![\"\"](\"https:\/\/www.dpin.de\/nf\/wp-content\/uploads\/sites\/2\/2025\/11\/heltec-v2-150x150.jpg\")
![\"\"](\"https:\/\/www.dpin.de\/nf\/wp-content\/uploads\/sites\/2\/2025\/11\/heltec-v4-150x150.jpg\")
![\"\"](\"https:\/\/www.dpin.de\/nf\/wp-content\/uploads\/sites\/2\/2025\/11\/lilygo-t3-150x150.jpg\")
<\/p>\nFor some time, actually some years, I am pondering with ideas how to create a wide area low bandwidth data network. The regulatory situation is a bit limiting, you only have few license free bands at hand, the so called ISM bands. The most well know are the 2.4GHz and 5GHz bands used by WiFi and Bluetooth. But these have practical limits, signals in these band do not propagate very well and far, basically everything is in its path causes significant loss, which is why WiFi usually does not go much farther than your own apartment. What I am looking for is rather hundreds of meters range, or better even, kilometers.<\/p>\n
Given the limitation in ISM bands the currently best and most easily accessible radio is probably LoRa. LoRa can operate in the 433MHz, 868MHz and 900MHz ISM bands. The LoRa radios adhere to the ISM limitations, especially the (low) maximum transmit power, but still reach comparably long range. They do this by using a spread spectrum technology, which is sadly proprietary to LaRa by Semtech. But well, these exist and hardware with LoRa radio chips is abundantly available, there are dozens of different easily accessible development boards with LoRa radio chips like SX1262 or SX1278 plus some Espressif ESP microcontroller, for example:<\/p>\n
<\/p>\n
These boards are nice to build autonomous devices, like a sensor node or mobile messaging devices, or gateway devices that can be attached e.g. vie Bluetooth Low Energy (BLE) to your mobile phone. Probably one of the most well know projects doing this is Meshtastic<\/a>, another super interesting one is the Reticulum network<\/a>.<\/p>\n Maybe a small intermission, a word about LoRa. I always find discussions about LoRa super confusing because the word LoRa can have different meanings in different contexts. On the lower level there is the LoRa radio, which is what I described above. The LoRa radio and chips implementing it are protocol agnostic, i.e. you can use the radio chips as arbitrary data radios and transmit whatever you like, like Meshtastic and Reticulum do. Then there is also the LoRa protocol, which is a proprietary standard for creating mesh networks between different node types. The protocol can be used kind of freely but it is proprietary to the Semtech company. And then there is LoRa WAN, which is the extension of local mesh networks into larger networks using internet gateway nodes. The LoRa WAN network is a proprietary service by Semtech with low bandwidth \/ usage free tier options. What I am talking about and using here is just the LoRa radio.<\/em><\/p>\n Back to LoRa enabled hardware, the development board with some ESP controllers on them are very nice, but for protocol tinkering a bit cumbersome. You need to implement everything for some ESP controller and every time you want to try something, you need to flash one or two boards with a new firmware.<\/p>\n I am looking for generic LoRa radio which I can attach to my PC and develop software on my PC that directly use the attached radio to send \/ receive data packets over LoRa. It should ideally be small so that it can be carried around easily. Then I came across the E22-900T22U by Ebyte<\/a>:<\/p>\n Very compact, USB interface, SMA connector for an external antenna – nice! So I ordered one. The problem with these is that they embed a small microcontroller to interface with the LoRa radio chip which implements a proprietary protocol, which is more geared towards to point to point data transmission, like a serial data bridge. This is not what I need. So I cracked it open to figure out if this can be changed:<\/p>\n Ebyte E22-900T22U PCB, side by side, one side flipped so that connections can be traced more easily<\/p><\/div>\n Inside you can find a Semtech LLCC68 LoRa radio chip, a ZBit Semi CX32L003F8<\/a> ARM Cortex M0 microcontroller, a CH340 USB to serial UART bridge, a red and green LED and a push button. Ebyte was nice enough to also embed four free solder vias for the SWD in system debugging interface (top right). Cool! For all these chips datasheets can be kind of easily found on the internet. With some poking around I found most connections.<\/p>\n The ZBit Semi CX32L003 is not a very common microcontroller. But since it is a ARM Cortex M0 implementation we can be hopeful. On Debian Linux you can easily install a cross toolchain, which is part of Debian:<\/p>\n ZBit Semi was kind enough to make an ARM CMSIS based SDK<\/a> available as open source on Github. So far so good. But how to get a program into the flash of the controller? The CX32L003 has a built-in bootloader that can be activated by holding the push button during power-on (i.e. plugging the dongle into USB). ZBit Semi offers an In System Programming (ISP) tool for the CX32L003 on their website<\/a>, but that’s Windows only and the serial protocol is not documented anywhere. And even if we had the protocol then you probably also want some debugging means for development.<\/p>\n After some hours of internet research I came across the work of Benjamin Vernoux! Benjamin has worked a lot on a similar Ebyte device and put a lot of effort into getting a cross development environment working. One part of his work is a patch for OpenOCD for the CX32L003<\/a>! That was already back in 2023 and the patch is not merged until today, so it does not come with the OpenOCD package e.g. found in Debian. But the patch still kind of cleanly applies to current OpenOCD. For my own and probably also your convenience I created a fork on my own code hosting server and applied the patch: https:\/\/source.haeckserei.de\/nica\/openocd-code<\/a><\/p>\n Then I soldered wired to the SWD pins and attached a cheap ST-Link SWD adapter:<\/p>\n Ttogether with the patched OpenOCD I get this:<\/p>\n We are in business!<\/p>\n Next the firmware. The CMSIS code base is not directly tailored for the GNU toolchain, rather some Eclipse based more or less commercial development environment. But also here Benjamin already laid out the groundwork, which can be found, along with a lot more information, on his server: https:\/\/hydrabus.com\/openocd_cx32l003\/<\/a> In there you can find a project called ‚Test_E220-900T22D_llcc68_ping_pong_EEZBB3.7z<\/a>‚ which has a customized version of the SDK and a demo program for the Ebyte E220 LoRa module, which can be compile with the Linux GNU cross toolchain and simple make!<\/p>\n I have modified it for the E22 dongle, the pinout is a bit different, additional LEDs etc. Right now it is still called very creatively „hello_world“ \ud83d\ude42 And that’s about what it looks like compiling:<\/p>\n Pretty cool! So we now have a linked ELF binary. Now flashing it via OpenOCD:<\/p>\n If everything worked out according to plan then the new program is now running on the controller, in my case I get some debug log output on the UART, I am using the very simple but handy tool ‚tio‘ to connect to it:<\/p>\n As you can see I still have not renamed everything, the „Ping Pong“ demo strings are still in there \ud83d\ude42 But I did change the program quite a bit by now. The radio is now in continuous receive mode, I also changed the frequency and LoRa parameters sync word, spreading factor, bandwidth and coding rate to the Meshtastic Medium-Slow<\/a> defaults, the default Long-Fast uses 250kBit and spreading factor 11, which does not seem to be supported by the LLCC68. Anyway, using the Medium-Slow default and a Meshtastic radio I can get something like this:<\/p>\n Wohoo! That should be some Meshtastic protocol packet!<\/p>\n So we can safely say, we have a working toolchain, compiler + linker, a working BSP and an in system debugger up and running perfectly fine!<\/p>\n I still need to clean up my testing mess a bit and will soon upload my WIP code to my server<\/a>. I am currently working on integrating an AT command parser for configuration and switching modes (between AT and ‚online‘ mode). There is also some storage space in flash, maybe I can make settings persistent. I also need to think about a proper protocol to send \/ receive data, the ASCII hexdump shown above is for sure not ideal.<\/p>\n I would also be very interested in help reverse engineering the serial ISP protocol so that these dongles could be more easily reflashed in the field – hint: The ISP Windows application is a .NET application which probably can be reverse translated to read the protocol from it? It would be very cool to have a small Linux commandline tool for that so that everyone with these dongles can flash an alternative firmware easily.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Introduction For some time, actually some years, I am pondering with ideas how to create a wide area low bandwidth data network. The regulatory situation is a bit limiting, you only have few license free bands at hand, the so called ISM bands. The most well know are the 2.4GHz and 5GHz bands used by WiFi and Bluetooth. But these… Read more »<\/a><\/p>\n","protected":false},"author":1,"featured_media":2286,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,37,2],"tags":[136,135,137,134],"class_list":["post-2285","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devices","category-floss","category-geek-stuff","tag-cx32l003","tag-development","tag-llcc68","tag-lora"],"_links":{"self":[{"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/posts\/2285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/comments?post=2285"}],"version-history":[{"count":12,"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/posts\/2285\/revisions"}],"predecessor-version":[{"id":2303,"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/posts\/2285\/revisions\/2303"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/media\/2286"}],"wp:attachment":[{"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/media?parent=2285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/categories?post=2285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dpin.de\/nf\/wp-json\/wp\/v2\/tags?post=2285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Intermission<\/h3>\n
Goal<\/h3>\n
![\"Ebyte](\"https:\/\/www.dpin.de\/nf\/wp-content\/uploads\/sites\/2\/2025\/11\/ebyte-e22-900t22u-300x249.jpg\")
<\/p>\n![\"E22-900t22U](\"https:\/\/www.dpin.de\/nf\/wp-content\/uploads\/sites\/2\/2025\/11\/e22-900t22u-pcb-1024x434.jpg\")
Development, Tools, SDK<\/h3>\n
sudo apt install gcc-arm-none-eabi binutils-arm-none-eabi<\/pre>\n
![\"\"](\"https:\/\/www.dpin.de\/nf\/wp-content\/uploads\/sites\/2\/2025\/11\/swd-e22-t22u-sm-209x300.jpg\")
<\/p>\n$ openocd -f interface\/stlink.cfg -f target\/cx32l003.cfg\r\nOpen On-Chip Debugger 0.12.0+dev-01248-g22afaae7f-dirty (2025-11-02-14:15)\r\nLicensed under GNU GPL v2\r\nFor bug reports, read\r\nhttp:\/\/openocd.org\/doc\/doxygen\/bugs.html\r\nWarn : DEPRECATED: auto-selecting transport \"swd (dapdirect)\". Use 'transport select swd' to suppress this message.\r\nInfo : using default value max bank size\r\nInfo : Listening on port 6666 for tcl connections\r\nInfo : Listening on port 4444 for telnet connections\r\nInfo : STLINK V2J29S7 (API v2) VID:PID 0483:3748\r\nInfo : Target voltage: 3.282518\r\nInfo : Unable to match requested speed 2000 kHz, using 1800 kHz\r\nInfo : Unable to match requested speed 2000 kHz, using 1800 kHz\r\nInfo : clock speed 1800 kHz\r\nInfo : SWD DPIDR 0x0bc11477\r\nInfo : [cx32l003.cpu] Cortex-M0+ r0p1 processor detected\r\nInfo : [cx32l003.cpu] target has 4 breakpoints, 2 watchpoints\r\nInfo : [cx32l003.cpu] Examination succeed\r\nInfo : [cx32l003.cpu] starting gdb server on 3333\r\nInfo : Listening on port 3333 for gdb connections<\/pre>\n
$ make\r\n...\r\nMemory region Used Size Region Size %age Used\r\nRAM: 2440 B 4 KB 59.57%\r\nFLASH: 25008 B 64 KB 38.16%\r\n\r\nInvoking: GNU ARM Cross Create Flash Image\r\narm-none-eabi-objcopy -O ihex \".\/build\/hello_world.elf\" \".\/build\/hello_world.hex\"\r\n\r\nCreate Flash Image BIN\r\narm-none-eabi-objcopy -O binary \".\/build\/hello_world.elf\" \".\/build\/hello_world.bin\"\r\n\r\nInvoking: GNU ARM Cross Create Listing\r\narm-none-eabi-objdump --source --all-headers --demangle --line-numbers --wide \".\/build\/hello_world.elf\" > \".\/build\/hello_world.lst\"\r\n\r\nInvoking: GNU ARM Cross Print Size\r\narm-none-eabi-size --format=berkeley \".\/build\/hello_world.elf\"\r\ntext data bss dec hex filename\r\n24884 124 2324 27332 6ac4 .\/build\/hello_world.elf<\/pre>\n
$ telnet localhost 4444\r\nTrying ::1...\r\nConnection failed: Verbindungsaufbau abgelehnt\r\nTrying 127.0.0.1...\r\nConnected to localhost.\r\nEscape character is '^]'.\r\nOpen On-Chip Debugger\r\n> reset halt \r\n[cx32l003.cpu] halted due to debug-request, current mode: Thread \r\nxPSR: 0x61000000 pc: 0x00004cb4 msp: 0x20001000\r\n> program hello_world.elf\r\n[cx32l003.cpu] halted due to debug-request, current mode: Thread \r\nxPSR: 0x61000000 pc: 0x00004cb4 msp: 0x20001000\r\n** Programming Started **\r\nAdding extra erase range, 0x000061b0 .. 0x000061ff\r\ncx32l003_write buffer=0x55a9bef4a700 offset=0x00000000 count=25008\r\n** Programming Finished **\r\n> reset run<\/pre>\n
# tio -b 115200 -f none -m INLCRNL \/dev\/ttyUSB0\r\n\r\nLLCC68 Ping Pong logs UART1, PA2-TXD, PA1-RXD\r\nINFO: ===== LLCC68 Ping Pong =====\r\n\r\nINFO: SDK version: 2.0.1-4-gc964966\r\nINFO: \r\nINFO: LLCC68 get default lora syncword=0x1424 (expected 0x1424)\r\n\r\nINFO: Common RF parameters:\r\nINFO: Packet type = LLCC68_PKT_TYPE_LORA\r\nINFO: RF Freq = 869525000 Hz\r\nINFO: Output power = 0 dBm\r\nINFO: Fallback mode = LLCC68_FALLBACK_STDBY_RC\r\nINFO: Rx boost mode deactivated\r\nINFO: \r\nINFO: LoRa modulation parameters:\r\nINFO: Spreading Factor = LLCC68_LORA_SF10\r\nINFO: Bandwidth = LLCC68_LORA_BW_250\r\nINFO: Coding rate = LLCC68_LORA_CR_4_5\r\nINFO: \r\nINFO: LoRa packet parameters:\r\nINFO: Preamble length = 8 symbol(s)\r\nINFO: Header mode = LLCC68_LORA_PKT_EXPLICIT\r\nINFO: Payload length = 128\r\nINFO: \r\nINFO: LoRa sync word = 0x2b<\/pre>\n
INFO: Packet status:\r\nINFO: - RSSI packet = -39 dBm\r\nINFO: - Signal RSSI packet = -39 dBm\r\nINFO: - SNR packet = 8 dB\r\nINFO: Preamble detected\r\nINFO: on_preamble_detected\r\nINFO: Header valid\r\nINFO: on_header_valid\r\nINFO: Rx done\r\nPacket content - (58 bytes):\r\nC0 85 52 EC 8B C2 04 C3 94 99 33 AD DF C0 DB 14\r\nC8 DA 6A 47 1C 2D FF FF FF FF 54 FC A5 A0 A8 2D\r\nCC 65 63 18 00 54 D6 E4 2D 14 06 D8 35 89 25 E2\r\n24 79 5F 42 B4 48 6F 38 20 30<\/pre>\n
Outlook<\/h3>\n