So i was wondering if anyone is reverse engineering a Hitec HPP-22, as it seems Hitec wants to keep the protocol a trade secret.

Here are some assumptions I have made, please correct as necessary.

Hitec designed this protocol and interface for programming digital servos.

They used to distribute HMI, a PC based app for programming digital servos that came with instructions for making a serial port to servo adapter.

Could it be that HPP-22 interface is not much more than a USB to Hitec protocol adapter and power supply for the device to be programmed?

I don't know if it has been reverse engineered yet, but at $27.95 it does not look like a lucrative target for hackers. The protocol is probably not very complicated and a few hours with a logic analyzer would likely allow you to replicate it.

The problem is that now, the HPP-22 software detects your HPP-22 unit.
I was hoping it was just an USB-Serial converter, but the software has no option to select a serial port.
I do not have an HPP22 yet, but I suspect it is using the HID USB driver stack, and authenticating itself to the software, as I see no driver files on the software package.
All the driverless bi-directional USB interfaces I have seen this days are HID.

I was thinking more along the lines of reverse engineering the telemetry function on the 2.4 GHz systems.

Here is some info on the HPP-22.

It uses the PIC18F2550 chip which includes a USB transceiver. I am quite sure they are using I2C to _receive_ the telemetry data into the HPP-22 - it appears that the HPP-22 module brings the I2C bus up and does the proper stuff to allow the transmitter module to write the telemetry data to it. It appears that the HPP-22 is at I2C address "0". I have been able to see some of the data, but I need better hardware to be able to view the whole message.

I am betting that the message is pretty simple, just transmitting the data back for each of the sensors. After I get a better bead on the format of the data coming back, then I will tackle how that data is getting to the receiver module...

I am hoping they did not encrypt the data, that would be a pain.

Matt

My notes...

It is a protocol converter.

I think it only does the Aurora, the 2.4 GHz Rxs and Txs.

It does not supply power to the devices at all, they need to be powered to
be programmed, as far as I can tell from using the P1 slot. I will check the Rx and Tx ports to see if they are powered, but I am pretty sure they are not.

From the manual:

Functions:
Radio, Module, and Receiver Firmware Upgrade
Radio, Module and Receiver Data Setting
Data Save & Load to PC
Date Reset
Auto Version Check
Plug and Play

Matt

Originally Posted by ergocentric

So i was wondering if anyone is reverse engineering a Hitec HPP-22, as it seems Hitec wants to keep the protocol a trade secret.

Here are some assumptions I have made, please correct as necessary.

Hitec designed this protocol and interface for programming digital servos.

They used to distribute HMI, a PC based app for programming digital servos that came with instructions for making a serial port to servo adapter.

Could it be that HPP-22 interface is not much more than a USB to Hitec protocol adapter and power supply for the device to be programmed?

I wouldn't bother with this hack more, the open source telemetry is ready for prime time:

https://www.rcgroups.com/forums/show...&postcount=101