Change FPV video scrambler password when VTX are air flying

We use a USB tool to connect the computer and the video scrambling and descrambling module to change the password, which is actually the encryption algorithm seed number. If we have installed the scrambling module on the drone and it is flying in the air, this method cannot change the password or the seed number of the scrambling algorithm. It can only be achieved by sending serial port commands.

Change FPV video scrambler password when VTX are air flying

FPV video scrambling module configuration parameters

Module configuration parameters are all implemented by writing a 256×8 RAM inside the module. The configured parameters are valid after saving, resetting or powering on again

RAM parameter description

Module configuration parameters are all implemented by writing a 256×8 RAM inside the module. The configured parameters are valid after saving, resetting, or re-powering on. After the system is powered on or reset, the serial port will print {AAAAAA}

RAM parameter details

RAM[0]: System reset control, readable and writable, read and write have different meanings
Write:
0X00: Reset the entire system, the serial port returns {AAAAAA}, indicating that the system has been reset
0X01: Save the parameters set by the user, the serial port returns {000101}, indicating that the execution is successful
0X02: Restore the parameters to the system default parameters, the serial port returns {000202}, indicating that the execution is successful
Other => Reserved
Read:
BIT0: Input locked or not, 0: unlocked, 1: locked
BIT7~BIT1: reserved
RAM[1]: Video input mode, readable and writable, default value 0X00
0X00: Force input mode to PAL, stronger anti-interference
0X01: Force input mode to NTSC, stronger anti-interference
Others reserved
RAM[2]: Module working mode. Readable and writable, default value 0X00
0X00: Scrambling mode
0X01: Descrambling mode
Others => reserved
RAM[3] ~ RAM[4]: Scrambled random number, range 0~1023, readable and writable, default value 0.
RAM[3] high byte, RAM[4] low byte

Other RAMs are reserved and their contents cannot be read or written

Module configuration command

Configuration command is implemented by sending commands to it through the serial port

Command format: {+operation code+RAM address++check code+}

The symbols {} are all hexadecimal numbers represented by ASCII code

{: indicates the start of the command

+: indicates that this only indicates the connection, used for explanation, and does not exist in the actual command

<>: indicates that this parameter does not exist in the read command

}: indicates the end of the command

Operation code: 00 indicates write, FF indicates read, 1 byte

RAM address: 1 byte

Operand: The operand of the command is 1 byte. In the read operation, this byte does not exist

Check code: (operation code + register address + ) mod 256

Command return format:

Operation success return format: {+register address+register value+check code+}

Reset command does not return

Operation failure return format: {FFFFFF}

Serial Port Command Example:

startup:
RX: {AAAAAA}

TX: {00010001} – set PAL
RX: {010001}   – success / or {FFFFFF} – fail
TX: {00010102} – set NTSC
RX: {010102}   – success / or {FFFFFF} – fail
TX: {FF0100}   – get video input mode
RX: {010102}   – 0x01 & 0x01 = NTSC / or {FFFFFF} – fail

TX: {00020002} – set Scrambling mode
RX: {020002}   – success / or {FFFFFF} – fail
TX: {00020103} – set Descrambler mode
RX: {020103}   – success / or {FFFFFF} – fail
TX: {FF0201}   – get working mode
RX: {020103}   – 0x01 & 0x01 = Descrambler mode / or {FFFFFF} – fail

Set seed = 1000 (0x03e8) high byte 0x03, low byte 0xe8

TX: {00030306} – set high byte 0x03 / or {FFFFFF} – fail
RX: {030306}   – success / or {FFFFFF} – fail
TX: {0004E8EC} – set low byte 0xe8
RX: {04E8EC}   – success / or {FFFFFF} – fail
TX: {FF0302}   – get seed’s high byte
RX: {030306}   – high byte = 0x03 / or {FFFFFF} – fail
TX: {FF0403}   – get seed’s low byte
RX: {04E8EC}   – low byte = 0xe8 / or {FFFFFF} – fail

TX: {00000101} – write settings
RX: {000101}   – success / or {FFFFFF} – fail

Chinese中文原文

FPV视频加扰模块配置参数

模块配置参数都是通过写模块内部的一个256×8的RAM来实现，所配置的参数在保存复位或重新上电后有效.

RAM参数说明

模块配置参数都是通过写模块内部的一个256×8的RAM来实现，所配置的参数在保存复位或重新上电后有效，系统上电或复位后，串口会打印｛AAAAAA｝

RAM参数说明

RAM[0] :系统复位控制，可读可写,读和写代表的意义不一样

写：

• 0X00：复位整个系统,串口返回｛AAAAAA｝，表示系统已经复位
• 0X01：保存用户设置的参数, 串口返回｛000101｝,表示执行成功
• 0X02：恢复参数为系统默认参数, 串口返回｛000202｝，表示执行成功
• 其它 => 保留

读：

• BIT0：输入锁定与否，0：未锁定，1：锁定
• BIT7~BIT1：保留

RAM[1] :视频输入模式，可读可写,默认值0X00

• 0X00:强制输入模式为PAL，抗干扰更强
• 0X01:强制输入模式为NTSC，抗干扰更强
• 其它保留

RAM[2] :模块工作方式。可读可写，默认值0X00

• 0X00：加扰模式
• 0X01：解扰模式
• 其它 => 保留

RAM[3] ~RAM[4]:加扰随机数，范围0~1023，可读可写，默认值0。
RAM[3]高字节，RAM[4]低字节
其它的RAM保留，不能读写其内容

FPV视频加扰模块配置命令

配置命令是通过串口向其发送命令来实现
命令格式: {+操作码+RAM地址+<操作数>+校验码+} 符号{}内都是ASCII码表示的16进制数字
{ : 表示命令开始
+ : 表示这里仅表示连接,用于说明,在实际命令中并不存在
<> :表示该参数读命令中没有
} : 表示命令结束
操作码 : 00 表示写, FF表示读，1字节
RAM地址： 1字节
操作数 : 命令的操作数 1字节,在读操作中,这个字节没有
校验码 : (操作码 + 寄存地址 + <操作数>) mod 256
命令返回格式 :
操作成功返回格式: {+寄存器地址+寄存器的值+校验码+}
复位命令没返回
操作失败返回格式:{FFFFFF}