FlySky FS-i6 8 channels firmware patch! - RC Groups
Shop our Airplanes Products Drone Products Sales
Thread Tools
Aug 23, 2015, 10:17 AM
Registered User
Discussion

FlySky FS-i6 8 channels firmware patch!


Hi everyone,

I create this thread because I'm busy trying to reversing the FS-i6.
I created a blog to post my work, but I'll need some help, especially from people who could do ARM development.

Here is a link to my first article. There is some info about the IBus protocol of the FlySky i6.
Here is the plot: I noticed the receiver gives 14 channels to the FC, instead of 6.

To the people who have read until the end: yes the emitter does send these extra channels

https://basejunction.wordpress.com/2...hannels-part1/

I'll need help to reverse the arm code, the updater code, or to figure out how to use the SWD debug port to program the ARM chip.
Last edited by ThomHpl; Sep 13, 2015 at 03:22 PM.
Sign up now
to remove ads between posts
Aug 24, 2015, 06:10 AM
Registered User
great article. seems this tx has so much hidden potential that we have yet to uncover.

Since you have experience with the IBUS protocol, do you have any knowledge about the telemetry stream that the RX sends back to the remote?

If we could reverse that we could probably have a FrSky-esque telemetry system for this remote!

edit: There is already going some work into custom firmware for this remote:

check http://openrcforums.com/forum/viewforum.php?f=124
Last edited by ampex_fhm; Aug 24, 2015 at 06:16 AM.
Aug 24, 2015, 12:26 PM
Registered User
I already started to investigate with the telemtry stream, but without any sensor to check or sniff the communication, it is really difficult to achieve.
Maybe I'll buy a cheap one to work on this.

And yeah I already saw this custom firmware, but it is for the FS-T6 and the i6 has a completely different hardware, I think :/
Last edited by ThomHpl; Sep 13, 2015 at 03:21 PM.
Sep 13, 2015, 03:27 PM
Registered User
I'm back!

I worked really hard for this, and I'm proud to announce that I now have a patched firmware for the FS-i6 wich allows me to use 8 channels !

Go check out my last blog entry!

Unfortunately I'm not able to give you an easy to use firmware updater for now, as I had to use a JTAG/SWD probe to flash my patched firmware, but I'm working on it!
Sep 13, 2015, 04:30 PM
Registered User
you're a beast dude, very nice!

bztw, someone on the cleanflight github analyzed the comms between a FlySky voltage sensor and an ia6b receiver. Maybe you want to check it out:

https://github.com/cleanflight/cleanflight/issues/1125
Sep 13, 2015, 05:01 PM
Registered User
Thanks for the information, really helpful for the telemetry! It seems that I'll still have work to do when I'm done with my firmware patch
Sep 13, 2015, 05:34 PM
Registered User
By the way, do the additional channels also get put out via the PPM output or is this serial only?
Sep 13, 2015, 05:45 PM
>DON'T PANIC<
Though mostly way over my head, still interesting Thom. I got just got the i6 and am now following your work. Thanks
Sep 13, 2015, 06:06 PM
Registered User
LDan: You're welcome

Ampex: On the TX side, ppm or no isn't an issue, the channels are sent in the air. But I just checked and no, it doesn't work with my FS-iA6B receiver. Only the iBus output is giving the extra channels. I think the receiver is only considering the 6 firsts channels and ignoring others when generating his PPM signal.

However I guess the ppm would work with the FS-iA10 receiver, given that it is the same AFHDS 2A protocol.

But hey, maybe it's possible to hack the FS-iA6B to make it working? ahah I already have enough work to do

EDIT:
I just checked the inside of the iA6B receiver: it has a STM32F031C6T6 MCU, and, like the FS i6, a pretty little exposed SWD debug port
So yeah it should also be possible to patch it to work with PPM. But it is a lot of work, instead of just using the iBus protocol...
Last edited by ThomHpl; Sep 13, 2015 at 06:47 PM.
Sep 13, 2015, 06:30 PM
>DON'T PANIC<
Do you think that your work on the i6 might help lead to a Deviation type functionality somewhere down the road? If I'm understanding enough it seems it might.
Sep 13, 2015, 07:11 PM
Registered User
I'm not really familiar with the deviationTX firmware. But if you mean to use it to pilot different types of flying models, like deviationTX is able to do, no I doubt it would be possible. The RF module in the FS-i6 is quite uncommon and I think it can only be used with a flysky i receiver.

You could modify the RF module in the TX but even so, the deviationTX firmware isn't compatible with the i6 hardware. (It uses another brand of microcontroller and it seems that it requires a lot of flash memory)

So in order to make it happen, we should:
-change the RF module
-change the hardware to meet DEVO hardware OR rewrite a new firmware

At first I spoke about porting some open source TX firmware, but the deviationTX is really a big one
Sep 13, 2015, 07:50 PM
>DON'T PANIC<
Yeah, I've got a Devo 7E, and have been following somewhat Deviation and other mods for it with the intention of possibly doing something to it to fly more protocols, but I'm still fairly unknowledgeable about most of it.

So from what you've just said, the current known limitation,

assuming:
- someone(s) willing to create Deviation like firmware that's compatible with the i6 hardware
- and the possibility that other modules can be installed/added for other protocols

might be the amount of flash memory available in the i6?

Am I close do you think?
Last edited by LDan101; Sep 14, 2015 at 08:22 PM. Reason: "7E", not "7"
Sep 13, 2015, 09:06 PM
Registered User
There is 64kB of flash in the MCU of the i6.

If you only want to add the ability to communicate with other protocols, you'll always need to install other RF modules, and on the software-side I see 2 options:

Either making another patch to the existing firmware to make it using the new module
Either porting an open source TX firmware (such as ER9X or others) wich could fit on the i6 hardware, and add this fonctionnality to the firmware. (it is easier to code in c, than to disassemble and patch things in assembly!)

Patching might not be extremely hard, but I don't know how other RF modules works. The module in the FS-i6 uses a kind of single wire SPI bus. The SPI bus is pretty commun in these RF modules but the protocol changes for every brand, wich means we can easily send data with a different module, but we have to figure out how to format this data to be understood by the receivers.
Sep 14, 2015, 10:44 AM
>DON'T PANIC<
Thanks again Thom.

And again, mostly over my head. I hope I haven't side tracked you too much about this.

I guess it does all look promising though, and hopefully we'll see enough interest regarding your efforts, and all of the resulting possibilities that may be made available.
Sep 14, 2015, 04:34 PM
Registered User
Not at all, it's quite interesting to think about future improvement.

Thanks to you, I found out that the RF module in the i6 is a A7105 module. It is the same that in all flysky transmitter, I think!
So the iBus of the i6 is only a change in the protocol used.

Another path to investigate: I guess it would be possible to add iBus support to FS-T6 or other FlySky transmitters... But I don't have the money to buy another TX

One more idea: possibility to mod a cheap receiver to add sensors and iBus to it...