); // Clear data ready, data sent, and retransmit
NRF24L01_WriteReg(NRF24L01_01_EN_AA, 0x00); // No Auto Acknowledgment on all data pipes
NRF24L01_SetBitrate(NRF24L01_BR_1M); //NRF24L01_BR_1M / NRF24L01_BR_250K
NRF24L01_SetPower(3); // maximum rf power
NRF24L01_Activate(0x73);
NRF24L01_WriteReg(NRF24L01_04_SETUP_RETR, 0x00);
NRF24L01_WriteReg(NRF24L01_1C_DYNPD, 0x00); // Disable dynamic payload length on all pipes
NRF24L01_WriteReg(NRF24L01_1D_FEATURE, 0x00); // Set feature bits on
NRF24L01_Activate(0x73);
NRF24L01_WriteReg(NRF24L01_05_RF_CH, 0x0); //Bind to channel
NRF24L01_WriteReg(NRF24L01_07_STATUS, 0x70);
NRF24L01_FlushRx();
delay(150);
Please Log in or Create an account to join the conversation.
- goebish
- Offline
- I Void Warranties
- Posts: 2631
NRF24L01_WriteReg(NRF24L01_11_RX_PW_P0, 12); // rx pipe 0, 12 bytes
NRF24L01_WriteReg(NRF24L01_02_EN_RXADDR, 0x01); // Enable data pipe 0 only
Also, set it to RX mode at the end of the init sequence, not at the beginning.
Anyway, I don't get why you want to do that, you won't collect more stuffs than with the SPI capture.
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
NRF24L01_Reset();
NRF24L01_Initialize();
XN297_SetRXAddr(tx_rx_id,5);
NRF24L01_FlushRx();
NRF24L01_WriteReg(NRF24L01_07_STATUS, 0x70); // Clear data ready, data sent, and retransmit
XN297_Configure(_BV(NRF24L01_00_EN_CRC) | _BV(NRF24L01_00_CRCO) | _BV(NRF24L01_00_PWR_UP) | _BV(NRF24L01_00_PRIM_RX));
NRF24L01_WriteReg(NRF24L01_01_EN_AA, 0x00); // No Auto Acknowledgment on all data pipes
NRF24L01_WriteReg(NRF24L01_02_EN_RXADDR, 0x01); // Enable data pipe 0 only
NRF24L01_WriteReg(NRF24L01_05_RF_CH, 0x0); //Bind to channel
NRF24L01_SetBitrate(NRF24L01_BR_1M); //NRF24L01_BR_1M / NRF24L01_BR_250K
NRF24L01_SetPower(3); // maximum rf power
NRF24L01_Activate(0x73); // Activate feature register
NRF24L01_WriteReg(NRF24L01_04_SETUP_RETR, 0x00);
NRF24L01_WriteReg(NRF24L01_1C_DYNPD, 0x00); // Disable dynamic payload length on all pipes
NRF24L01_WriteReg(NRF24L01_1D_FEATURE, 0x00); // Set feature bits on
NRF24L01_WriteReg(NRF24L01_11_RX_PW_P0, 0x0C); // rx pipe 0, payload size
NRF24L01_FlushRx();
NRF24L01_SetTxRxMode(RX_EN);
delay(150);
Please Log in or Create an account to join the conversation.
- goebish
- Offline
- I Void Warranties
- Posts: 2631
Please Log in or Create an account to join the conversation.
- mjbudden
- Offline
- Posts: 21
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
Please Log in or Create an account to join the conversation.
- goebish
- Offline
- I Void Warranties
- Posts: 2631
Or is it 100% the same protocol ?.
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
Please Log in or Create an account to join the conversation.
- goebish
- Offline
- I Void Warranties
- Posts: 2631
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
the quad uses the JJRCX1 sub protocol instead of hontai but uses the XN297 to transmit (JJRCX1 uses NRF24)
so there is some work to be done after all
since my quad does not have a camera i could not test video/picture
but i was able to use the calibration/flip/RTH/headless/toggle lights modes
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
the F-805C arrived today, and the protocol is not the same as the hontai protocol it seems. attaching some sigrrok spi dumps, it seems to be using the XN297 chip
on startup
BB_CAL - 0x209C7F3FCD
RF_CAL - 0x9CABBB79B09ADA
DEMOD_CAL - 0x03A7C4DF0B
TX_ADDR - 0xBBBCBDBEBF
RX_ADDR_P0 - 0xBBBCBDBEBF
FLUSH_RX
FLUSH_TX
STATUS - 0x70
EN_AA - 0
EN_RXADDR - 01
SETUP_AW - 03
RF_CH - 02
SETUP_RETR
RX_PW_P0 - 0x0A
RF_SETUP - 0x01
ACTIVATE
DYNPD - 0x00
then it goes on for abit on these channels
0x30, 0x35, 0x3A, 0x40 (Channel Hop)
A0 8D 12 00 00 A5 A5 A5 00 83
then it continues on this
0x44, 0x4B, 0x34, 0x3B (Channel Hop)
00 00 00 00 40 40 40 00 00 15
Please Log in or Create an account to join the conversation.
- Toybomb
- Topic Author
- Offline
- Posts: 13
AA BB CC DD EE FF GG HH II JJ
AA - Throttle 0x00-0xFF (Trim 0x00-0x1E)
BB - Yaw Left - 0x00-0x7F, Right 0x80-0xFF
CC - Pitch Up - 0x80-0xFF, Down 0x00-0x7F
DD - Roll Left - 0x00-0x7F, Right 0x80-0xFF
EE - Start 0x40, (Yaw Trim Right Plus 0x00-0x1E, Yaw Trim Left Minus 0x00-0x1E)
FF - Start 0x40, (Pitch Trim Up Plus 0x00-0x1E, Pitch Trim Down Minus 0x00-0x1E)
GG - Start 0x40, (Roll Trim Right Plus 0x00-0x1E, Roll Trim Left Minus 0x00-0x1E)
HH - Headless 0x02, RTH 0x01
II - Video button pressed + 0x10, Picture button pressed, 0x08, Headless 0x80, RTH 0x40, Mode Slow/Fast + 0x04, Flip 0x01
JJ - Checksum?
Please Log in or Create an account to join the conversation.
- Home
- Forum
- Development
- Protocol Development
- X5C Clone using XN297L