Reading downlink data from LMIC.frame - how?


I am very new to LoRaWAN and thus to LMIC and I am having trouble getting payload from my downlink messages.

I am using the AWS IoT Core for LoRaWAN with a RAK 7268 gateway and an ESP32-based sensor with the rfm95w radio. I have connected everything fine and after some juggling managed to successfully get the uplink payload, but I cannot for the death of me understand how to extract the payload from the LMIC.frame.

I am trying to send a “Hello There!” message. The AWS IoT Core Downlink message accepts a Base64 encoded message - this becomes “SGVsbG8gVGhlcmUh” (48 65 6C 6C 6F 20 54 68 65 72 65 21 in HEX; 12bytes in length). When I send the following message, the sensor receives the message and the LMIC.frame receives 12 bytes. However, no matter how I try to read the data, it’s not making sense.

I am using the following code:

for (int i=0; i<LMIC.dataLen; ++i) {
                    Serial.print(LMIC.frame[i], HEX);
                    Serial.print(" ");

The output varies here are two samples: A0 AC 1A B0 00 85 00 00 03 35 00 FF and A0 A5 0D 01 00 85 00 00 03 36 00 FF which is far from the expected (as the input above).

Here are the session parameters associated with the second output:

devaddr: 10DA5
AppSKey: 0xD0-0x8C-0x07-0xFB-0xDB-0xBF-0xC2-0x55-0x42-0x9E-0x8C-0xFA-0x3D-0x57-0x8C-0x39
NwkSKey: 0x99-0x19-0x94-0x2E-0xE3-0xB6-0x48-0x82-0x61-0x98-0x80-0x3E-0xAF-0xC9-0xC6-0x4E

I tried the LoRa Packet Decoder, but to no luck - see here or bellow:

I am using OTAA 1.0.3 on the US band and the current 4.1.1 version of arduino-lmic. The fact that the output changes leads me to believe that it might be encrypted. How would I go about decrypting it?

I have read through the source code and the documentation, and scoured the internet but cannot find any hints. Can anyone help?
Thank you!

Ok, I think I have it figured out - I am a dummy and didn’t really understand the structure of the LMIC.frame - this (in hindsight somewhat obviously) contains the whole LoRaWAN packet frame. The data is part of this frame, but starts at the LMIC.dataBeg

for (int i = LMIC.dataBeg; i < LMIC.dataBeg + LMIC.dataLen; i++) {
                    Serial.print(LMIC.frame[i], HEX);
                    Serial.print(" ");

works just fine