diff --git a/Lua_scripts/MultiChan.txt b/Lua_scripts/MultiChan.txt
index 6912a68..fe35626 100644
--- a/Lua_scripts/MultiChan.txt
+++ b/Lua_scripts/MultiChan.txt
@@ -229,6 +229,6 @@
 98,0,Kyosho3,ASF,0
 100,0,YuXiang,Std,0,Lock,Rate,Land,Manual,Flip,Mode,Pitch
 102,0,JIABAILE,Std,0,Speed,Light,Flash
-102,1,JIABAILE,Gyro,0,Speed,Light,Flash,Tr_ST
+102,1,JIABAILE,Gyro,0,Speed,Light,Flash,ST_Tr
 103,0,H36,Std,1,Flip,HLess,RTH
-104,0,KAMTOM_NRF24L01_INO,Std,1,
+104,0,KAMTOM,Std,0,ST_Tr,TH_Tr,TH_DR
diff --git a/Multiprotocol/Kamtom_nrf24l01.ino b/Multiprotocol/Kamtom_nrf24l01.ino
new file mode 100644
index 0000000..bd06789
--- /dev/null
+++ b/Multiprotocol/Kamtom_nrf24l01.ino
@@ -0,0 +1,179 @@
+/*
+ This project is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+Multiprotocol is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with Multiprotocol.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#if defined(KAMTOM_NRF24L01_INO)
+
+#include "iface_xn297.h"
+
+//#define FORCE_KAMTOM_ORIGINAL_ID
+
+#define KAMTOM_PAYLOAD_SIZE			16
+#define KAMTOM_RF_NUM_CHANNELS		4
+#define KAMTOM_BIND_COUNT			2000
+#define KAMTOM_WRITE_TIME			650
+#define KAMTOM_BIND_CHANNEL			0x28	//40
+#define KAMTOM_PACKET_PERIOD		3585
+
+
+enum {
+	KAMTOM_DATA,
+	KAMTOM_RX,
+};
+
+static void __attribute__((unused)) KAMTOM_send_packet()
+{
+	if(bind_counter)
+	{
+		bind_counter--;
+		if(!bind_counter)
+			BIND_DONE;
+	}
+
+	memset(packet, 0x00, 16);
+
+	if(IS_BIND_DONE)
+	{//Normal
+		XN297_Hopping(hopping_frequency_no);
+		hopping_frequency_no++;
+		hopping_frequency_no &= 3;
+
+		//RXID
+		packet[0] = rx_tx_addr[0];
+		packet[2] = rx_tx_addr[1];
+		//Next RF channel
+		packet[1] = hopping_frequency[hopping_frequency_no];
+		//Channels and trims
+		for(uint8_t i=0; i<6; i++)
+		{
+			packet[4+i] = convert_channel_s8b(CH_TAER[i]);
+			if(i>3) //ST_TR and TH_TR
+				packet[4+i] >>= 2;
+		}
+		//packet[11] = 0x00;	//??
+		//TH_DR
+		packet[12] = convert_channel_16b_limit(CH7,0x25,0x64);
+	}
+	else
+	{
+		packet[1] = KAMTOM_BIND_CHANNEL;
+		memcpy(&packet[4],hopping_frequency,4);
+		packet[12] = 0xA5;
+	}
+	packet[10] = 0x40;	//??
+	//Checksum
+	uint16_t sum = packet[1];
+	for(uint8_t i=4;i<13;i++)
+		 sum += packet[i];
+	packet[13] = sum;
+	packet[3] = (sum>>6) & 0xFC;
+	//TXID
+	packet[14] = rx_tx_addr[2];
+	packet[15] = rx_tx_addr[3];
+	// Send
+	XN297_SetPower();
+	XN297_SetTxRxMode(TX_EN);
+	XN297_WriteEnhancedPayload(packet, KAMTOM_PAYLOAD_SIZE,false);
+	#if 0
+	//def DEBUG_SERIAL
+		for(uint8_t i=0; i < KAMTOM_PAYLOAD_SIZE; i++)
+			debug("%02X ", packet[i]);
+		debugln();
+	#endif
+}
+
+static void __attribute__((unused)) KAMTOM_initialize_txid()
+{
+	calc_fh_channels(4);
+	#ifdef FORCE_KAMTOM_ORIGINAL_ID
+		rx_tx_addr[0] = 0xC7;
+		rx_tx_addr[1] = 0x78;
+		rx_tx_addr[2] = 0x2C;
+		rx_tx_addr[3] = 0x25;
+		hopping_frequency[0] = 59;
+		hopping_frequency[1] = 59;
+		hopping_frequency[2] = 71;
+		hopping_frequency[3] = 65;
+	#endif
+}
+
+static void __attribute__((unused)) KAMTOM_RF_init()
+{
+	XN297_Configure(XN297_CRCEN, XN297_SCRAMBLED, XN297_1M);
+	//Address
+	XN297_SetTXAddr((uint8_t*)"\xCC\xDD\xEE\xDD", 4);
+	XN297_SetRXAddr((uint8_t*)"\xCC\xDD\xEE\xDD", KAMTOM_PAYLOAD_SIZE);
+	XN297_RFChannel(KAMTOM_BIND_CHANNEL);
+}
+
+uint16_t KAMTOM_callback()
+{
+	static bool rx=false;
+	
+	switch(phase)
+	{
+		case KAMTOM_DATA:
+			rx = XN297_IsRX();
+			XN297_SetTxRxMode(TXRX_OFF);
+			#ifdef MULTI_SYNC
+				telemetry_set_input_sync(KAMTOM_PACKET_PERIOD);
+			#endif
+			KAMTOM_send_packet();
+			if(rx)
+			{
+				uint8_t val=XN297_ReadEnhancedPayload(packet_in, KAMTOM_PAYLOAD_SIZE);
+				if(val==KAMTOM_PAYLOAD_SIZE)
+				{
+					BIND_DONE;
+					if(packet_in[0] == 0xA0 && packet_in[14] == rx_tx_addr[2] && packet_in[15] == rx_tx_addr[3])
+					{
+						rx_tx_addr[0] = packet_in[9];
+						rx_tx_addr[1] = packet_in[10];
+						//if(packet_in[1] == 0x03)		// low voltage
+					}
+					#if 0
+						for(uint8_t i=0; i < KAMTOM_PAYLOAD_SIZE; i++)
+							debug(" %02X", packet_in[i]);
+						debugln();
+					#endif
+				}
+			}
+			phase++;
+			return KAMTOM_WRITE_TIME;
+		default: //KAMTOM_RX
+			//{ // Wait for packet to be sent before switching to receive mode
+			//	uint16_t start=(uint16_t)micros();
+			//	while ((uint16_t)((uint16_t)micros()-(uint16_t)start) < 500)
+			//		if(XN297_IsPacketSent())
+			//			break;
+			//}
+			//Switch to RX
+			XN297_SetTxRxMode(TXRX_OFF);
+			XN297_SetTxRxMode(RX_EN);
+			phase = KAMTOM_DATA;
+			return KAMTOM_PACKET_PERIOD - KAMTOM_WRITE_TIME;
+	}
+	return 0;
+}
+
+void KAMTOM_init()
+{
+	KAMTOM_initialize_txid();
+	KAMTOM_RF_init();
+
+	bind_counter = KAMTOM_BIND_COUNT;
+	phase = KAMTOM_DATA;
+	hopping_frequency_no = 0;
+}
+
+#endif
diff --git a/Multiprotocol/Multi.txt b/Multiprotocol/Multi.txt
index eb92885..815456c 100644
--- a/Multiprotocol/Multi.txt
+++ b/Multiprotocol/Multi.txt
@@ -98,4 +98,5 @@
 99,XK2,X4,P10
 100,YuXiang
 102,JIABAILE,STD,GYRO
-103,H36
\ No newline at end of file
+103,H36
+104,KAMTOM
\ No newline at end of file
diff --git a/Multiprotocol/Multi_Protos.ino b/Multiprotocol/Multi_Protos.ino
index 87f40a6..371a9e6 100644
--- a/Multiprotocol/Multi_Protos.ino
+++ b/Multiprotocol/Multi_Protos.ino
@@ -114,7 +114,8 @@ const char STR_EAZYRC[]     ="EazyRC";
 const char STR_KYOSHO3[]    ="Kyosho3";
 const char STR_YUXIANG[]    ="YuXiang";
 const char STR_UDIRC[]      ="UDIRC";
-const char STR_JIABAILE[]	="JIABAILE";
+const char STR_JIABAILE[]   ="JIABAILE";
+const char STR_KAMTOM[]     ="KAMTOM";
 
 const char STR_SUBTYPE_FLYSKY[] =     "\x04""Std\0""V9x9""V6x6""V912""CX20";
 const char STR_SUBTYPE_HUBSAN[] =     "\x04""H107""H301""H501";
@@ -391,6 +392,9 @@ const mm_protocol_definition multi_protocols[] = {
 	#if defined(JOYSWAY_A7105_INO)
 		{PROTO_JOYSWAY,    STR_JOYSWAY,   NO_SUBTYPE,            0, OPTION_NONE,    0, 0, SW_A7105,  JOYSWAY_init,    JOYSWAY_callback    },
 	#endif
+	#if defined(KAMTOM_NRF24L01_INO)
+		{PROTO_KAMTOM,     STR_KAMTOM,    NO_SUBTYPE,            0, OPTION_NONE,    0, 0, SW_NRF,    KAMTOM_init,     KAMTOM_callback     },
+	#endif
 	#if defined(KF606_CCNRF_INO)
 		{PROTO_KF606,      STR_KF606,     STR_SUBTYPE_KF606,     3, OPTION_RFTUNE,  0, 0, SW_NRF,    KF606_init,      KF606_callback      },
 	#endif
diff --git a/Multiprotocol/Multiprotocol.h b/Multiprotocol/Multiprotocol.h
index 91d8ca4..00bad2b 100644
--- a/Multiprotocol/Multiprotocol.h
+++ b/Multiprotocol/Multiprotocol.h
@@ -19,7 +19,7 @@
 #define VERSION_MAJOR		1
 #define VERSION_MINOR		3
 #define VERSION_REVISION	4
-#define VERSION_PATCH_LEVEL	33
+#define VERSION_PATCH_LEVEL	34
 
 #define MODE_SERIAL 0
 
@@ -131,6 +131,7 @@ enum PROTOCOLS
 	PROTO_UDIRC		= 101,	// =>CC2500 & NRF24L01
 	PROTO_JIABAILE	= 102,	// =>NRF24L01
 	PROTO_H36		= 103,	// =>NRF24L01
+	PROTO_KAMTOM	= 104,	// =>NRF24L01
 	
 	PROTO_NANORF	= 126,	// =>NRF24L01
 	PROTO_TEST		= 127,	// =>CC2500
diff --git a/Multiprotocol/Validate.h b/Multiprotocol/Validate.h
index f6f5692..0f45c01 100644
--- a/Multiprotocol/Validate.h
+++ b/Multiprotocol/Validate.h
@@ -326,6 +326,7 @@
 	#undef	HONTAI_NRF24L01_INO
 	#undef	JIABAILE_NRF24L01_INO
 	#undef	JJRC345_NRF24L01_INO
+	#undef	KAMTOM_NRF24L01_INO
 	#undef	KN_NRF24L01_INO
 	#undef	KYOSHO2_NRF24L01_INO
 	#undef	LOLI_NRF24L01_INO
@@ -393,6 +394,7 @@
 	#undef	SHENQI_NRF24L01_INO
 	#undef	JIABAILE_NRF24L01_INO
 	#undef	UDIRC_CCNRF_INO
+	#undef	KAMTOM_NRF24L01_INO
 #endif
 
 #ifdef MULTI_SURFACE
diff --git a/Multiprotocol/XN297_EMU.ino b/Multiprotocol/XN297_EMU.ino
index c0565c2..bb0163c 100644
--- a/Multiprotocol/XN297_EMU.ino
+++ b/Multiprotocol/XN297_EMU.ino
@@ -353,9 +353,9 @@ static void __attribute__((unused)) XN297_WriteEnhancedPayload(uint8_t* msg, uin
 
 		last++;
 		buf[last] = bit_reverse(msg[len-1]) << 6; // last 2 bit of payload
-		if(xn297_scramble_enabled)
-			buf[last] ^= xn297_scramble[scramble_index++] & 0xc0;
 	}
+	if(xn297_scramble_enabled)
+		buf[last] ^= xn297_scramble[scramble_index++] & 0xc0;
 
 	// crc
 	if (xn297_crc)
@@ -375,8 +375,7 @@ static void __attribute__((unused)) XN297_WriteEnhancedPayload(uint8_t* msg, uin
 		buf[last++] = (crc & 0xff) << 6;
 	}
 	pid++;
-	if(pid>3)
-		pid=0;
+	pid &= 0x03;
 
 	// send packet
 	XN297_SendPayload(buf, last);
diff --git a/Multiprotocol/_Config.h b/Multiprotocol/_Config.h
index c5f55ee..2cab843 100644
--- a/Multiprotocol/_Config.h
+++ b/Multiprotocol/_Config.h
@@ -246,6 +246,7 @@
 #define	HONTAI_NRF24L01_INO
 #define JIABAILE_NRF24L01_INO
 #define	JJRC345_NRF24L01_INO
+#define	KAMTOM_NRF24L01_INO
 #define	KN_NRF24L01_INO
 #define	KYOSHO2_NRF24L01_INO
 #define	LOLI_NRF24L01_INO
@@ -745,6 +746,8 @@ const PPM_Parameters PPM_prot[14*NBR_BANKS]=	{
 		SKYTMBLR
 	PROTO_JOYSWAY
 		NONE
+	PROTO_KAMTOM
+		NONE
 	PROTO_KF606
 		KF606_KF606
 		KF606_MIG320
diff --git a/Protocols_Details.md b/Protocols_Details.md
index bbcf85b..7b0eadd 100644
--- a/Protocols_Details.md
+++ b/Protocols_Details.md
@@ -1981,6 +1981,15 @@ Model: DF-Models SkyTumbler
 
 RTH not supported
 
+## KAMTOM - *104*
+Models: KAMTOM KM24xx (KM32xx?), Pinecone SG-24xx
+
+CH1|CH2|CH3|CH4|CH5|CH6|CH7
+---|---|---|---|---|---|---
+ST|TH|UNK1|UNK2|ST_TR|TH_TR|TH_DR
+
+Low batt telemetry is not yet added.
+
 ## KYOSHO2 - *93*
 Model: TX KT-17, Minium Edge 540, Minium Citabria