I think you’re on the right track – a few points:

1) I think that the 4th byte is just ignored by the S107G, Trim/calibration is definitely controlled by offsetting the Yaw value. I picked up a Syma S800G which has sideways (slide) control and took a peek at it’s control packets. It does appear that the S800G uses the 4th byte for left/right slide control, whilst Trim is again applied by offsetting the Yaw. Interestingly, using the S107G controller (a 4-byte model – S107T2) with the S800G and applying a little throttle while holding it in your hand, the helicopter responds – altering the Trim dial makes the slide servo’s move! Sadly you can’t use the S107G controller to control Slide in the air because the Trim dial is bound to Yaw and the 4th byte, and it makes the chopper go into a crazy spiral..

2) For control purposes, channel selection is just a matter of changing bit #16 to 0 or 1 – though for the physical controllers, the channels also change the packet transmission intervals to avoid packet collisions (channel B’s interval is 1.5x the interval of channel A). As an example of the use of the Channel Bit in practice, I built a controller using an Arduino controlled by a Processing sketch that can control 2 helicopters simultaneously (and independently) with one transmitter by just alternating the channel bit (and using 2 different control value arrays).

I actually just finished writing up a proper technical protocol definition for this protocol (to make it easier to use than my blog post for proper development) – you can take a look here: http://www.jimhung.co.uk/?page_id=1076

Hope that helps!

Jim

One more finding, which I think Jim has hinted at, but not explained in much detail- Channel selection of A or B still nets 34khz. The channel is selected by changing the
first bit in byte 3. 0 = channel B, 1 = channel A. You have decoded channel B, Jim has decoded Channel A. This is why your throttle values are to 255, and his are to 127.
When the controller is set to channel A, the copter sees the minimum 0 bits, and follows this to stay on that channel. If it sees over 128 at power up, it knows to
use Channel B, which goes from 128 to 255. From my findings, the control duration is not channel specific, as i’m using your code for channel B, but using Jim’s
channel A throttle bits(0-127, or all 1′s in the first bit of byte 3) and it works just fine.

I’m suspecting the channel selector on “our” transmitters is nothing more than a simple voltage divider that goes to the throttle lever input.
Channel A may send 0-2.5 volts to the lever, Channel B may send 2.5-5 volts. Then ADC is done in the controller. I believe it also sets a pulse duration change
in the controller as well.

Looking at both of your and Jim’s decoded bytes, they all pretty much match except throttle data, but after really looking at it, its the channel selection bit on
the first bit of byte 3 that is only different. So I believe your throttle math should be 127-255(to select channel B), not 0-255. I think you inadvertently hint on
this by saying throttle does not start at 0. I’m not sure how you were able to start the throttle at 128, unless you mapped this electrically at the pot(or maybe I’m
missing this somewhere in your code?).

Unfortunately, I do not have any testing equipment, but If you feel so inclined, see what byte 1 does with the trim control, and what byte 3 does
with A and B selection, although I gather Jim has already done this test. Again, thank you for your work on this, I have learned quite a bit with
this project!

According to Jim (http://www.jimhung.co.uk/?p=901), S107G has at least two different revisions and the command structures are different among the two. Could you check yours? From what you described, it sounds like your S107G protocol might be different then the one I reverse engineered?

I was wondering if you could upload the schematic diagram of the breadboard circuit.

Kind regards
Jonah