Radioenge – Hack

  • by

Hello, last month I bought a Brazilian LoRaWAN module.

Radioenge is a module with stm32l071cz mcu and sx1272 for LoRa communication.

This module uses AT communication to configure and send data over the LoRaWAN, and my experience with the module was not the best, the library is a little confuse and jank.

I have 3 modules and 2 of then does not work Join as intended. So I tried to talk with the support company to make the modules works. All the things the support asked me to do I already tried…

So I asked…

Can I burn a new firmware? And they said No.

Can I have the schematic? And they said No.

Ok, then I do It myself.

Burn a new Firmware

The challenge begins…

Let’s check the datasheet of the stm32l071cz. I can use the BOOT pin to burn a new firmware… Nop the pin is connected to de GND.

Probably the SWD pins are available and yes there are available to use!

Using a multimeter and the datasheets I was able to check all the pins and create this image.

I need the ST-LINK to burn the mcu using the SWDIO and SWCLK pins.

I Installed the STM32CubeProgrammer to burn the board.

I tried to connect to the board but it was on the sleep mode, I needed to hold the reset button (connect to the GND) and then press connect on STM32CubeProgrammer and realize the reset button.

The connection should be a success.

Now I go on the OB (Option Bytes) and find the Read Out Protection (RDP) the value should be BB. Change to AA to remove the protection of the flash and press Apply. The board should be erased and is ready to work with the Arduino IDE.

Arduino IDE

I downloaded and installed the STM32Cube MCU Packages to be able to upload some new firmware.

The STM32Cube MCU Packages does not have the exactly mcu (stm32l071cz), but is possible to use some similar to make works.

I used the stm32l073, the pinout is really similar and should work like a charm.

Select the board Nucleo-64 and board part number Nucleo L073RZ. And change the upload method to STM32CubeProgrammer (SWD).

I tried some blink and works great!

LoRa

I’m still testing with the lmic library, and was able to send and receive message from the ttn.

You can find more information on the github.