CC1101: RTL-SDR and CC1101 wmbus

Hello,

My goal is to be able to read the wmbus packets coming from my cc1101 based radio with a RTL2832 SDR based dongle. 

First, to make sure the sdr is working i tested it with a 434.475 MHz radio from a 3rd party and with the RC1140-MBUS3 module. Both worked fine. I used the xaelsouth software for demodulating and decoding the T1 mode packets.

I can also read the wmbus packets coming from my cc1101 with the RC1140-MBUS3 module.

The problem is that i couldnt read my packets with the RTL2832 SDR. I cant figure out what is happening. 

Here is my cc1101 config ->

// Product = CC1101
// Chip version = A   (VERSION = 0x04)
// Crystal accuracy = 10 ppm
// X-tal frequency = 26 MHz
// RF output power = + 10 dBm
// RX filterbandwidth = 325.000000 kHz
// Deviation = 38 kHz
// Datarate = 32.630920 kBaud (will change to 100 kbaud when operating in T1 mode)
// Modulation = (0) 2-FSK
// Manchester enable = (0) Manchester disabled
// RF Frequency = 434.475 MHz (this is the fc for wmbus when operating in my country)
// Channel spacing = 199.951172 kHz
// Channel number = 0
// Optimization = -
// Sync mode = (5) 15/16 + carrier-sense above threshold
// Format of RX/TX data = (0) Normal mode, use FIFOs for RX and TX
// CRC operation = (0) CRC disabled for TX and RX
// Forward Error Correction = (0) FEC disabled
// Length configuration = (0) Fixed length packets, length configured in PKTLEN register.
// Packetlength = 255
// Preamble count = (2)  4 bytes
// Append status = 0
// Address check = (0) No address check
// FIFO autoflush = 0
// Device address = 0


const RF_CONFIG_T tModeRfConfig = {
                                   0x08,   // FSCTRL1   Frequency synthesizer control.
                                   0x00,   // FSCTRL0   Frequency synthesizer control.
                                   0x10,//0x21,   // FREQ2     Frequency control word, high byte.
                                   0xB5,//0x6B,   // FREQ1     Frequency control word, middle byte.
                                   0xE8,//0xD0,   // FREQ0     Frequency control word, low byte.
                                   0x5C,   // MDMCFG4   Modem configuration.  - 103 kBaud
                                   0x04,   // MDMCFG3   Modem configuration.
                                   0x05,   // MDMCFG2   Modem configuration.05
                                   0x22,   // MDMCFG1   Modem configuration.
                                   0xF8,   // MDMCFG0   Modem configuration.
                                   0x00,   // CHANNR    Channel number.
                                   0x44,   // DEVIATN   Modem deviation setting
                                   0xB6,   // FREND1    Front end RX configuration.
                                   0x10,   // FREND0    Front end RX configuration.
                                   0x18,   // MCSM0     Main Radio Control State Machine configuration.
                                   0x2E,   // FOCCFG    Frequency Offset Compensation Configuration.
                                   0xBF,   // BSCFG     Bit synchronization Configuration.
                                   0x43,   // AGCCTRL2  AGC control.
                                   0x09,   // AGCCTRL1  AGC control.
                                   0xB5,   // AGCCTRL0  AGC control.
                                   0xEA,   // FSCAL3    Frequency synthesizer calibration.
                                   0x2A,   // FSCAL2    Frequency synthesizer calibration.
                                   0x00,   // FSCAL1    Frequency synthesizer calibration.
                                   0x1F,   // FSCAL0    Frequency synthesizer calibration.
                                   0x59,   // FSTEST    Frequency synthesizer calibration.
                                   0x81,   // TEST2     Various test settings.
                                   0x35,   // TEST1     Various test settings.
                                   0x09,   // TEST0     Various test settings.
                                   0x06,   // IOCFG2    GDO2 output pin configuration.
                                   0x00,   // IOCFG0D   GDO0 output pin configuration. Refer to SmartRF® Studio User Manual for detailed pseudo register explanation.
                                   0x00,   // PKTCTRL1  Packet automation control.
                                   0x00,   // PKTCTRL0  Packet automation control.
                                   0x00,   // ADDR      Device address.
                                   0xFF    // PKTLEN    Packet length.
};

const uint8_t tModePaTable[] = {0xC0};
const uint8_t tModePaTableLen = 1;

Those values are the same of the Ti wmbus stack, i just changed the Fc to 434.475 MHz.

For testing purposes the RTL2832 is connected to a raspberry pi and i am using this software to decode the packets: github.com/xaelsouth/rtl-wmbus

This is the rtl_sdr setup that i used: rtl_sdr -f 434425000 -s 1600000 - 2>/dev/null | build/rtl_wmbus

Is there any additional configuration that i must do in cc1101?

Thanks in advance !