CC1101 on Cardputer ADV: What Bruce Firmware Actually Lets You Learn (868 & 915 MHz Guide, 2026)

PINGEQUA Lab -- Sub-GHz learning guide -- 16 min read -- Published 2026-07-29

Buying a CC1101 cap is easy. Understanding what the chip is actually doing -- and why an 868 MHz board can't become a 915 MHz board -- is the part that turns a gadget into an education. This is that guide.

Why Sub-GHz is the best radio band to learn on

If you want to actually understand radio rather than just use it, the Sub-GHz ISM bands -- 433 MHz, 868 MHz, 915 MHz -- are the friendliest place to start, and it's worth being explicit about why.

• The protocols are simple enough to read by eye. A huge share of the traffic in these bands is on-off keying (OOK): the carrier is either present or absent, and the information lives entirely in how long it's present. Plot that on a screen and you can literally see the bits. Compare that to Wi-Fi or Bluetooth, where you need a full protocol stack before anything is legible.
• The devices are everywhere and boring. Weather stations, tire-pressure sensors, garage remotes, doorbells, wireless thermometers, utility meters. Boring is good -- it means abundant, repeatable signals to study without touching anything sensitive.
• The physics is visible. Lower frequency means longer wavelength, better diffraction around obstacles, and more forgiving antennas. You can feel the difference between 433 MHz and 2.4 GHz walking around a building in a way that's hard to grasp from a textbook.
• Receiving is the whole first month. Nearly everything worth learning at the start happens in RX. That matters legally as well as pedagogically -- listening carries a very different regulatory profile from transmitting.

What you need is hardware that exposes the radio at a low enough level to be instructive, on a host portable enough that you'll actually carry it. That's the specific niche the Cardputer ADV plus a CC1101 cap occupies.

The CC1101, chip-level: what you're actually holding

The CC1101 is a low-power sub-1 GHz RF transceiver from Texas Instruments. It is not a "433 MHz chip" or an "868 MHz chip" -- it is a software-configurable radio covering three frequency ranges, and the numbers below come straight from TI's product page:

Read that table again and one thing should jump out: the CC1101 chip is not what makes a board 868 MHz or 915 MHz. The silicon covers 779-928 MHz continuously, which spans both. What makes the Hydra RF 824 Pro an 868 MHz product and the 924 Pro a 915 MHz product is everything around the chip -- the impedance matching network and the antenna, both physically tuned to one center frequency.

OOK, ASK, FSK -- the vocabulary you'll need

Three terms come up constantly and are worth nailing down before you touch the hardware:

• OOK (on-off keying) -- the transmitter is either radiating a carrier or silent. A "1" is carrier-on for some duration, a "0" is carrier-on for a different duration (or carrier-off). Cheapest possible radio to build, which is why it dominates key fobs, garage doors, and $6 weather sensors.
• ASK (amplitude-shift keying) -- the general family OOK belongs to; the amplitude of the carrier encodes the data. In practice, in this hobby, people use "ASK" and "OOK" nearly interchangeably.
• FSK (frequency-shift keying) -- the carrier stays on and shifts between two (2-FSK) or four (4-FSK) frequencies. More robust against amplitude noise, so it's what you find in better-engineered devices, and in most of the 868/915 MHz IoT world.

Bruce's capture tooling is strongest on ASK/OOK, which lines up neatly with what a beginner should be studying first anyway. When you eventually hit a device you can't decode, "it's probably FSK, and here's how I'd confirm that from the spectrum view" is exactly the reasoning skill this hardware is meant to build.

The hardware: what a Hydra RF 824 / 924 Pro adds to a Cardputer ADV

The host first. The M5Stack Cardputer ADV is an ESP32-S3FN8 (Xtensa 32-bit LX7 dual-core, 240 MHz) with 8 MB flash, a 1.14 inch ST7789V2 display at 240x135, a 56-key keyboard, and a 1750 mAh battery, per M5Stack's official documentation. Critically for our purposes, it exposes an EXT 2.54-14P rear expansion header carrying GPIO (G3, G4, G5, G6, G13, G15), power (5VIN / GND / 5VOUT), and SPI / I2C / UART signals.

That rear header is the whole story of ADV-versus-v1.1 compatibility. The original Cardputer v1.1 does not have it, which is why every Hydra RF cap is Cardputer ADV only -- a point we've broken down separately in our ADV vs v1.1 RF module compatibility guide, and by a distance the number one cause of "my module isn't detected" support tickets.

What the cap itself brings:

The dual-radio arrangement is the part worth dwelling on, because it's a genuine architectural decision rather than a spec-sheet bullet. Two SPI radios sharing one bus on a microcontroller is a classic source of bugs -- if both chips can be selected at once, or if one holds the bus while the other is initialized, you get the "works only if I open the other one first" class of failure that's been documented in Bruce's own issue tracker. Handling that arbitration in hardware, rather than hoping the firmware always gets chip-select ordering right, removes a whole failure category from the beginner experience.

If you want the wider comparison of Sub-GHz versus 2.4 GHz roles on this platform, we cover it in CC1101 vs nRF24L01+: which one do you actually need.

Bruce firmware: every RF menu item, and what each one teaches

Bruce is the open-source ESP32 firmware that turns the Cardputer ADV into a usable radio instrument. The current release at the time of writing is Bruce 1.16, published 2026-07-24, which added Keeloq decode support among other RF improvements. This is the section most buying guides skip -- and it's the one that determines whether your $36 cap becomes a learning tool or a drawer ornament.

Here is the actual RF menu, per the Bruce wiki, with the pedagogy attached to each entry:

On the 2.4 GHz side, be realistic about scope: the Bruce wiki describes the nRF24 feature set as using the module "to jam 2.4 GHz signals and view the spectrum." Setting aside the jamming functions, that leaves 2.4 GHz spectrum viewing as the legitimate educational use -- which is genuinely worthwhile (watch Wi-Fi channels 1/6/11 light up, see Bluetooth hop across the band), but it is a narrower capability than the Sub-GHz side. Anyone telling you the nRF24L01+ on these caps is a full-featured 2.4 GHz analysis suite is overselling it.

Setup: flashing Bruce and getting the module recognized

All three Hydra RF models -- 424, 824 Pro, 924 Pro -- use an identical GPIO assignment, so the setup is the same regardless of band. Only the final frequency selection differs.

1. Attach the hardware. Seat the cap on the Cardputer ADV expansion header and screw on both antennas -- the Sub-GHz antenna and the 2.4 GHz antenna. Do this before powering up. Running any RF transmitter without an antenna attached risks damaging the output stage; M5Stack issues the same warning for its own LoRa cap.

2. Flash Bruce. The path of least resistance is a browser-based flasher -- no toolchain, no Python environment, no drivers to hunt down. Use the PINGEQUA one-click flasher at flash.pingequa.com/devices/cardputer-bruce in Chrome or Edge on desktop with a USB data cable (charge-only cables are a recurring false alarm). The official bruce.computer/flasher works too. Our full walkthrough of browser-based flashing is in how to flash Marauder, Bruce and 5Ghost without a PC toolchain.

3. Confirm the pin configuration. Bruce reads its GPIO map from brucepins.conf. The PINGEQUA flasher applies the Hydra configuration automatically; if you need to check or set it by hand, the published values are:

CC1101_CS = 13
CC1101_GDO = 5

NRF24_CS = 6
NRF24_CE = 4

To edit manually: connect the Cardputer to your network, open Files > WebUI, log in with the default credentials admin / bruce, edit brucepins.conf, save, and restart. One trap worth knowing: the config can live on either the SD card or LittleFS, and if both exist you want them consistent.

4. Select the radio. Navigate to RF > Config > RF Module > CC1101. On a shared-SPI board, pick the shared-SPI option rather than legacy.

5. Set your frequency. This is the only model-specific step:

Restart after changing it. If the module still isn't detected, our dedicated troubleshooting piece -- Bruce firmware on M5Stack: fixing CC1101 / nRF24 not found -- walks the full decision tree. In our experience the cause is almost always one of four things, in this order: wrong host (v1.1 instead of ADV), stale or wrong firmware build, brucepins.conf not applied, or the module not selected in RF Config. Dead hardware is rare and should be your last hypothesis, not your first.

868 MHz or 915 MHz: choosing for Europe and North America

The rule is simple and has two halves that must both be satisfied: pick the band your region allocates for short-range devices, and confirm it's the band the devices you want to study actually use. Getting only one right leaves you with a board that's either legally fine but deaf, or well-matched but not something you should be transmitting on.

Europe and the UK: 868 MHz (Hydra RF 824 Pro)

The European short-range device allocation is the 863-870 MHz band, harmonised under ETSI EN 300 220 and CEPT/ERC Recommendation 70-03. The defining characteristic that surprises newcomers from North America is duty-cycle limiting: sub-bands within 863-870 MHz carry maximum transmit-time percentages, so a device may only be on the air for a small fraction of any given period. That constraint shapes how European Sub-GHz protocols are designed -- short packets, infrequent transmissions, no chatty polling.

The precise sub-band table (frequency edges, ERP limits, and duty-cycle percentages per sub-band) is revised periodically and implemented with national variations. We deliberately don't reproduce a table here, because an out-of-date regulatory table is worse than none -- check the current text of ETSI EN 300 220-2 and your national regulator (Ofcom in the UK, BNetzA in Germany, ARCEP in France, and so on) before transmitting.

868.35 MHz -- the Bruce setting for the 824 Pro -- sits in the widely used general-purpose portion of this band and is where a great deal of European consumer and IoT traffic lives.

US, Canada, Australia: 915 MHz (Hydra RF 924 Pro)

North America and Australia use the 902-928 MHz ISM band. In the US this falls under 47 CFR section 15.247, which covers 902-928 MHz, 2400-2483.5 MHz, and 5725-5850 MHz. For digitally modulated systems the maximum peak conducted output power is 1 watt, and the minimum 6 dB bandwidth must be at least 500 kHz. Frequency-hopping systems in 902-928 MHz are allowed 1 W with at least 50 hopping channels, or 0.25 W with fewer than 50.

Note how much of a non-issue those ceilings are for a CC1101, which tops out at +12 dBm -- about 16 milliwatts. This class of hardware operates orders of magnitude below the regulatory limit. The constraints that will actually bite you are not power limits; they're the rules about what you transmit and toward whom.

Culturally, 915 MHz is also where the interesting North American device population lives: smart meters, LoRa and LoRaWAN deployments, industrial telemetry, and a growing share of consumer IoT. If you're in the US, the 924 Pro is not a compromise -- it's the band with the richest set of things to look at.

What about 433 MHz?

433 MHz remains the most common band worldwide for cheap consumer remotes, and the Hydra RF 424 covers it at USD 32.99. It's the right choice if your targets are key fobs, garage remotes, and budget sensors regardless of where you live -- though in the US it overlaps the 70 cm amateur band, which is worth understanding before you key up. Our 424 vs 824 vs 924 band selection guide handles that decision in depth.

CC1101 vs SX1262: the Hydra RF and the M5Stack LoRa Cap are not rivals

The most common question we get from Cardputer ADV owners is some version of "should I get the Hydra RF or the official M5Stack LoRa cap?" -- and the honest answer is that the question contains a false premise. They're different radios for different jobs, and quite a few people should own both.

The M5Stack Cap LoRa-1262 (SKU U214, USD 14.50) pairs a Semtech SX1262 LoRa transceiver with an ATGM336H-6N multi-constellation GNSS receiver. Per M5Stack's documentation it operates across 868-923 MHz, transmits up to +22 dBm, and supports FSK, GFSK, MSK, GMSK, LoRa, and OOK modulation. It ships with a LoRa rubber antenna. M5Stack also sells a Cardputer Mesh Kit (USD 48.00, announced April 2026) that bundles the LoRa cap with a Cardputer ADV pre-flashed with Meshtastic firmware.

The technical distinction that matters

LoRa is a modulation scheme -- chirp spread spectrum, in which each symbol is a frequency sweep across the channel. That design is what buys LoRa its extraordinary link budget: a receiver can pull a LoRa signal out from below the noise floor, which is how kilometres of range at milliwatt power becomes possible. The price is data rate. LoRa is slow, and it's a closed-ish ecosystem: you talk LoRa to other LoRa devices, using a stack like Meshtastic or LoRaWAN.

The CC1101 does the opposite thing well. It doesn't have LoRa's link budget, but it speaks the plain, narrowband modulations that the existing installed base of short-range devices actually uses -- the OOK garage remote, the 2-FSK weather sensor, the ASK doorbell. It's a generalist listener in a band full of chatter.

So the split is clean:

• You want to send messages off-grid, run a Meshtastic node, or log GPS positions -- the M5Stack Cap LoRa-1262 is the correct product, and it's inexpensive. A Hydra RF cap will not join a Meshtastic mesh; it isn't an SX1262 and isn't sold as a LoRa or Meshtastic accessory.
• You want to see what's already transmitting around you, learn how those signals are constructed, and read a spectrum -- that's the Hydra RF's job. The LoRa cap, running Meshtastic, isn't a general-purpose Sub-GHz analysis tool.
• You want both -- they're both caps for the same host, so swap them. USD 35.99 + USD 14.50 covers a genuinely broad slice of the sub-1 GHz world.

We compare the two products head-to-head from a buying standpoint in M5Stack LoRa Cap vs PINGEQUA Hydra RF.

A realistic learning path: first hour to first month

The failure mode with this kind of hardware isn't the hardware -- it's opening every menu on day one, understanding none of it, and shelving the thing. Here's a sequence that actually builds.

Hour 1 -- Get recognized, then stop

Attach both antennas, flash Bruce, confirm brucepins.conf, select CC1101 in RF Config, set your frequency (868.35 or 915.00). Success criterion for hour one is narrow and specific: the module is detected and you can open a spectrum view without an error. Don't try to capture anything yet.

Hour 2 -- Learn your own noise floor

Open RSSI Spectrum and leave it running. Sit in a room and watch the baseline. Walk into another room. Go outside. You're building the single most useful intuition in practical radio: what "nothing" looks like, so that "something" becomes obvious. Most beginners skip this and then can't tell a signal from a fluctuation.

Hour 3 -- Capture something you own

Take a remote you own -- your own garage door, your own doorbell, your own weather station -- and use Scan/Copy. Watch whether Bruce identifies a known protocol. Then repeat in raw mode and use Record Raw to look at the pulse durations. Press the button five times and compare the captures. This is the moment the abstraction breaks open.

Day 2-7 -- Read the datasheet alongside the screen

Now go back to the CC1101 numbers with the device in front of you. Change the data rate and watch what happens to what you can receive. Look at the sensitivity figures (-116 dBm at 0.6 kBaud versus -112 dBm at 1.2 kBaud) and connect them to what you observe. Open Spectogram and identify how wide your captured signal actually is. This is where hobbyist and engineer diverge -- the engineer reads the datasheet.

Week 2+ -- Protocols, and why replay mostly fails

Capture a modern car key fob or a recent garage opener and try to understand why a straight replay doesn't work. The answer is rolling codes: the transmitter and receiver share a counter and a key, every press generates a different valid code, and a previously-sent code is rejected. KeeLoq is the classic implementation -- Bruce 1.16 added KeeLoq decode support, so you can now inspect the structure rather than just seeing an opaque blob.

This is the most valuable lesson the hardware teaches, and it's a defensive one. You learn why a well-designed system resists replay, which is precisely the knowledge that makes you able to spot a badly-designed one. It also permanently defuses the "this device opens any garage" fantasy -- it doesn't, and understanding the mechanism is more interesting than the fantasy was.

Where to go next

From here the paths fork: deeper protocol analysis (pair the Cardputer with an SDR for wideband work), the 2.4 GHz side via the onboard nRF24L01+ spectrum view, or the Wi-Fi domain entirely -- the ESP32-S3 in the Cardputer ADV has its own radio, and firmwares like Marauder open a separate curriculum. Our Cardputer vs Flipper Zero comparison maps how these platforms complement each other.

Legal and ethical boundaries -- read this part

This hardware is sold and written about here for education, authorized testing, and research on systems you own or have written permission to test. Three specific boundaries:

1. Jamming is illegal, full stop. Bruce's menu contains jammer entries. In the United States, the FCC prohibits the manufacture, importation, marketing, sale, and operation of jamming equipment under 47 U.S.C. section 302a(b), with section 333 separately prohibiting willful or malicious interference and sections 501/503 providing for fines and criminal penalties. Jammers cannot be FCC-authorized at all, because interference is their entire purpose. The EU and UK positions are equivalent. There is no hobbyist, educational, or just-testing exemption. Don't use those menu entries.

2. Transmitting into systems you don't own is a separate problem from RF regulation. Even a perfectly Part 15-compliant transmission can constitute unauthorized access to someone else's device. The radio rules and the computer-misuse rules are different bodies of law and you can violate the second while fully complying with the first.

3. Receiving is generally the safe ground -- but not unconditionally. Listening to the ISM bands is where nearly all of this guide's learning value sits, and it's the lowest-risk activity. Certain categories of interception carry their own statutory restrictions depending on jurisdiction. If you stay with signals from devices you own, you're on solid ground.

None of the above is legal advice. Radio regulation is national, it changes, and the responsibility for compliance is the operator's.

FAQ

Sources and further reading: Texas Instruments, CC1101 product page -- M5Stack, Cardputer-Adv documentation -- M5Stack, Cap LoRa-1262 documentation and M5Stack store listing (SKU U214, USD 14.50) -- CNX Software, Cardputer Mesh Kit coverage, 30 April 2026 -- Bruce firmware, RF feature documentation and release history (v1.16, 24 July 2026) -- PINGEQUA, Hydra RF setup repository -- 47 CFR section 15.247 -- FCC Jammer Enforcement (47 U.S.C. sections 302a(b), 333, 301, 501, 503) -- ETSI EN 300 220-2 and CEPT/ERC Recommendation 70-03. PINGEQUA is an independent manufacturer and is not affiliated with M5Stack, Bruce, Texas Instruments, Nordic Semiconductor, Semtech, or Meshtastic. Product names and trademarks belong to their respective owners.

Educational and authorized-testing use only. Frequency allocation, power, and duty-cycle information above is general reference material, not legal advice -- radio regulation is national and subject to change, and compliance is the operator's responsibility. Verify current rules with your own regulator before transmitting on any band. Do not use jamming functions: they are illegal in the United States, the European Union, and the United Kingdom, with no hobbyist exemption. Only test systems you own or have explicit written authorization to test.