Bare-metal firmware for the FreeWili 2 (Raspberry Pi RP2350B) that turns its on-board CC1101 radio and 480×320 touch LCD into a hand-held sub-GHz tool: a spectrum analyzer, a live signal monitor, and a capture + re-transmit ("replay") workflow for OOK remotes.
Above: the Monitor screen capturing a 433.92 MHz OOK remote and replaying it over the air to drive the two light-up wristbands.
▶ Watch the demo on YouTube — recording a wristband remote and transmitting it back to control the light.
- Spectrum Analyzer — sweeps a selectable ISM band (315 / 433 / 868 / 915 MHz) and renders a live waterfall in a PSRAM framebuffer, plus a find-strongest peak readout. Auto-tracked noise floor with a one-touch TARE (baseline zero) so real signals pop above ambient. Antenna is auto-selected per band (overridable).
- Monitor — async-transparent OOK receive: the CC1101 slices the raw data onto GDO0, which a PIO + DMA ring samples off-bus into an edge-duration stream. Shows a live logic-style trace of the burst plus edge/burst/gap stats and RSSI.
- Capture & Transmit (replay) — REC records the edge stream to an 8 MB PSRAM clip; TX re-transmits it over the air via CC1101 async-transparent OOK, so the original device reacts as if its own remote sent the signal.
- RGB LED indicator — the 16 on-board WS2812s show a live spectrum line on the Analyzer and a green "signal present" breathe on the Monitor.
- Touch UI — LVGL v9 over an FT6336 capacitive panel; the fast traces are drawn by direct PSRAM→LCD DMA blits (not LVGL canvases) to fit in SRAM.
| Part | Detail |
|---|---|
| MCU | RP2350B (FreeWili 2), overclocked to 250 MHz @ vreg 1.25 V, copy_to_ram |
| Radio | CC1101 on SPI1 (shared with the LCD), GDO0 = live data (PIO-sampled) |
| Display | ST7796 480×320 SPI LCD |
| Touch | FT6336 over I2C1 |
| LEDs | 16× WS2812 on a single PIO-driven data line |
| PSRAM | APS6404L 8 MB, memory-mapped (framebuffers + capture clip store) |
| Antenna | SMA + on-board antenna mux (PCAL6524 I/O expander), routed per band |
Diagnostics are SEGGER RTT only (no UART/USB stdio).
Toolchain: Pico SDK 2.2.0 + ARM GCC (via ~/.pico-sdk). Host: Windows + PowerShell.
powershell -File tools/build.ps1 # build -> C:/buildfiles/subghz/subghz.uf2 + .elf
powershell -File tools/flash.ps1 # OpenOCD SWD program + verify + reset
powershell -File tools/rtt.ps1 # live SEGGER RTT diagnostics
powershell -File tools/test.ps1 # host unit tests (MinGW GCC + Ninja + CTest)The pure logic cores (scan, monitor, capture, replay pacing, palette, LED, touch
mapping) are compiled and unit-tested on the host under tests/ — no hardware
required.
- HOME → pick Analyzer or Monitor.
- Analyzer: choose a band; watch the waterfall.
WFALL/PEAKtoggles the mode,RUN/PAUSEthe sweep,TAREre-zeros the baseline. - Monitor: choose a band/
MOD; the trace shows live bursts.- REC — records the current signal to a PSRAM clip (button turns red).
- TX — re-transmits the recorded clip over the air (OOK).
TX makes the CC1101 transmit on ISM frequencies. Radio transmission is
regulated (FCC / CE / your local authority). Only transmit to devices you own,
keep within your region's power/duty limits, and don't interfere with others. This
project is for education, personal automation, and authorized security research
on your own equipment. You are responsible for how you use it.
MIT © 2026 Dave Robins. Some files are adapted from other projects under their own licenses — see THIRD-PARTY-NOTICES.md.
- Board/display/PSRAM/tooling adapted from evaderkrub/usbcamfw; WS2812 driver from evaderkrub/sensorview.
- LVGL (MIT), SEGGER RTT (BSD-3), Raspberry Pi Pico SDK (BSD-3).
See AGENTS.md for the architecture map, the hard-won hardware invariants, and the module layout.