CC1101 - Continuous Output on GDO0 with receiveDirectAsync()

[VK1IAN]

I'm trying to reverse engineer my Mobiletron TPMS sensors using a CC1101 (RadioLib 7.6.0) and ESP 8266 D1 mini.
I know very little about the sensors, except they transmit on 433.92MHz and use FSK modulation.
What information I could find on radiolib, indicated I can access the raw data via GDO0 using receiveDirectAsync. Problem is when I active this mode, I see continuous transitions on GDO0; even when there is no signal input (no antenna connected).
I have reduced my test code to the minimum required (see below) and I am monitoring the GDO0 pin with an oscilloscope. What I am seeing is not a clock signal.
Be grateful if someone could look at my code and advise if there is any other nerd knobs I need to tweak.
`
#include <Arduino.h>
#include <RadioLib.h>

// ---------------- CC1101 ----------------
// CC1101 has the following connections:
// SCK pin: D5 GPIO 14
// MISO pin: D6 GPIO 12
// MOSI pin: D7 GPIO 13
// CS pin: D8 GPIO 15
// GDO0 pin: D1 GPIO 5
// RST pin: unused
// GDO2 pin: D2 (optional) GPIO 4

CC1101 radio = new Module(D8, D1, RADIOLIB_NC, RADIOLIB_NC);

// ---------------- CONFIG ----------------
#define GDO0_PIN D1

// ---------------- SETUP ----------------
void setup() {
Serial.begin(115200);
delay(1000);
pinMode(GDO0_PIN, INPUT_PULLUP);

int state = radio.begin(433.92, 4.8, 5.0, 100);
if (state != RADIOLIB_ERR_NONE) {
Serial.println("Radio init failed!");
while (true);
}

radio.receiveDirectAsync(); // GDO0 = data, GDO2 = not used

Serial.println("--------Starting--------");
}

// ---------------- LOOP ----------------
void loop() {
}`

[jgromes]

The fundamental thing to understand about all direct modes in this library is that when the radio is in this mode, it does not perform any packet operations - that includes detection of what a "packet" is. What you are seeing on the output is noise received at the radio input port - even without antenna, there is still something and the radio is attempting to demodulate it.

You will need to do some research to figure out the basic modulation and packet parameters of the transmitters - an SDR and application like Universal Radio Hacker will be very helpful with that. Once you have at least the bit rate and frequency deviation figured out, you should see a change in the output with the oscilloscope. For example, if you set the radio bit rate to 10x the expected packet bit rate, then the random noise should be at 10x higher frequency than the actual packet, which is well visible on a oscilloscope.

After that, you will need to figure out the packet structure - whether there is some preamble and sync word, how is the data encoded etc.

[VK1IAN]

Thanks Jan.
It seems I misunderstood what "direct" mode means. I understand that in direct modes there is no decoding, but what I was anticipating was data reflecting the received FSK tones; i.e a "1" at one frequency and a "0" at the other.
Doing any sort of analysis is difficult at my QTH as the airwaves are awash with weather stations in the 433M band, making it difficult to identify my sensors. I also suspect the sensors are very low power devices (they have a 7 year lifespan) which just adds to the difficulty.
That said, we are going on holidays in a few weeks to the "outback", where I'm sure of finding some "RF quiet" camp sites, which should make identifying the sensors easier.
I wasn't aware of URH until a few weeks ago, so I'm in the process of learning how to use it.
I have found (from FCC test reports) that the sensors operate on 433.92MHz and use FSK modulation. Specifics like deviation, bit rate, etc were redacted at the request of the manufacturer.
Thanks again for the response.