HobbyKing.com New Products Flash Sale
Reply
Thread Tools
Old Mar 10, 2012, 12:47 PM
Registered User
Joined Jun 2010
119 Posts
Discussion
Walkera DEVO Tx Hacking

I put together a little tool for editing the bitmaps in Walkera Devo 6, 8 & 12 after chatting to FDR_. You can find it here

When you open a Walkera lib you will be presented with a list of "resource elements" each of which contains one or more bitmaps. Double clicking on a "resource element" allows you browse the bitmaps in that element and import/export the bitmaps as standard Windows bitmap files. When importing a bitmap it must be the same size as the original.

You can also export all the bitmaps in a Walkera lib file (use the export all button).

If you modify any of the bitmaps in the file you can update it with your changes and the app will fix up the CRC for you. The modified file can then be flashed to your Tx as usual - obviously use a lib file that matches your Tx's firmware

Note: This app is provided "as-is" and with no warranty. If it bricks your Tx then I am not responsible. That said, it really shouldn't since all we are doing is changing the contents of the bitmaps.

Happy Hacking!



Edit: Update v0.2 tool can be found here

Adds support for import/export of strings. Strings will be extracted to a .rtf file

European languages, make sure your editor handles UTF-7
Chinese, make sure your editor handles Bigendian Unicode

For some reason the Chinese strings don't display correctly.

Edit: Update v0.2A tool can be found here
rcH4x0r is offline Find More Posts by rcH4x0r
Last edited by rcH4x0r; Mar 13, 2012 at 04:19 PM. Reason: V0.2
Reply With Quote
Sign up now
to remove ads between posts
Old Mar 10, 2012, 01:12 PM
Registered User
United Kingdom, Bristol
Joined Aug 2008
1,774 Posts
still not getting one

SadSack is offline Find More Posts by SadSack
Reply With Quote
Old Mar 10, 2012, 01:18 PM
Registered User
Joined May 2011
655 Posts
Please, make the window sizable!
FDR_ is offline Find More Posts by FDR_
Reply With Quote
Old Mar 10, 2012, 02:52 PM
Registered User
Joined May 2011
655 Posts
Where to go now with the hacking project?

The library is almost done:
0-24. Pictures
25. all null
26. Bold font
27-28. Normal font
29. Chinese font
30. all null
31. String table

So the annoying sounds are in the firmware...
FDR_ is offline Find More Posts by FDR_
Reply With Quote
Old Mar 10, 2012, 03:49 PM
Registered User
Joined Jun 2010
119 Posts
That rather depends on what you want to achieve. For me the next things are:
-Reverse the FW to understand the transmitted packet format
-Reverse teh HW to understand what's connected to where
rcH4x0r is offline Find More Posts by rcH4x0r
Reply With Quote
Old Mar 10, 2012, 04:00 PM
Registered User
Joined May 2011
655 Posts
Yes, that is the question indeed...

I think the most important thing would be the compatibility with other non-DEVO receivers, ie protocols for Walkera 24xx, 26xx, 28xx, and perhaps protocols of the others: DSM2/DSMx would be nice!
I know you have already reverse engineered the 24xx protocol!
FDR_ is offline Find More Posts by FDR_
Reply With Quote
Old Mar 10, 2012, 04:56 PM
Registered User
Joined Jun 2010
119 Posts
I looked at the older 4 channel Walkera Txs, particularly the SPI bus between the MCU and CYRF chip, I think I understand a lot of the protocol but not all. Hopefully the Devo protocol is similar enough that it will give some hints as to the missing info.

Whether other protocols can be supported depends on the RF HW. I really doubt other protocols could be hacked into the Devo Tx's FW, I think you would need a new FW designed to support multiple protocols. Judging by the way the Lib files work the Devo FW is probably not that great :s

The telemetry module is interesting though, it's based on the CYRF6936, the same chip as the older Walkera kit. In the worst case we have an easy to access SPI bus to play with....
rcH4x0r is offline Find More Posts by rcH4x0r
Reply With Quote
Old Mar 11, 2012, 01:03 AM
Better then Sliced Bread!
NorCalMatCat's Avatar
United States, CA, Arcata
Joined Oct 2011
2,649 Posts
Woop, I started another thread on this subject after looking up and down to see if one existed :P I am really interested in trying to hack the firmware itself.
NorCalMatCat is offline Find More Posts by NorCalMatCat
RCG Plus Member
Latest blog entry: Let'sFPV UBEC 1 WEEK SALE
Reply With Quote
Old Mar 11, 2012, 04:27 AM
Registered User
Joined May 2011
655 Posts
Quote:
Originally Posted by rcH4x0r View Post
I looked at the older 4 channel Walkera Txs, particularly the SPI bus between the MCU and CYRF chip, I think I understand a lot of the protocol but not all. Hopefully the Devo protocol is similar enough that it will give some hints as to the missing info.

Whether other protocols can be supported depends on the RF HW. I really doubt other protocols could be hacked into the Devo Tx's FW, I think you would need a new FW designed to support multiple protocols. Judging by the way the Lib files work the Devo FW is probably not that great :s

The telemetry module is interesting though, it's based on the CYRF6936, the same chip as the older Walkera kit. In the worst case we have an easy to access SPI bus to play with....
There are some information about it:
http://9xforums.com/forum/viewtopic.php?f=5&t=362
They even link your pages...

The telemetry module IS the standard RF module of the DEVO 8 and 12. They do all the communication throw it. It is only a revised version of some kind. There are reports, that telemetry works with the original modules too...
FDR_ is offline Find More Posts by FDR_
Reply With Quote
Old Mar 11, 2012, 05:05 AM
Better then Sliced Bread!
NorCalMatCat's Avatar
United States, CA, Arcata
Joined Oct 2011
2,649 Posts
Could it just be that it needs 2 radio links to work? One handling servos, the other telemetry?
NorCalMatCat is offline Find More Posts by NorCalMatCat
RCG Plus Member
Latest blog entry: Let'sFPV UBEC 1 WEEK SALE
Reply With Quote
Old Mar 11, 2012, 05:34 AM
Registered User
Joined May 2011
655 Posts
Quote:
Originally Posted by NorCalMatCat View Post
Could it just be that it needs 2 radio links to work? One handling servos, the other telemetry?
How do you mean? I don't get it...
FDR_ is offline Find More Posts by FDR_
Reply With Quote
Old Mar 11, 2012, 06:02 AM
Registered User
Joined Jun 2010
119 Posts
The old 4 channel Walkera sets based on CYRF6936 had what I think is a pre amplifier on the receiver. The CYRF6936 is capable of transmitting and receiving but not at the same time (half duplex) so it could handle both tasks.

If the telemetry function needs a preamp then that would explain the need for a physical upgrade rather than a software update.

There's two SPI busses being used in the 8S firmware I have looked at, I dont know which is which yet.

SPI1 uses bit 2 of GPIO Port B for CS
SPI2 uses bits 8 & 12 of GPIO Port B for CS (2 pins for CS ?!?)

Can anybody who opened their Devo8 tell me where these GPIOs go? My Devo8 is on its way from HK....
rcH4x0r is offline Find More Posts by rcH4x0r
Reply With Quote
Old Mar 11, 2012, 06:36 AM
Registered User
Joined May 2011
655 Posts
Quote:
Originally Posted by rcH4x0r View Post
The old 4 channel Walkera sets based on CYRF6936 had what I think is a pre amplifier on the receiver. The CYRF6936 is capable of transmitting and receiving but not at the same time (half duplex) so it could handle both tasks.

If the telemetry function needs a preamp then that would explain the need for a physical upgrade rather than a software update.

There's two SPI busses being used in the 8S firmware I have looked at, I dont know which is which yet.

SPI1 uses bit 2 of GPIO Port B for CS
SPI2 uses bits 8 & 12 of GPIO Port B for CS (2 pins for CS ?!?)

Can anybody who opened their Devo8 tell me where these GPIOs go? My Devo8 is on its way from HK....
I hope you have ordered the DEVO 8S with RX802!
FDR_ is offline Find More Posts by FDR_
Reply With Quote
Old Mar 11, 2012, 11:57 AM
Registered User
Joined Jul 2008
775 Posts
So I take it that no one is even going to try and hack the devo 7. I wish I had the money for the 8 when I bought my mini combo. I like the 7 though it does what I need it to. I just wish I could have an alarm that goes off after 3 minutes of inactivity. I always forget to shut it off. I would also like it if the timer could be stopped while throttle hold is on. I always forget to stop the timer when I crash.
mescalinedream is offline Find More Posts by mescalinedream
Reply With Quote
Old Mar 11, 2012, 12:08 PM
bobepine's Avatar
Joined Jun 2011
7,561 Posts
What are the benefits of hacking?

Thanks!

Chris
bobepine is online now Find More Posts by bobepine
Site Sponsor
Reply


Thread Tools

Similar Threads
Category Thread Thread Starter Forum Replies Last Post
Wanted Broken Walkera Devo and Spektrum tx itsmillertime Aircraft - General - Radio Equipment (FS/W) 1 Mar 20, 2012 04:37 AM
For Sale Walkera Devo 7 TX/Devo RX2625H Combo for sale Tom Z Aircraft - General - Radio Equipment (FS/W) 0 Oct 06, 2011 12:33 PM
For Sale Walkera Devo 7 TX/Devo RX2625H Combo for sale Tom Z Aircraft - Electric - Helis (FS/W) 0 Oct 05, 2011 11:38 AM
Discussion New Walkera Devention Devo 12 TX w/ Touch-Screen hobbypartz Radios 2 May 08, 2011 11:38 PM
Discussion New Walkera Devention Devo 12 TX w/ Touch-Screen hobbypartz XHeli 0 May 05, 2011 11:19 PM