goebish

I use a logic analyzer when possible, that's the simplest method. https://www.deviationtx.com/forum/protocol-development/4595-spi-capture-guide

Can you tell which chips are on the quad's pcb and in the remote ?

PPM_MIN & PPM_MAX aren't meant to be modified, you should setup your controller endpoints to output 1000-2000µs, that's +/- 125% on the DX6i, not sure for the MZ-24

Ok that's weird, you can modify PPM_MAX_COMMAND if required, but not PPM_MIN & PPM_MAX

I'm not sure why they're not compatible, they're supposed to use the same center frequencies and gfsk deviation but I wasn't able to make it work properly with a nrf24l01...

I think this chip is the MPU (gyro+accelerometer), the RF part is probably built into the bigger chip (MCU) ... If you're lucky this chip could be xn297 compatible. Do...

another (more complex) approach is with a 2.4GHz capable SDR, eg an HackRF or BladeRF.

No idea, sorry, I offer no support for those modules.

@pascallanger have you ever heard of this one ?

@NelsenEW you know what you've to do ;)