- Posts: 10
WLToys Q303
14 Dec 2016 14:54 - 15 Dec 2016 02:48 #56818
by ajtank
Replied by ajtank on topic WLToys Q303
One may purchase genuine chips according to the information listed on the manufacturer
website
or purchase a known good module
here
and swap the chip. I got mine from Arrow USA.
Goebish can you tell where you purchased the chips for your module ?
To replace the chip and capacitor one needs to get rid of the screening can first. I use solder wick to remove all the solder at the 4 joints. Then lifting the can up is just a piece of cake. There are a lot of videos on Youtube about the soldering of a QFN, e.g. here. The capacitors are located on the adjacent sides of the crystal, see below in red rectangles:
Goebish can you tell where you purchased the chips for your module ?
To replace the chip and capacitor one needs to get rid of the screening can first. I use solder wick to remove all the solder at the 4 joints. Then lifting the can up is just a piece of cake. There are a lot of videos on Youtube about the soldering of a QFN, e.g. here. The capacitors are located on the adjacent sides of the crystal, see below in red rectangles:
Please Log in or Create an account to join the conversation.
15 Dec 2016 10:53 #56835
by goebish
Replied by goebish on topic WLToys Q303
I just received your FC, thank you very much for already having soldered leads to the RF board, I only have to connect it to my analyzer 
Now I'll try to understand the tx id / rf channels algo, or at least generate enough to avoid interferences if many people fly Q303 with Devo transmitters at the same time (unlikely, but still
)
Now I'll try to understand the tx id / rf channels algo, or at least generate enough to avoid interferences if many people fly Q303 with Devo transmitters at the same time (unlikely, but still
) Please Log in or Create an account to join the conversation.
15 Dec 2016 12:58 #56842
by brylant
Replied by brylant on topic WLToys Q303
@goebish: do you have any legit spare chips...? I'd take two off you 
Please Log in or Create an account to join the conversation.
15 Dec 2016 15:11 - 15 Dec 2016 15:11 #56844
by goebish
Replied by goebish on topic WLToys Q303
Work in progress for the Q303 ... that's a real pleasure to crack a protocol when we can tap onto the RX to retrieve expected frequencies with crafted transmitter IDs
I still have to check a few stuffs but the algo seems really simple.
I still have to check a few stuffs but the algo seems really simple.
Please Log in or Create an account to join the conversation.
15 Dec 2016 15:30 - 18 Dec 2016 03:53 #56845
by goebish
Replied by goebish on topic WLToys Q303
So, it's extremely simple ...
TX id is 32 bit long (arbitrary), but only 2 bits are used to generate the frequencies sequence (4 hops), yes, there are only 4 possible sequences ...
and to answer your previous question, the lower frequency it can use is 2470 MHz and the higher one is 2479 MHz.
I suppose the CX35 is using a similar pattern but with a different base frequency (0x46 here), we'll have to check that
edit: if this theory is verified, the cx35 is using 0x14 as base channel and channels are spaced 3 MHz apart instead of 2MHz on the Q303, ie:That matches with what you captured from the CX35 transmitter:
ID: 24 37 46 89 (offset = 0x24 & 3 = 0)
RF: 14 17 1A 1D
TX id is 32 bit long (arbitrary), but only 2 bits are used to generate the frequencies sequence (4 hops), yes, there are only 4 possible sequences ...
u32 txid = 0xb8696467; // any arbitrary value
u8 freq[4];
u8 offset = (txid >> 24) & 3;
for(u8 ch=0; ch<4; ch++)
freq[ch] = 0x46 + ch*2 + offset;and to answer your previous question, the lower frequency it can use is 2470 MHz and the higher one is 2479 MHz.
I suppose the CX35 is using a similar pattern but with a different base frequency (0x46 here), we'll have to check that
edit: if this theory is verified, the cx35 is using 0x14 as base channel and channels are spaced 3 MHz apart instead of 2MHz on the Q303, ie:
freq[ch] = 0x14 + ch*3 + offset;ID: 24 37 46 89 (offset = 0x24 & 3 = 0)
RF: 14 17 1A 1D
Please Log in or Create an account to join the conversation.
15 Dec 2016 16:06 - 15 Dec 2016 16:13 #56848
by ajtank
Replied by ajtank on topic WLToys Q303
Great !! The everlasting exploration is coming to an end
Please Log in or Create an account to join the conversation.
16 Dec 2016 14:03 - 16 Dec 2016 14:06 #56885
by goebish
Replied by goebish on topic WLToys Q303
Next is the CX35, if my theory is right, that's 2 birds with 1 stone
Please Log in or Create an account to join the conversation.
Time to create page: 0.132 seconds
-
Home
-
Forum
-
Development
-
Protocol Development
- WLToys Q303