EAchine E012

raw packet: 55 55 3c 27 af 81 a0 ad bd 14 39 f3 e9 e0 fe e0 99 b3 59 7b fa 
guard: 55 55
len: 15
pid: 0
no ack: 0
raw payload        : 4f 5f 03 41 5b 7a 28 73 e7 d3 c1 fd c1 33 66 
unscrambled payload: cf aa 38 4c 36 50 d1 cf b6 5d 8d 00 00 56 b6 
crc: b2 f7

raw packet: 55 55 3d 27 af 81 a0 ad bd 14 39 f3 e9 e0 fe e0 99 b3 79 4f 39 
guard: 55 55
len: 15
pid: 1
no ack: 0
raw payload        : 4f 5f 03 41 5b 7a 28 73 e7 d3 c1 fd c1 33 66 
unscrambled payload: cf aa 38 4c 36 50 d1 cf b6 5d 8d 00 00 56 b6 
crc: f2 9e

raw packet: 55 55 3e 27 af 81 a0 ad bd 14 39 f3 e9 e0 fe e0 99 b3 19 12 fb 
guard: 55 55
len: 15
pid: 2
no ack: 0
raw payload        : 4f 5f 03 41 5b 7a 28 73 e7 d3 c1 fd c1 33 66 
unscrambled payload: cf aa 38 4c 36 50 d1 cf b6 5d 8d 00 00 56 b6 
crc: 32 25

raw packet: 55 55 3f 27 af 81 a0 ad bd 14 39 f3 e9 e0 fe e0 99 b3 39 26 2b 
guard: 55 55
len: 15
pid: 3
no ack: 0
raw payload        : 4f 5f 03 41 5b 7a 28 73 e7 d3 c1 fd c1 33 66 
unscrambled payload: cf aa 38 4c 36 50 d1 cf b6 5d 8d 00 00 56 b6 
crc: 72 4c

HS6200 rf frame: preamble (55/aa) | address (4-5 bytes) | guard (2 bytes, default = first byte of address) | PCF (6 bit payload length + 2 bit PID + 1 bit no_ack flag) | scrambled payload (0-32 bytes) | optional crc (1-2 bytes)
scramble (xor): 80 f5 3b 0d 6d 2a f9 bc 51 8e 4c fd c1 65 d0
crc: CRC16/CCITT-FALSE, LFSR fed with address in reverse order + PCF + scrambled payload
crc poly: 0x1021
crc init: 0xffff
crc xorout: none

bind:
-----
address: 55 42 9C 8F C9
rf_ch: 3c

00 01 02 03 04 05 06 07 08 09 10 11 12 13 14
CF AA 38 4C 36 50 D1 CF B6 5D 8D 00 00 56 B6

00 address[1]
01 aa
02 rf_ch[0]
03 rf_ch[1]
04 rf_ch[2]
05 rf_ch[3]
06 address[0]
07 address[1]
08 address[2]
09 address[3]
10 address[4]
11 00
12 00
13 56
14 address[2]

data:
-----
interval: 4525 us
address: sent during bind
rf channels: sent during bind

00 01 02 03 04 05 06 07 08 09 10 11 12 13 14
cf 01 64 64 64 00 aa 02 00 00 00 00 00 56 b6

00 address[1]
01   01 
    |04 : right trigger (only if throttle > 0)
    |10 : left trigger 
    |40 : flip
02 aileron 00 - c8
03 elevator 00 - c8
04 rudder 00 - c8 
05 throttle 00 - c8
06 aa 
07 02 high rate
08 00 
09 00 
10 00 
11 00 
12 00 
13 56 
14 address[2]