I'm trying to figure out the protocol between the handset and the base, and thought I might as well post the progress here...
It appears to be a fairly simple async protocol (as expected, only TX and RX wires).
The bit width (time between two of the narrow rising edges) is 16uS, so I guess that gives a baud rate of 62,500?
Here's a quick grab from the analyser.
I wouldn't take too much notice of the actual decoded data, as I don't think it's correct yet...
The "black" channel is TX from base to handset, the "brown" channel is the RX response.
The data looks a little bit like I2C (active low, with a possible address byte at the start).
I2C normally has a clock line and is bidirectional though, so it's probably just standard async serial but we don't know the number of bits etc.
I don't think the Hydra was actually tracking when this capture was taken, but it was pulsing the transmit coils etc.
If we could figure out this serial protocol, it would be simple enough to use a small AVR chip to spoof the joystick / buttons and make a smaller custom tracker module and allow the Windoze drivers / SDK to work.
Also, I've traced the pinouts of the handset / base connector(s)...
Base unit handset port pinout...
1. +3V3
2. RH TX (FROM handset)
3. RH RX (TO handset)
4. LH TX (FROM handset)
5. LH RX (TO handset)
6. RH /EN
7. LH /EN
8. RH coil sig
9. RH coil sig
10. RH coil sig
11. LH coil sig
12. LH coil sig
13. LH coil sig
14. GND
I haven't opened the the Left-hand handset yet, so it's /EN,TX,RX,coil pinouts are implied.
(Pins 11,12,13 are definitely the LH coil signals though.)
EDIT: Might as well list the Handset plug pinouts (long cable) separately for clarity...
NOTE: Ground / shield is connected inside the handsets with a separate wire.
Please be aware though that the wire colours in your Hydra may differ.
1. /EN (Green)
2. Coil sig (Blue)
3. Coil sig (Orange)
4. Coil sig (Purp)
5. TX (Brown, TO base)
6. RX (Yellow, FROM base)
7. +3V3 (Red)
The oscillator for the transmit coils in the base appears to be free running at ~18KHz.
As discussed previously, the osc is running all the time and is switched between the three transmit coils by the mux.
Anyway, plenty more fun to be had.
I might try some custom transmit coils soon.