cleric-k / flyskyrxfirmwarerssimod Goto Github PK

First off, thank you for your excellent work! I already installed the mod on a FS-A8S.
FlySky has recently launched a new receiver that supposedly extends the range to over 1.5km. Which is very exciting if true. I haven't tested it yet but here is the manufacturers own test: https://www.youtube.com/watch?v=TCdAkFM6Va4&t=23s

My question: I'd like adapt your RSSI mod to the FS-X14S (which would be very useful considering the extend range of the receiver). Could you point me in the right direction of how to do so? (I imagine the first step is to extract the firmware.) If it's successful you can add the mod to your list of modded receivers so others can also benefit from it.

Hi,

this is awesome!! :-) It would be very interesting if you would document the process of how exactly you made the patch and if you would explain the syntax used in .ld and makefile. I am assuming you used IDA or Ghidra to reverse the firmware and when you located the function for processing the incoming data and the address of the call of the function you named prepare_ppm_buf(buf) then you replaced the call address with the address of your code from inject_rssi.c. From the code I can see you located the address of the get_signal_strength() too and deciphered how the value should be calculated. Of course, for writing the code you had to decipher the prepare_ppm_buf(buf)'s function signature as well.

Seems as you located the free space at 0x0800392A where you assembled the code to be injected and you patched the CRC check with nop.

I wonder how much free space is at 0x0800392A and if it would be possible to hardcode the bytes to a few unused channels so that data could be read via iBUS.

For example, I'd like to hardcode bytes e.g. 0xc9 0xa8 to channels 10 and 11 to be able to identify the receiver by reading the iBUS data via a microcontroller.

I connected a new FS-X6B (bought about 2 weeks ago from Hobby King) to my ST-LINK V2 (updated to latest firmware), attempted to read it, and got the message

Can not read memory!
Disable Read Out Protection and retry.

So, I opened up the Option Bytes menu and set Read Out Protection to Level 0. That was my mistake. Apparently this completely erases the device memory, and it's now bricked. The LED no longer turns on, with or without the Update button pressed, and it never responds to the ST-LINK. Any hints for unbricking it?

EDIT: On the PCB, the board is labelled V1.1 20160719

Hi! I saw your modification for the X6B and ia6b receiver and it was an extraordinary work.
I have also ia6c receivers on my mini quads and I would like to contribute to this project with the rssi modification. Can you help me developing the solution?

Thanks for your time, it is realy useful.

Hi,
the x6b version of RSSI modified firmware appears to be based on the original firmware that had an issue with failsafe when using ibus in BF/iNav (holds channel values by default). Could you please source it from the fixed one? It is available here:

https://github.com/povlhp/FlySkyRxFirmware/tree/master/firmwares.

Best Regards,
Tomasz.

IA8X AND IA8S are the two receivers included with the FlySky Nirvana. Any way to get fw with RSSI on ch 14 for those 2?

Let me know what I can do to help. I have an stlink and both those rx chips....just lack the knowledge to code

I flashed the firmware on Flysky X14s, but can someone confirm that this receiver can provide full bidirectional single wire telemetry capable Ibus ?

I assume Transmitter must be set Ibus, at the Receiver the Sbus pin will than be outputting Ibus?
Will it also be bidirectional capable, so accept telemetry from flight controller?

To do so I want to connect to Uart Tx1 (uninverted) betaflight:
I enable serial Rx, select ibus
I enable telemetry

in CLI set the port:
serial 1 4160 115200 57600 115200 115200
set serialrx_halfduplex = ON
set tlm_halfduplex = ON
set serialrx_inverted = OFF
set tlm_inverted = OFF

any succes stories on this?

When I set sbus in betaflight and sbus in the evo, moving the sticks don't show in betaflight

Hello,
I flashed my receiver today with an stlink v2. After the flash it seems bricked. Doesnt power on at all. No led no heat of of it. It was brand new out of package. I powerd it with 3.3v gnd and connected clock and data interface so my stling. Dumb me created no backup. Is there any chance of saving the thing or is it 100% gone. When i connect it to the stlink again there is 0 signs of life. It doesnt even connect to the stlink.

Thanks for your work on these firmwares, it's brilliant! I don't understand how you managed to reverse engineer the binary but I like it a lot :)

Anyway, back on topic... I have a flashed 3x iA6B, 2x X6B, and 2x 2A ver2.0. Obviously I was most excited for the 2A but it doesn't play nicely on either of the 2 I have. Interestingly 1 is form Banggood and 1 is from ebay but they both have identical firmware and behave the same on the mod'd f/w. All other receivers work fine.

When I flash either of your ch8 or ch14 2A binarys to my 2As they just blink in groups of 4 or 5 flashes with a gap inbetween them, but don't connect to my Tx or give an ibus signal.
It works if I inject the byte at 10FC from my binary into yours then flash, but then I lose telemetry on the Tx. Previously it would send back Rx voltage. I've attached my original f/w from the 2A's, would you please be able to take a peek for me when you have the time?

I would have tried to use the script to modify my firmware but it's unclear to me what dependencies the code and compiler have, or how we use it. I'm guessing it's a case of replacing the 8A_orig.bin with mine and then issuing some command?

Thanks again
Original flysky 8A binary.zip

Hi, I have been given a receiver from a 'flying Fy-X8' quadcopter. The quadcopter looks like this one:

https://www.google.com/search?q=flying+fy-x8&tbm=isch&ved=2ahUKEwjansnqgePyAhUMlBoKHZogBp0Q2-cCegQIABAA

I am thinking it is similar to Flysky Ia10b receiver?

FY-X8 receiver:

Flysky ia10b receiver:

The FY-X8 receiver has no pin connection for ibus servo/sens.
However, looking at the pcb picture there are 2 extra 3-pin pcb pads - which might suggest they are the 'missing' ibus servo/sens connections?

Do you think it is possible to flash it with ia10b firmware? I have no ia10b to compare pcb traces, just internet photos.

Both use stm32 & a7105

Seems the patched firmware do not support sensors on X6B receiver as after reflashing the FS-i6x not showing this info anymore.

Hi all i'm new and i need an help.. i tried to flash my x6b with stlink utility, first time i don't get it working but after switching the power form 3.3v to 5v (+vcc pad on the receiver) it worked but the utility say to me "Can not read memory! Disable Read Out Protection and retry"
.. after a research i set on Option Bytes menu, Read Out Protection to Level 0.. now my receiver is bricked i think.. the red led no longer turns on.. on another closed issue here i see another member with the same problem, so i follow the procedure wrote by Clericto connect under reset the board. but it not work properly.. (image attached).
what can i do?

Hi, I just received my new flysky fs-x14s receiver. But i cannot bind it with my transmitter (fs-i6X). The green led from the receiver is flashing and on the tx screen is remaining on "RX binding ..".
I have tried to update my tx and also my rx but no success binding.
Also I have tried:
*Setup the TX on SBUS => still not binding
*Factory rest TX => still not binding...

Do any of you encounter this problem? any suggestion will be much appreciated.
Thank you in advance.

Hello, I had a problem with my x6b receiver, first I tried to connect to target from st-link utility but cannot read memory because it has read out protection I don't know why(I think what I have read on internet could be when I open st-utility first time and set size to 0x8000 instead 0x1000 this change lock the memory but I'm not sure) , second I try bytes option to set level 1 to 0 but I didn't see that this mass erased the chip before RDP is set to 0 and I hadn't any firmware after that and now I couldn't connect to the chip in normal or under reset mode so finally I connected to the chip putting in hot plug mode(only mode that worked for me I read on internet too) and flashing your modded firmware for channel 14 but now I hadn't a backup of my original firmware, it would be perfect if you could upload it thought I think I will never use it again. Thank you.

As title states; iBus signal has for some reason lost it's pull-up, so the data is invalid.
I've had this receiver working for about a month but only used it maybe 25 times, it's in a micro that I fly in the back garden when I get a chance. Yesterday after 2 packs I plugged in the 3rd as normal (No crash between packs) but the craft wouldn't arm. Tx is bound fine, solid red light on the Rx, all wiring intact.
I swapped another using the same wires as they're cut to length, all working.
The faulty Rx appears to work fine but can;t communicate with the FC.

**Edit - I have re-flashed firmware because it failed verification on a few groups of bytes, although no improvement. Seems fairly likely to be h/w related.
I haven't tried re-flashing the firmware yet. Does ### anyone know if pull-up activated in the STM or whether it's an external resistor? Could a re-flash fix this if so? I know a flipped bit is super unlikely, and I'm leaning towards STM failure. Perhaps as this one is only for the back yard I might try adding a 3v3 pull-up to the data line - thoughts?

Here's some scope traces to show the issue a bit clearer:

Malfunctioning 8A:

Functioning iBus link:

If it turns out this is just a hardware failure then please accept my apologies!

Cheers

Hello. do you have the source code? i have x6b v1.1 and i use 1-7 sbus (not change in fc) channels. i need 2 more pwm channels. I would like to change regular pwm channels 1-6 to 9-14 or any other, except 1-7.

I'm using an X6B receiver, and the mod firmware, and I noticed that it doesn't cut throttle when it loses connection. Is there something I can do to fix that with an I6s radio? If not, can you please add that to the firmware? I need that function to activate failsafe on my autopilot, but it is also a safety concern for people flying manually, as well.