ThermoPro TP60B / TX-2B 915 MHz temp+humidity - decoded, looks like a TP11 cousin

Related to #3323 but not the same device. That one's the 433.867 MHz TP60 and the timing looks totally different. Mine is the 915 MHz TX-2B. Got the payload figured out and checked it against the base station display.

The layout turns out to match the existing thermopro_tp11.c decoder almost exactly - same 12-bit temperature as ((byte1 & 0x0F) << 8) | byte2, and the same id position (byte0 plus the high nibble of byte1). Difference is mine has no -200 offset on the temperature and adds a humidity byte, so it's basically a TP11 cousin with humidity.

Setup: ThermoPro TP60B outdoor unit, TX-2B module, 915 MHz on the label. Actually transmits around 914.99, drifts a bit low. RTL-SDR Blog V4, recorded baseband IQ at 2.4MHz in SDR++. Sends every ~50s, repeats the packet 6-8 times per burst. 2-FSK, tones ~26 kHz apart, but it demods fine as ASK. Uniform pulses, data's in the gap lengths (two widths), with a frame gap and a longer inter-frame gap. Pulled the bits in URH.

Two captures, 32-bit payload after the sync. Cold reading was 59.5F / 83% RH, bytes were 0x25 0x50 0x99 0x53. Hot reading was 128.8F / 10% RH (still climbing), bytes were 0x25 0x52 0x09 0x0A.

byte0 and the top nibble of byte1 don't change between the two - looks like ID.

Temp is 12-bit: ((byte1 & 0x0F) << 8) | byte2, in tenths of a degree C. Cold: 0x099 = 153 = 15.3C = 59.5F, matches. Hot: 0x209 = 521 = 52.1C = 125.8F. Display said 128.8 but it was actively warming up so the packet I caught was a few seconds behind, and the direction fits.

Humidity is just byte3 as-is. 0x53 = 83, 0x0A = 10. Both matched.

So: temp_C = (((byte1 & 0x0F) << 8) | byte2) / 10.0, and humidity = byte3.

Stuff I didn't nail down: where the sync ends exactly and whether there's a checksum after those 4 bytes; whether temp goes negative properly since all my captures were above freezing; and the low battery bit, no idea where that is.