I received my spare Yuneec typhoon H receiver and this is what I have figured out about it so far.
1. The Yuneec ST10, ST16, the Wizard wand, the Typhoon H, Q500, and Blade Chroma all seem to use the same transmitter/receiver module = SR24
2. The SR24 is a CC2530 based Zigbee module.
3. The connection to the SR24 is: pin 1- Black wire, GND; Pin 2 - White wire, +3V; Pin 3 - Gray wire, serial data in; Pin 4 - Yellow wire, serial data out.
4. After attaching it to a typhoon H to bind it, I captured the serial output data using a logic analyzer module
5. From the logic analyzer data, the serial connection is 115.2Kbps 8N1, LSB first.
6. The data output is one 46 byte data frame followed by two 27 byte data frames.
7. Each data frame starts with the same two bytes: 0x55, 0x55
8. The next two bytes seem to indicate if it is a 46 or 27 byte frame: 46bytes=0x2B,0x03 .... 27bytes=0x18,0x00
9. Bytes 5,6,7 seem to be a counter of some sort. They always seem to go up from one frame to the next by ~50K but the exact value varies a bit. Maybe clock counts?
10. The last byte if each frame (byte 46 or 27) always varies and I think it is a checksum
11. I believe all the channel info is encoded in bytes 9-26 with each channel represented by 12 bits. The channel data that I have figured out is in this order:
T,A,E,R, Smart/Angle/Home switch, ? , Camera tilt Slider, Pan Knob , ? ,pan mode switch, landing Gear switch, Button 2
12. Bytes 30-27 of the 46 byte packets is the Latitude of the ST16 transmitter to 7 decimal places.
13. Byte 34-31 of the 46 byte packets is Longitude of the ST16 transmitter to 7 decimal places
14. I captured the binding sequence using what I think are the correct settings, but I haven't tested sending that data into the receiver from my serial port to see if it will actually put the RX into bind mode. I could be missing something.
The binding data looks like this: 0x55,0x55,0x8,0x4,0x0,0x0,0x42,0x49,0x4E,0x44,0xB0 repeated five times.
All of this plus some sample data I captured is in a thread I started on RCgroups to see if anybody was interested in helping to figurethis out.
Yuneec Receiver protocol? - RC Groups
So back to the OP's questions:
1. Bind to other receivers?
Probably not. Like I said it is an Zigbee module and you can purchase those for fairly cheap but I believe they would have to be programmed with the correct configuration to act like a yuneec receiver and I'm not sure how you would get that configuration data.
2. Purchase a Yuneec receiver, bind it to the ST-16, and use it with a third party flight controller (like a Pixhawk)?
Maybe. In order to make it work somebody would have to program this serial protocol into the flight controller software. A lot of this flight controller FWs are open source (cleanflight, Inav, etc) and with the data I supplied above someone who is good at programming could probably do it. Unfortunately that isn't me. It might also be possible to have something like an arduino read the RX serial data, transform it into SBUS, or some other well known serial protocol and then output that to any off the shelf flight controller.
3. Anything else beyond its original intended purposes (flight and buddy mode)?
A possible use would be to take the info I have above and write some code for the arduino to have the ST16 control a ground vehicle of some sort. I think I might be able to do that level of coding so that maybe what I try to do. Having the ST16's Lat/long data being transmitted to the receiver opens up the possibility of having a "rover" follow you around.