Help to find the protocol for JJRC H31 please!

Making some progress, parameters:

LT8910
62.5 kbps
base frequency: 2402 MHz
channel spacing: 1 MHz
gfsk modulation, deviation: 225 (avg) - 280 kHz (max)
NRZ line coding
no FEC
3 byte preamble
32 bit syncword
4 bit trailer
crc enabled
crc init = 0x00
no scramble
no auto-ack
packet length = 1st byte of payload

annotated bind sequence:
gist.github.com/goebish/25d28ae2086eff31fb3b3df33eca19ae

Nothing sure yet, but it might be possible to emulate it with the cc2500.

First attempt, can't get it to bind so far.
github.com/goebish/deviation/blob/protoc...col/jjrch31_cc2500.c
More debugging required ...

No, I've tweaked base frequency and gfsk deviation with protocol options so they're the same as stock transmitter (checked with SDR) but that still doesn't work.
Still trying stuffs ...
I'm no genius, just a hacker trying stuffs until it works ... or not

I'm not at home this week, I'll continue during the week-end

An oscilloscope is useless for this kind of work, required tools are a logic analyzer and a SDR device (I use a HackRF One).
The LT8910 is working fine, I'm sure of that because the stock Tx can bind to the Rx. And I'm sure my cc2500 is fine as well.

I spent some more time on it, that's weird, my emulated protocol does exactly what I expect:
(here sending bind packet):


But that's not the case of the stock transmitter:


I'm not sure what's wrong (tried demodulating for every supported LT8910 bitrates with no consistent result), I see in the logic analyzer dump that the stock transmitter writes to a lot of undocumented LT8910 registers, I've to connect a LT8920 breakout board (that's all I have ...) to an Arduino to make some tests.

I don't give up yet, but more work is required, just be patient

there's no variable or rolling code, that's not a keyfob

The other Tx/Rx is using a LT8920, I'll probably have the same issue with it, except if it's using 1 Mbps bitrate, I haven't checked yet.

Just be patient

Don't worry, even if I don't post here, work is going on behind the scene, we're 3 people looking at your stuffs

And in worst case, if in a few weeks I've not been able to make it work here's the deal: if you've a T8SG V2 plus (or another transmitter with JR module bay) I'll send you an external LT8920 module that can do both protocols.