Cheerson CX35

Please Log in or Create an account to join the conversation.

Replied by goebish on topic Cheerson CX35

ajtank wrote: Oh just read your message again, you mean you teach me how to collect info from the receiver?

That's not different from capturing the transmitter
I just need that you set some "special" IDs on the Devo transmitter, try to bind with them (that will fail, that's normal), then give me the captures from the receiver during those failed attempt.
Those captures will tell me which frequencies are expected by the RX for some given transmitter IDs.

Please Log in or Create an account to join the conversation.

Replied by ajtank on topic Cheerson CX35

I am more than willing to assist

Please Log in or Create an account to join the conversation.

Please Log in or Create an account to join the conversation.

Please Log in or Create an account to join the conversation.

u8 freq[16] = {0x23, }; // seems to be constant
u8 X = ???
for(u8 hop=0; hop<15; hop++) {
    freq[hop+1] = freq[hop] + X;
    if(freq[hop+1] > 0x46) { 
        freq[hop+1] -= 0x33;
    }
}

Please Log in or Create an account to join the conversation.

Please Log in or Create an account to join the conversation.

Replied by goebish on topic Cheerson CX35

Ok, the RX cycles through all the 16 channels while the TX transmits on only 4 ... that's terrible, while the TX sends one packet every 3 ms, the RX gets only about 1 out of 10 ... bad design

Now I've to wrap my head around the offset (X) calculation ...

Please Log in or Create an account to join the conversation.

Please Log in or Create an account to join the conversation.

Replied by goebish on topic Cheerson CX35

I think I won't need the 2nd TX capture, I almost understand how to calculate X ... I'm still on it, I might need more captures with different TX ID, I'll let you know

Please Log in or Create an account to join the conversation.

Replied by goebish on topic Cheerson CX35

... Also, once implemented properly, the deviated protocol should be way more reliable than the stock transmitter
I really don't understand why stock transmitter uses only 4 frequencies out of 16... the rx has to try to resynchronize all the time, so in the end only 2 frequencies are received by the rx ...
www.dropbox.com/s/8ee0bstelejlydi/CX35_R...th_stock_TX.txt?dl=0
(0x17 and 0x1d here)

Please Log in or Create an account to join the conversation.

Replied by ajtank on topic Cheerson CX35

It looks like you are interested to understand how the rx hops more than tx
If tx only hops among 4 channels and one of them is fixed then it should be easier to guess its relationship with the id

Please Log in or Create an account to join the conversation.

Replied by goebish on topic Cheerson CX35

Yes, I want to understand, better implement the protocol properly, not like stock Tx

Please Log in or Create an account to join the conversation.

Please Log in or Create an account to join the conversation.

Please Log in or Create an account to join the conversation.

Replied by goebish on topic Cheerson CX35

Wow, I just had another look at the CX10D (not WD) tx captures, seems the id / rf mapping is the same than cx35 rx (16 rf channels), 2 birds with one stone !

CX10D capture (tx 1):
tx id: 03 25 71 98 --> X = 6 + ((03 & 7)*3) = 0x0f
freqs: 23 32 41 1d 2c 3b 17 26 35 20 2f 3e 1a 29 38 14

that matches with what I found above

... but ... that doesn't match with a 2nd CX10D tx capture, where "base freq" is 0x2e instead of 0x23 (the rest still matches), I hope the new set of IDs (12-24) will help to understand that.

CX10D capture (tx 2):
tx id: 97 79 98 78 --> X = 6 + ((0x97 & 7)*3) = 0x1b
freqs: 2e 16 31 19 34 1c 37 1f 3a 22 3d 25 40 28 14 2b

Please Log in or Create an account to join the conversation.

Please Log in or Create an account to join the conversation.

Replied by goebish on topic Cheerson CX35

Thanks, that generated plenty of frequency sequences that do not have 0x23 as base freq, hopefully I should be able to understand with that

Please Log in or Create an account to join the conversation.

Replied by goebish on topic Cheerson CX35

... I might need more captures later, sorry, I thought it would be as simple as the Q303 protocol, but I was wrong

Please Log in or Create an account to join the conversation.

Please Log in or Create an account to join the conversation.