Spektrum DX3S Hack (Part 2 - Telemetry and the first RX)

Back to the DX3S hack project, I got some time and took a look at the telemetry data. I didn't do any video, but the information below should be enough.

The telemetry data is fairly simple. On each 8 byte packet sent by the remote, the RF module responds with 8 bytes. Out of this 8 bytes, only bytes 3 and 4 are relevant.

Spektrum DX3S Hack (update: 16 April 2013)

Not long ago, I bought my second RC model (HPI Trophy Truggy 4.6 was the first): a Team Associated RC18R. Smaller, electric, perfect for indoor use. The problem is I only have a receiver for my DX3S.
Looking on the web, the cheapest receiver is about 150 RON (40-50$), which is almost the amount of money I gave for the small RC car. Also, the cheapest receiver has only 2 channels and no telemetry (RPM and battery voltage would be useful).