EAchine E012

Hi there !

SeByDocKy has found that the new EAchine E012 Tx is using an HS6200 transceiver, I might be able to emulate it with the nrf24l01, only if the protocol is not using 500kbps bitrate.

Can someone make a dump of the SPI bus in the stock Tx so I can check that ?

Here's the pinout:


I need CE, CSN, SCK, MISO, MOSI and IRQ (GND = VSS)

If it's using 1Mbps or 2Mbps bitrate I should be able to add it to Deviation once I get one (I'll need one because captures over the air are necessary to reverse the scrambling).

As I said, don't ruin your Tx if you're not confident enough with the soldering job, nobody is in a hurry, right ?

Note that if it's using 500kbps I might still be able to emulate it with the A7105, it will just take more time as I've less expertise with this transceiver than the nrf24l01.

Seems clock & enable are wrong, maybe their wires are shorted with other pins somehow ?
Also, enable in Logic should be connected to CSN (Chip Select when Negative), not CE.

if there are too many wires, capture only CSN, MOSI & CLK (+GND connected, of course, you can connect it to battery -), that should be enough for what I want to check.

Clock seems almost Ok (but it's not), but csn is definitively wrong, you should see 1 negative pulse on CSN for 16 pulses on CLK.

Can you post a picture of your wiring ?

Also, capture at 20 or 24 MHz as the max SPI clock rate for HS6200 is 10MHz.

Well, don't spend too much time on that (and don't kill your Tx!) directly connect ground to battery - and try to keep the wires as short as possible as it seems it's using a rather high clock rate.... and the kind of wires you're using, wrapping wire, is far from being ideal for this job (you should get some stranded 30awg silicone wires such as www.ebay.com/itm/1M-3-3ft-30AWG-Flexible...6color-/252562300800 ).
I'll just order one

Yeah, wrapping wire sucks for this kind of job
It's meant to be wrapped around some pins with a special tool, not soldered:

Ok thanks,
0x26 0x40 = 1 Mbps bitrate, so it can be emulated with a nrf24l01.

I'll order one because dump over the air is required to capture and implement the whitening ...
Meanwhile I'll write a HS6200 decoding script ...

Ordered ... should take 2-3 weeks to arrive.

The protocol seems simple... data address & hopping frequencies are sent in clear text during bind, shouldn't be hard to implement, also I've already written some code to emulate the HS6200 some time ago , I'm only missing a few scrambling bytes which I've to capture over the air.