I've been putting dumps here: https://drive.google.com/drive/folders/1iN0vuhsRMY6tCWZOCC9F4SSBbT9ljmq7?usp=sharing
NOTE DO NOT USE fx3_100MHz_DataCap.dat.tar.gz The data is bad!
Histogram (from 100 MHz FX3 data):

vvv C Program for analyzing the FX3 dump.
analyze.txt
Current ideas/questions:
(1) Supersoaker: what if it's a CDMA stream, or other stream of pseudorandom data that specifically prevents repeated codes or subcodes and encodes the position of the rotor.
(2) Why do my charts show a peak at more than 2 codes?
(3) Coding is probably something "like" Manchester. Spread around 6 MHz.
Hint from Alan:
The modulation is quite simple, but sensor group delay might be confusing you a little. Best to probe the laser drive directly if you are completely lost. The data rate is 6 Mbps and the modulation is basically 3/6 MHz FSK, but it includes a pi phase shift on zeros to ensure a minimum frequency. The base station console might give you some hints about what the bitstream is. It is not framed or packetised in any way, so you won't really be helped by capturing more than a few tens of bits. That after all is the entire idea... Or maybe you will... If you can't work out what it is you will need all of it from one sync event, to the next one. Oh and OOTX isn't dead, it just got slower.
Hints we got from Ben:
Ben Jackson I don't like popcorn but I am baking bread
Ben Jackson 50rpm
Ben Jackson Charles should make a sampling camera to do ultra-high speed photography of repetitive stuff
Ben Jackson licensees don't know either
Ben Jackson yes, that's fine
Ben Jackson the datasheet has the timings
Ben Jackson yes, for how to configure the chip
Ben Jackson the config word isn't that interesting. it's just a way to make adjustments to the chip after the fab. so you would need to know lots of internal details to know what the bits do
Ben Jackson instead of making a bunch of variants of the chip
Ben Jackson but once you figure out what it should be, the other values aren't that interesting anymore
Ben Jackson I think there are updates coming, but I don't know if that's in the update
Ben Jackson FYI @CNLohr that capture doesn't look right to me
Ben Jackson it's hard to look at raw analog photodiode signals
Ben Jackson you need an amplified photodiode with more bw
Ben Jackson @CNLohr that was re the chat
Ben Jackson @CNLohr how fast is the ESP sampling?
Ben Jackson did you look at the datasheet? it should tell you the possible BW of what possible input signals it can process
Ben Jackson you should probably move the base and the sensor farther apart
Ben Jackson @MobiusHorizons good idea
Ben Jackson they don't communicate with each other
Ben Jackson they're blue while spinning up
Ben Jackson it is easy to block 2.0 without the blinker
Ben Jackson there's no clock pin
Ben Jackson @CNLohr are you sure you powered up and configured the sensor properly?
Ben Jackson that can make it tricky to just measure the output
Ben Jackson b/c you still need active config
Ben Jackson you could have glitched it into sleep mode
Ben Jackson wait, are you reloading the ESP on every run?
Ben Jackson and each run it tries to configure the already-configured sensor?
Ben Jackson @CNLohr beep
Ben Jackson after you configure the sensor it's in a different mode
Ben Jackson the initialization sequence won't work then
Ben Jackson don't drive the D/E lines again after config or you will do unpredictable things
Ben Jackson so power cycle, send config sequence, D/E go hi-Z and stay hi-Z as long as you want to use it
Ben Jackson if you have to drive those during a reload you should powercycle the sensor
Ben Jackson that looks about right for config
Ben Jackson you sure you are loading those bits in the right order?
Ben Jackson that looks potentially right
Ben Jackson he changed TS4231s
Ben Jackson where it the sensor in front of the base?
Ben Jackson measure the env timings
Ben Jackson you probalby have a local reflection
Ben Jackson a shiny bit right near the sensor
Ben Jackson like a connector
Ben Jackson no SUPER local
Ben Jackson like on the board with the sensor
Ben Jackson or just move the base way farther away
Ben Jackson yeah black gaffer tape isn't great for IR
Ben Jackson sharpie is also terrible in ir
Ben Jackson the first step to blocking IR is to realize your intuition for what color or transparency things are in IR is shit
Ben Jackson for not reflecting we have some special matte black optical tape that's black in IR
Ben Jackson and for blocking transmission you really need foil backed tape
Max Bambusman @Ben Jackson aluminium duct tape?
Ben Jackson that will definitely block it
Ben Jackson but then it's a mirror
Ben Jackson the tape we use has foil lining but it's black on the outside
Ben Jackson blue painters tape is almost entirely transparent in IR, fyi
Ben Jackson @Naters305 it's kind of like interviewing 😉
Naters305 Haha Nice @Ben Jackson
Ben Jackson I'm going to laugh so hard when you figure out what this bitstream is
Ben Jackson understanding the bits should be straightforward
Ben Jackson or rather demodulating them
Ben Jackson but figuring out what they are might be a crueler challenge than the old wireless protocol
Ben Jackson @Peter S. Hollander email the VR licensing email (include your account name if it's not obvious) and I can send you some
Ben Jackson What will his chat thing do if 我说汉语
Ben Jackson it doesn't like emoticons
Ben Jackson oh cool it beeps
Ben Jackson this is super handy
Ben Jackson unicode characters made your terminal beep
Ben Jackson they stop transmitting when the motor control loop goes out of spec
Ben Jackson so in theory if you spun the outside at -50rpm very constantly it would work
Ben Jackson but your outside motor control loop would need to hold about 200ppm tolerance
Ben Jackson yeah, I never thought about how hard this would be to reverse engineer from snippets
Ben Jackson interesting idea
Ben Jackson or point it into an integrating sphere
Ben Jackson @CNLohr you didn't forget about power cycling if you want to reconfigure, right?
Ben Jackson you should just power it with a fet so you can toggle it in the boot sequence
Ben Jackson @MobiusHorizons the shape of a flashlight beam reflector has the properties you want (i.e. it kind of collimates light)
MobiusHorizons @Ben Jackson that's pretty much what I was thinking
Ben Jackson what, you don't want to build an integrating sphere?
Ben Jackson I love the juxtaposition of how clever an idea that is vs how much it will not help you at all :)
Ben Jackson how much of a hint do you want
Ben Jackson the wall would work
Ben Jackson oh, no, the wall will be more useful
Ben Jackson wall is strictly a good idea and an improvement over short captures
Ben Jackson and you will easily figure out 1s vs 0s
Ben Jackson right
Ben Jackson I mean having a longer sequence of bits won't help you
Ben Jackson 😃 😃 :)
Ben Jackson so @Peter S. Hollander has decided to start cutting off his leg with the saw ;-)
Max Bambusman @Ben Jackson how much do you/steam want the vive to be reverse engineered?
Ben Jackson when I designed it originally I started by capturing with saleae and decoding w/ python
Ben Jackson it will export to CSV
Ben Jackson then I wrote a saleae plugin to demodulate which is fun
Ben Jackson you typo'd 6MHz as 600kHz at some point
Ben Jackson the saleae protocol decoders are asynchronous and run in another thread
Ben Jackson so there can be weird latency
Ben Jackson I've never tried to use the manchester module
Ben Jackson it probably would want 6Mhz differential manchester
Ben Jackson you sure that's not decoding?
Ben Jackson hmm
Ben Jackson silicone labs
Ben Jackson hmmmm
Ben Jackson try differential manchester, 6MHz, one bit per transfer
Ben Jackson I wonder if that would work
Ben Jackson I could find a capture and test
Ben Jackson maybe it wants 3?
Ben Jackson does it want 12?
Ben Jackson it does
Ben Jackson @CNLohr turn off your unused channels to capture
Ben Jackson time to 也说汉语
pacccer @Ben Jackson do we need a higher sample rate?
Ben Jackson @pacccer I just realized when he was exporting that he had all channels on
Ben Jackson not sure where he captured
Ben Jackson @Jernej Jakob right
Ben Jackson note that the laser line comes out perpendicular to the stripes you see on the lens
Ben Jackson well you can't take it apart because it's impossible to take apart
Ben Jackson I'm waiting for ifixit to give it a -1 on the servicability scale
Ben Jackson 1004 is the start of all of our model numbers
Ben Jackson only for management
Ben Jackson @CNLohr turn off the unused saleae channels
Ben Jackson that will unlock higher bw options
Ben Jackson ohhh non-pro
Ben Jackson turns out you can tell if your supply chain is compromised if FTDI makes their drivers fail on those devices
Ben Jackson well if FTDI found out that your devices included counterfeit chips they could sue to prevent you from importing them
Ben Jackson ?
Ben Jackson I don't care about FTDI
Ben Jackson what was the capture frequency?
Ben Jackson that's a good choice
Ben Jackson I feel like you could get something out of 24MHz the way you're capturing
Ben Jackson one thing to consider: how would you modulate this if you were doing it?
Ben Jackson does it make sense if 1's are \"long\" and 0's are \"short\"? that's not a constant bitrate
Ben Jackson sure, but that's partly down to how you analyzed it
Ben Jackson your analysis method *adds* phase noise
Ben Jackson because you add in all phase noise in every edge
Ben Jackson man this is serious deja vu for me
Ben Jackson you really want some mulitple of 6 or better 12 or your life is going to be even harder
Ben Jackson I used 500 :)
Ben Jackson going to have to go soon
Ben Jackson if you want to request any specific hints before, now's the time
Ben Jackson I want to see your reaction when you figure it out, but I think it might take a few more streams...
Ben Jackson your analysis with your eyes just scrolling along was good
Ben Jackson your question about bit stuffing already includes an incorrect assumption
Ben Jackson so the answer is \"mu\"
Ben Jackson yes
Ben Jackson although it's DC balanced regardless
Ben Jackson he's right about \"mu\"
Ben Jackson the bitstream AND the encoding are both dc balanced
Ben Jackson you kind of asked about one
Ben Jackson re: bit stuffing
(I was talking about something ABOUT the signal just naturally works out to make it work out to be right)
Ben Jackson yes
Ben Jackson YES
Ben Jackson oh man you're so close :)
Ben Jackson got to go, catch up with you all later
I've been putting dumps here: https://drive.google.com/drive/folders/1iN0vuhsRMY6tCWZOCC9F4SSBbT9ljmq7?usp=sharing
NOTE DO NOT USE fx3_100MHz_DataCap.dat.tar.gz The data is bad!
Histogram (from 100 MHz FX3 data):

vvv C Program for analyzing the FX3 dump.
analyze.txt
Current ideas/questions:
(1) Supersoaker: what if it's a CDMA stream, or other stream of pseudorandom data that specifically prevents repeated codes or subcodes and encodes the position of the rotor.
(2) Why do my charts show a peak at more than 2 codes?
(3) Coding is probably something "like" Manchester. Spread around 6 MHz.
Hint from Alan:
Hints we got from Ben: