Cheerson CX35

Cool, that's some good progress, I'll have a look at your new RTH capture this evening.

I still can't find the RTH flag, I think it can be enabled only after take off.

If you redo the captures, try to have only 1 action per file, so that's less confusing.

Thanks, but that's still confusing, looks like the flags don't work as I'm used to.
I'm sorry, I think I'm starting to understand, but I'll need a few more captures:

- bind, take off then press rate button 5 times
- bind, take off then press photo button 5 times
- bind, take off then press video button 5 times
- bind, take off then move elevator stick up for a few seconds, release the stick then press RTH button

I still can't see anything in the RTH captures, that's weird.

Also, how many rates does it have, 2 or 3 ?

Ok, now I understand, thanks

The last byte of the packet doesn't have boolean flags (as most protocols have), but holds the "code" of the last button that has been pressed on the transmitter, and some buttons can have 2 "codes", eg the photo snapshot button, so you do not have to press another button before you can take another photo ...

packet[9] =
rate: 0x09 / 0x29
take off: 0x0e
descend: 0x0f
snapshot: 0x0b / 0x2b
video: 0x0c / 0x2c
RTH: 0x11 / ??? (probably 0x31 if I follow the pattern, need another capture to confirm ...)

Looks like each button has only 1 "code" actually, then 0x20 is toggled if the same button is pressed several times in a row, so the RX knows the same button has been pressed gain.

Your last rth capture was fine, but I'll need another one, because I think I know how to enable it now, but not how to disable ...
I need:
- bind, take off then move elevator stick up for a few seconds, release the stick then press RTH button, wait a few seconds then press RTH again.

No problem, that's not difficult but it doesn't work the same than what I'm used to, hence I was confused by the first captures

New test builds (Q303 protocol / CX35 format option):
www.dropbox.com/sh/rtlponu4hcctzcr/AABsu...zHk87LdpioQxP7a?dl=0
source

First test normal version, if it doesn't work then check the "fixed_ID" version.
Everything should work, but better test without propellers first

No emergency stop ?

Yes, a capture from another transmitter would help.
I do not have a CX35 FC, let's wait another capture, perhaps that will be enough to figure out how it works.

I'm not sure how it works, there's nothing interesting in the capture, no changes in the packet that's sent, the last byte is always 00, as if no buttons was pressed on the transmitter.
www.dropbox.com/s/qvm4pjr36bt244m/CX35_FPV_button.txt?dl=0

I don't think so, the video part in the transmitter is only a vRX, and there's no way to directly send this kind of data between a vTX and a vRX anyway.

Are you sure that you pressed the proper button to change vTX frequency (FREQ-T) during the capture ?
I can see in the manual that vTX and vRX frequencies are set separately (that's weird !).