In the last days THALES Salamandre HFXL signals were again active, as was also noticed by
Antonio.
TDoA points to the area around Paris. However, judging from the observed field strengths, there were transmitters at (at least) two locations active.

TDoA 
A 72frame long HFXL burst is shown below (most bursts consist of 9 frames). The symbols were obtained by manually correcting for the doppler offset and searching for the correct symbol timing using GNU octave. The burst consists of frames with 287 symbols where the last 31 symbols are +sign miniprobes.

HFXL burst 
The preamble consists of three parts where the 1st two parts are following MILSTD188110 App. C and the 3rd part is a proprietary extension. It encodes 10 dibits D
_{0},...,D
_{9} containing information about the used modulation schema and other signal parameters.

HFXL preamble 
It is known that the first few dibits encode information about the used modulation schema:
[D_{0}, D_{1}, D_{2}] = [(1,M_{0}), (1,M_{1}), (1,M_{2})]
In order to study these bursts more systematically the extended HFXL preamble was implemented in
grdigitalhf as an extension of the 110C mode. A number of recorded HFXL signals were analyzed and the constellations shown below were found (not shown: BPSK). Note that the BPSK and QPSK modes are scrambled to 8PSK symbols.

HFXL constellations after descrambling 
The table below shows a map between [M
_{0},M
_{1},M
_{2}] and the channel symbols after descrambling. 64QAM mode was not observed and is therefore missing in the table below.
M_{0},M_{1},M_{2} Channel symbols after descrambling
0, 0, 0 BPSK
1, 0, 0 QPSK
0, 1, 0 8PSK
1, 1, 0 16QAM
0, 0, 1 32QAM
1, 0, 1 
0, 1, 1 QPSK chips with phases [+1,1,1,+1]
1, 1, 1 
At first is was puzzling that two combinations of [M
_{0},M
_{1},M
_{2}] correspond to QPSK descrambled symbols. Having a closer look at (0,1,1) bursts, it can be seen that it consists of QPSK symbols S
_{i} spread out using [+1,1,1,+1] chips,
i.e.,
..., S_{i},S_{i},S_{i},S_{i}, S_{i+1},S_{i+1},S_{i+1},S_{i+1}, ...
making it a very robust mode to transmit data.

QPSK (0,1,1) mode 
The bits extracted from the 72frame long burst shown above have a mean of 0.377; assuming that the probability for a bit to be 1 is 0.5 this translates into 24.6% of the payload consisting of zeros. If this is correct then one should see long strings of 0 bits.
Assuming that the 72 frames in this burst consist of two blocks of 36 frames, and that an interleaver of the form specified in MILSTD188110 App. D is used, the maximum run lengths for all interleaver increments are shown below. For both interleaver blocks there is a maximum for an interleaver increment of 469.

maximum run length as a function of interleaver increment 
Assuming that the correct interleaver increment is 469, the deinterleaved bits are shown below:
 there are four gaps, each about 215 bits long
 the probability of a bit to be 1 if it is not in one of these gaps is 46.1% for the 1st block and 46.9% for the 2nd block
 the distribution of the deinterleaved bits for both blocks is similar and shows an interesting pattern

deinterleaved bits for interleaver increment 469 
As this analysis is based on a single burst with 72 frames, it might be a mere coincidence. In addition it is worth noticing that using the same interleaver increment, assuming that all 72 frames are a single interleaver block, the double of the bit patterns above is obtained.

deinterleaved bits for interleaver increment 469 