Appreciate any help with replicating a cheap quadcopter remote control - Page 1
Forum section: electronics / projects

author: omeriko9
author_rank: Newbie
timestamp: July 20, 2015, 10:07:46 pm
content: Hello everybody! My first time hereEE & hardware reversing is a major hobby of mine. After many hours of EEVblog videos, I've found myself wandering around this forum pages, and thought it might be a great place to try get some help from you guys.For couple of weeks now, I'm struggling to replicate a cheap quadcopter's remote control (several models, actually), by using an Arduino Nano with NRF24L01. I have experience with this configuration and have done a couple of projects using this nice 2.4Ghz transceiver. So I've used a Saleae 4 channels logic analyzer to sniff the SPI bus from the RC's MCU to the BK2423 (NRF24 air-compatible).I've figured out most of the initialization, channels and address settings, by carefully following the BK2423 specs, yet I've failed every time :\ After many weeks of trying different commands/timings, I've come to the stage where I make the NRF24 replicate the exact same messages (channels changes, payloads changes, addresses, timings), but the quadcopter simply won't bind or response...I've uploaded my question tohttp://reverseengineering.stackexchange.com/questions/9331/reversing-a-2-4ghz-quadcopter-remote-controlwith all the links and pictures, got some leads, but no solution.Anyone here with some experience replicating RC? What might I be missing here?...

author: Mechatrommer
author_rank: Super Contributor
timestamp: July 21, 2015, 02:07:18 am
content: Quote from: omeriko9 on July 20, 2015, 10:07:46 pmhttp://www.rcgroups.com/radios-135/

author: Alex Eisenhut
author_rank: Super Contributor
timestamp: July 21, 2015, 03:41:44 am
content: ..but how does this module bind to your quadcopter?

author: omeriko9
author_rank: Newbie
timestamp: July 21, 2015, 08:41:14 am
content: Quote from: Alex Eisenhut on July 21, 2015, 03:41:44 amWell what I have discovered is that, surprisingly, the remote control does not listen to the quadcopter at all! Not even on the interrupt channel. The remote control broadcast it's messages to the air, and when the quadcopter finds something he likes, he happily binds and response to the RC commands.I have all the commands parsed, and I'm sending the same, but it still won't response.Quote from: Mechatrommer on July 21, 2015, 02:07:18 amYeah I had dilemma about posting here. It's not a pure "This low pass filter cutoff mismatches the spec of this capacitor with values bla bla" analog circuit question. Unfortunately I am not trying to replicate one of the well-branded RC models, but a cheap Chinese one, which makes this project more of a reversing signal process.I would still much appreciate anyone with tips or experience with this matter.

author: bance
author_rank: Contributor
timestamp: July 21, 2015, 05:10:01 pm
content: I was thinking about doing something similar with the A7105 Hubsan X4 protocol, I've no idea if this is feasible or if I have the neccessary skills......However, I did find this post which goes into some depth about the binding process, it's not exactly what you're looking for, but it may be of some help.....http://www.rcgroups.com/forums/showthread.php?t=1773853Steve.

author: Alex Eisenhut
author_rank: Super Contributor
timestamp: July 21, 2015, 10:51:30 pm
content: I'm not sure I understand. The RC stuff uses specific protocols like DSM2 with spread spectrum. It just happens to be on 2.4GHz. That's why they use spread spectrum, so they can use unlicensed spectrum and cohabitate nicely.If your 2.4GHz module isn't designed for that, how can it work? It's not enough to just send out at 2.4GHz, IMO. Each DSM transmitter has its own UID so the quadcopter can remember what it's binded with.Your module looks like a high bandwidth data sender-outer. A RC radio even for a quadcopter just spits out 60 frames a second of very simple data.Are you sure it even has enough range? I've flown quads out of sight...https://en.wikipedia.org/wiki/Radio-controlled_helicopterunder "Spread spectrum"I didn't see anything resembling that in the NRF24L01 description. I'd buy a DSM2 module and play with that.

author: hendorog
author_rank: Super Contributor
timestamp: July 22, 2015, 12:01:22 am
content: OP said the RC protocol in use is compatible with the NRF24 - I'm guessing its one of those toy indoors nano size quads from China, so not the same as standard RC gear.QuoteIf you have access to an SA you could compare the RF protocol between the two.Also, stating the obvious, but that page you pointed to has an update with NRF24 code:https://dl.dropboxusercontent.com/u/2248531/blog/nfr24L01_mod.zip

author: omeriko9
author_rank: Newbie
timestamp: July 22, 2015, 12:39:47 pm
content: Quote from: hendorog on July 22, 2015, 12:01:22 amExactly.The Arduino code that guy posted is pretty much useless as I've discovered that each remote uses a different set of predefined assumptions. Some of them actually perform binding and listens to Rx and some just assume the drone will bind without verifying.I have no access to a spectrum analyzer or other fancy equipment, just the logic analyzer, but I did ordered a couple of BK2423 just to make sure that's not the issue. Other then replication of the exact commands I'm pretty lost on what to check next...