Furibee F36 protocol attempt

Could you please share a pinout for the TX IC? Power, GND, XTAL, antenna and analog pins would be interesting. Let's assume they are using the same vendor's IC is in the TX.

I have asked the NST for datasheets, and I got a package from them which (of course) did not contained any more comprehensive material, but shown some hints.
www.dropbox.com/s/v4p6pfhgl55lhpa/NST_Pack.zip?dl=0

I have realized that the same chip also manufactured/sold by the company called Levetop:
www.levetop.com/ch/product1_5916.html

Their available datasheet seems to be less comprehensive:
www.levetop.com/data/LT5916_SS.pdf

At least the have a dev tool package available. I am still downloading it to see if they have some interesting headers or whatever inside. Stay tuned!

Interesting stuff

In the zip there are some hex encoded files, and they have what appears to be a similar encoding to the on-air protocol.

Since they have both in and output files ( I think ) perhaps they can be used to figure out how it's done. They call it "encryption" but I don't see why anyone would need it for programming the chip

If my understanding is correct there is a standalone device used for factory programming and you can download the "SSL" encrypted firmware files to it.

BTW: Have you had a chance to lookup the TX IC pinout?

I have installed the development tools available at the Levetop's website, and there are not so much interesting stuff (regmaps, datasheets whatever).
It installs an Eclipse based IDE, mcore-elf-gcc and gdb, and STLINK drivers

The toolchain vendors seems to be the C*Core (chinacore: www.china-core.com )

It might support st-link too, there is a INT/SWD pin.

The tx chip is a different kind, most likely a 8 bit OTP.

It seems the quadcopter's IC might have been designed for quads in particular, it has 4 pwm pins, and their development board has gyro and a motor driver on it.

their development board has gyro and

Where have you found this dev board?

Is that the "Co_Setup" development tools that you downloaded? Is there any reference to the LT5916 in it? The reason I'm asking is that the download description says it is for the LT32 series.

Correct, I have mentioned the Co_Setup. There are not any references to the LT5916 series in it.
If I think well our subject (LT5916) uses the same core so there were a chance that it would be also supported.

In the nst_pack.zip there is LT5910 demo board schematic pdf.

Ah okay, but that schematic has LT5910S-SO16 in the title, which is confusing because that MCU look like a bigger one in QFN48 package.

Good news guys!

I have not stopped pinging our friends at NST, so they have given me what I (we) wanted.

It turned out that the LT5916 is basically a LT32A01 and an LT8920 packaged together:

This is LT5916 detailed data sheet, where 5916内核 is the mcu part of LT5916, where LT8920 is the RF part of LT5916.

They were kind enough to provide a Chinese datasheet for the LT32A01 (marked with NDA labels even if I have not signed anything with them), and an English datasheet of the LT8920.

I have found LT8920 on the ebay in small quantities:
www.ebay.com/itm/5PCS-X-LT8920-LT8920TSS...7:g:1F8AAOSwIWVY-a3M

My first Furibee seems to be lost on the long way from China, but I am expecting the next one to arrive this week. I will order some from these LT8920 and design some breakout board for them.

Stay tuned!

Fingers crossed! Thanks for not giving up

I have a F36. If you can find the pins that we can tap on, I would do the capture.

LT8920 Datasheet in Chinese:

www.wlxmall.com/images/stock_item/att/AT1698357.pdf

Hi wasp09,

Unfortunately you cannot access the SPI physically because basically they have integrated the radio and MCU dies into one package.
The datasheet what you have linked is the same what I have attached in the previous post in English, just this is an older one and in Chinese.

I have "diffed" the LT8910 (which was tried by @goebish before) datasheet with the LT8920 and found the following differences:
** The register 32 [5:4] is marked as reserved in the LT8910 while in the LT8920 it could be used for the FEC mode. If I recall correctly goebish already played with these fields with an LT8910, and I have found some references to it in the following library: github.com/534659123/LT8910
So somehow this information has it's roots.
** The register 41 14th bit is SCRAMBLE_ON instead of reserved. It is interesting because there is a Scrambling data register in the LT8910.
** The register 45 is documented with some "best values" for separate data rates.

The most fun is the fact that the LT8920 datasheet you have linked marks the mentioned bits reserved too.

I see.

LT8920 is supposed to be the improved version of LT8910.

Found a link to sample code but it may require membership and Chinese to download and browse:

en.pudn.com/downloads787/sourcecode/comm//detail3112239_en.html

I have pudn account but the download links says invalid ID at both mirrors.
Anyway all necessary information is in the datasheet, and mainly seems to be compatible with the LT8910 where libraries already exists.

Perhaps you can try asking the uploader:

s.pudn.com/upload_log_en.asp?e=3066051

I have commented about the issue because the private message sending seems to be broken there.

But anyway, I assume that is just an example code how to use the LT8920 with an STM8, which might reveal some things, but the most important things should be available from the datasheet attached before.

I am still waiting to my Furibee to arrive. My LT8910 and LT8920 SMD pack is on it's way too.
BTW I have found a nice LT8920 module on Amazon:
www.amazon.com/Icstation-Wireless-Transc...erface/dp/B01N7CY6TT

Unfortunately it does not ship to my country

Ah it seems to be that the ebay is full of these XY-WA and XY-WB modules which seems to be populated with LT8920, for price ~1 USD.
I think I have also found above mentioned STM8 sources. I have added them to my NST pack in the case if anyone would be interested:
www.dropbox.com/s/v4p6pfhgl55lhpa/NST_Pack.zip?dl=0