Problem solved, Thanks Dai.
But I still got one problem.
See the attached jpg. the data I sent from PC this time is:
0000 ff ff ff ff ff ff 00 0b 2f 35 17 41 08 06 00 01 ........ /5.A....
0010 08 00 06 04 00 01 00 0b 2f 35 17 41 0a 08 00 03 ........ /5.A....
0020 00 00 00 00 00 00 0a 08 00 64 ........ .d
the received data is as shown in the jpeg file.
There are 2 bytes of zero ahead first byte of sent data "ff" and 17 bytes (ff_rx_mod=1h) of zero following the last 32bits "0a 08 00 64".
I guess the first 2 bytes of zero would be preamble or sfd, but what is the last 17 bytes of zeros? and where is the CRC field?