FlySky i6 part 4: Custom updater

/!\ This updater is unstable, see there for the newer version /!\
Hi everyone! Today the train workers are in strike, so I can’t go to college, so I have plenty of time to release the product of my work!

But first thing first, a little bit of explanation. Today I’ll show you how the official FlySky updater works, and try to do mine!

Updater serial protocol

We know that the updater is using a serial com port to flash the firmware into the TX flash memory.
I used my logic analyzer to sniff the whole data transfer process, from this capture I understood how the protocol was working.

First thing it does is sending a « ping » request, wich is answered by the transmitter.

                    0    1     2    3    4    5     6    …                         …   n-1   n
[PC -> TX] 05  00  C0  3A  FF
[TX -> PC] 55  0F  00  C0  0A  00  01  00  00  00  00  00  00  D0  FE

Structure of the frame sent by the PC:

byte    function
1 0      size of the frame ( 2 bytes )
2         command type
…        parameters of the command, grouped by 2 bytes
n n-1  checksum (0xFFFF minus the sum of all the bytes of the frame) (2 bytes)

Frame sent by the TX: it’s the same principle, except that there’s an additionnal 0x55 byte at the begining of the frame.
I identified 4 types of commands:

C0: request name – no params
example: 05  00  C0  3A  FF
C1: restart TX – no params,[1 null byte]
example: 06  00  C1  00  38  FF
C2: ask to write bytes – location,[0x0900 ???],[8 null bytes]
example: 11  00  C2  00  18  00  09  00  00  00  00  00  00  00  00  0B  FF
C3: write bytes – location,[2 null bytes],data_block_size

The C2 command is sent before copying byte, to ask if we can send the next kB (1024 bytes) of data.
The TX replies with, following the same example than before:

55 13 00 C2 80 00 18 00 09 00 00 00 00 00 00 00 00 34 FE

The C3 command is the interesting one, it tells the TX to copy the bytes the PC is giving into its flash memory. It has a header with the C3 command, then the block of data bytes, then the checksum.

0B 01 C3 00 18 00 00 00 01 40 16 00 20 C5 19 … 18 47 B0 D7 00 00 85 C2
header                              data (256 bytes = 0x100 bytes)           checksum

The TX replies to every C3 command with:

55 0A 00 C3 00 00 00 00 DD FE

Custom updater

So I used all this information to code a custom updater wich follow the right updating process. My coding is not really clean, and it’s been a long time since I did C programming, but you can find it on github :

FSi6 updater on github OLD VERSION, don’t use it!!!

The new version of the updater is available. See this article for informations: BaseI6 Updater. You can download the tool on github >>> here <<< .

Final words

And most wanted: the release of my patch and the updater! I have done a lot of testing, I tried really hard to cause bricking of my device (including uploading a bad firmware made of random bytes), and I always was able to recover to the official firmware or directly to my firmware. So I think my updating method is pretty safe, as it doesn’t touch the bootloader section of the flash program.

But again, I’m not responsible for any harm you could do to your device! Please don’t blame me if something bad happens.

This patch allows the FS-i6 to use 2 additionnal channels. These channels are linked to the switches A and D and are only available through the iBus output of the iA6B receiver.

/!\ Someone with a TGY unit reported bricked device, don’t try it with the TGY units until I investigate further /!\

There is a way to recover the TGY device. The bricked TGY unit is now working, but the bug has also appeared on other TGY units. Maybe you need to update to the official FlySky 1.1 firmware before you use the custom updater.


BaseJ v0.1 patch and updater

Instructions are on the readme file.

PS: Help me to buy a new oscilloscope: Donate on PayPal !
Any help is really appreciated 😉

24 réflexions au sujet de « FlySky i6 part 4: Custom updater »

    1. Thank you very much for your comment! Unfortunately I’m struggling to find time to add more content to this blog, but this kind of comment is definitely motivating me to work on it. (I recently reverse engineered the circuit of a very cheap esc for a brushless motor, if I find some time I’ll make a clean article about it, even if the circuit is pretty simple it could be interesting)


  1. Hi, I have a strange problem with latest 10ch firmware. It flashes and then restarts the TX and I get Throttle warning but all sticks are up and throttle at min… what I’m doing wrong? Thanks


  2. I tried to use FS-i6 firmware and TGY i6 firmware and patch_0_1.bin to flash my transmitter, at the end of the message which display  » ERROR _ bad page reply from TX Ignoring page at offset )xf300″ and nothing happen. no display, no sound. no function. any suggestion please.


    1. Hi, this page error shouldn’t cause a problem, but my firmware was more of a proof of concept. You should follow this thread:
      Due to a lack of time because of my studies I didn’t worked on this for a few months. Some people from rcgroup has continued the work, and did a better job than me (don’t blame me, I’m still a student 😉 ). I’m sure the use of their firmware will repair your tx. I should definitely do a post about it, and I hope your problem will be fixed.


  3. Hello,

    I tried this last night and bricked my controller. But managed to recover it so posting to share how here to help others

    Downloaded the FS-i6 1.1 firmware updater here

    I had to right click “run as administrator” to make it open

    On your bricked controller left stick hold horizontal trim right, vertical trim down and power on the controller. You controller will make no sound and have no display, but is in update mode.

    Then on computer select the correct com port, click open port, then programme. It will load 1.1 firmware to the controller and restart it.

    I haven’t got Thom’s update to work on my controller with original 1.10 firmware or the older 1.1 firmware. Just goes into a loop at start up.

    Using official lead and windows 10.


    1. Quick update.

      I used updater V0.3 (bottom of FlySky i6: Installing RCEYE NovaX350 firmware page) and it successfully flashed Thom’s patch. I then tried the original updater and it worked first time. So try V0.3 first, it still uses the same patch to the firmware.

      Although I have now managed to patch the firmware, I get the Base J logo on the display but I cannot get channels 7&8 to function. Every time I plug a servo in it causes an overload or something as it drags the receiver voltage down to about 3v sending the controller to alarm low voltage of the Fs-ia6B receiver. Before I did the firmware update plugging servos into these sockets didn’t do this, so I’m a bit confused at the moment. Maybe the firmware patch although allows switching channels 7&8 maybe only for signal output not actual servos.


      1. I’ve now tried various things but still unable to use the two auxiliary channels.
        Tried servos, and that drops the receiver voltage down.
        Tried plugging into RC electronic controller but it does not sense the signals.
        Tried just connecting the signal pin to the electronics, but still not detecting the signals

        Maybe the receiver firmware has been updated to stop this firmware patch working?

        Don’t know whether to flash transmitter to the nova firmware, with it not having a boot loader don’t want to brick the controller also will I have same issue of the receiver not working with the firmware like I have now?

        Any advice?


  4. I was unable to install a working patch, screen just keeps flashing.. Any idea why or how to solve? No problem to put back original Flysky soft or Turnigy…




  5. I also bricked my flysky fs-i6 device had previously flashed tgy i6 ppm firmware from
    After flashing your bin it is in boot loop
    If one switch is not in position 1 or the throttle stick is over zero there is the Warning Message, if i put sticks back to normal position then it is in boot loop. Can i fix that?


    1. This problem with TGY units is really weird.
      To fix it, you can try this method:
      – power off the TX
      – while pressing the 4 trimmers buttons of the left stick, power on the TX
      – it won’t make any sound or display anything at the screen, but it is in firmware updating mode
      – try to program it with the official FlySky updater first
      – then if you want the BaseJ custom firmware, try to program with the custom updater


  6. I know this is not the place to ask this question but i’m having trouble finding it else where.
    Do you know if th fs-i6(with or without your mod) can be make to work with headtrackers? IE using the trainer port to receive PPM and pass through to rx channels ?
    Thanks for the effort here, i’m watching your developments with interest. It’s a really good piece of work.


  7. I just tried to update my new i6 using your firmware and custom updater. Last message from the updater was ignoring page at offset 0xf300, then the tx started to reboot continuosly. So now I’m the proud owner of a « bricked » TGY-i6. Is there any way I can recover it?


  8. Can you assign all the switches to channels in order to make it a 10ch radio?? Also is it possible to use the additional channels through ppm in order to use the ia6 rx also??


    1. It is possible to make it a 10ch radio, maybe I’ll do it in the next release. But for the ppm output, no it isn’t possible. In order to do that, you need to reprogram your receiver and not the transmitter.


Répondre à Tish Ragazzo Annuler la réponse.

Entrez vos coordonnées ci-dessous ou cliquez sur une icône pour vous connecter:


Vous commentez à l’aide de votre compte Déconnexion /  Changer )

Photo Google

Vous commentez à l’aide de votre compte Google. Déconnexion /  Changer )

Image Twitter

Vous commentez à l’aide de votre compte Twitter. Déconnexion /  Changer )

Photo Facebook

Vous commentez à l’aide de votre compte Facebook. Déconnexion /  Changer )

Connexion à %s