Reading through the SPIRIT1 datasheet again and having found fewer patterns in the payload data than I expected I wondered if they had enabled Data Whitening.
After adding this and using it to transform the received data things did look a little different.
There is still the same basic structure of 4 bytes of data with distinct patterns followed by 4 bytes that don't change at all (header and identifier).
Reviewing the payload, there was room for some optimism that this was the way to go...
The last 4 bytes all follow a very similar pattern, regardless of the length of the payload.
- 443044ec appears on 25 packets
- 443044ef' appears on 22 packets
- 443047ec appears on 14 packets
- 443047ef' appears on 16 packets
Assumption #9 - Data Whitening is enabled
Checking the other controller/receiver pairs I find the same sequences at the end of all the packets, so this does seem to be related to the data rather than the specific controller.
I'm still not sure how the variability in packet length is handled but it is likely as simple as the packet type defining the length. Interestingly all the shorter packet payloads start with a number 0x and the longer packets start 4x. However, it can't be as simple as this as the 4x payloads are either 52 or 84 bytes. I need to correlate the data a little more.