Global Drone, Skull Drone or GW008

Yes there is still hope, but this is the "PAN" version, not the LT8910 one.

I'm a programmer basically, but everything hardware / embedded / RF I taught myself thanks to the internet and the people on this forum

Yet more progress, I'm able to receive the packets with a nrf24l01 actually, the 200kHz drift isn't a problem, I think victzh noticed it as well when he first worked on the xn297 emulation.
I'm working on computing the crc now, then I think I should be able to add the protocol to deviation

CRC: Ok

Now to write a XN297_WriteEnhancedPayload function then implement the protocol ...

I'm still crossing fingers, this protocol is using auto acknowledge, which can't be emulated because that's not possible to switch from tx to rx mode fast enough, but I think we can live without it and "fly blind" as the quad only returns empty ACK packets. I only hope the rx recovers fast enough when it misses a packet.

The problem with auto ack in other protocols is that some modules are not using genuine nRF24L01+ but Si24R1 instead (labeled as nRF24L01 ...), they are supposed to be compatible, but they're not when using dynamic payload with auto ack:
hackaday.com/2015/02/23/nordic-nrf24l01-...ake/#comment-2474764
fortunately very few protocols make use of this mode, and when they do the ACK packets can be ignored without much issues most of the time ...

Here the problem is different, we're emulating a xn297 with a nRF24L01 (or Si24R1, we don't care, as everything is emulated in software).

To be honest, I used SDR but a simple nrf24l01 + arduino would have been enough, just that I didn't remember that I modified my nrf24 sniffer some time ago hence I thought I only got noise when I first tried.

Anyway, here's what I used, but that's not "universal":
- hardware: HackRF One
- sniffing + gfsk demodulation: gnuradio, with this .grc: www.dropbox.com/s/sk28appcfpwtkap/xn297_gfsk_demod.grc?dl=1
- decoding: www.dropbox.com/s/36og270vm42zu9u/gw008_decod.cpp?dl=0 (C/Qt, though it should be easy to get rid of Qt, I'm only using QFile).
- crc cracking: reveng
- music: Sex Pistols + Green Day + Ska-P, perhaps the most important part of the setup, no music, no code
Note that as it is, it does only decode xn297 scrambled packet with CCCCCCCCCC address, enhanced packet mode and 15 byte long payload, that's just some dirty code, but it should be easy to modify for other purposes.

My SDR toys

Caerus wrote: So this has nothing to do with inferior hardware.... just a new software/RF puzzle you haven't seen before?

Yes, this is the first XN297 protocol that's using enhanced packet mode, I've added code to generate those "enhanced" packets yesterday, still not tested tho.

Success !

Test builds: www.dropbox.com/sh/kzbq09i0n0n4p5y/AADNB...7BieEsGlf_jy-Xa?dl=0
Diff: github.com/DeviationTX/deviation/compare...rotocol_gw008_xns104

New protocol: GW008
Only 1 Tx ID, I doubt I can do anything better with only one stock Tx, but I'll have a try later ...

Still requires a bit of cleanup and I haven't implemented flips yet, please report if it works on your side

Ah Ok, probably the quad transmits its ID at some point, I'll check that.

edit: looks like it's a 1 byte ID ( 0x18 here ?), I'll try to find how to grab it, worst case it will be a protocol option and you'll have to manually find your ID (out of 256 possibilities )