M5Stack Cardputer ADV Volume 4 — Module Ecosystem — M5Stack Cardputer ADV · Hacking

Cap modules + Grove Units catalog + HAT incompatibility note + M5MonsterC5 for 5 GHz + DIY hardware patterns

Section	Topic
1	About this volume
2	Cap modules — 14-pin EXT bus daughter cards
· 2.1	Cap LoRa-1262 (the flagship — full details in Vol 5)
· 2.2	Legacy Caps (EOL)
· 2.3	Future / community-discussed Caps
3	Grove Units — top-edge HY2.0-4P modules
· 3.1	Curated Grove Unit catalog
· 3.2	I²C bus management for multiple Grove Units
· 3.3	PaHub vs PbHub — when to use which
4	HAT modules do NOT fit Cardputer ADV
5	M5MonsterC5 — 5 GHz / Wi-Fi 6 coprocessor add-on
6	DIY hardware patterns
· 6.1	Grove I²C sensor breakout (cut-and-wire)
· 6.2	CC1101 sub-GHz add-on (Bruce-compatible)
· 6.3	Custom Cap on EXT bus (own daughterboard)
· 6.4	USB-C OTG accessories
· 6.5	Bypass Cap LoRa-1262 and feed own SX1262 / SX1276
7	Module-selection decision tree
8	Resources

1. About this volume

Vol 4 catalogs the modules and add-ons that extend the Cardputer ADV’s capabilities. Three official buses — Cap (14-pin EXT), Grove (HY2.0-4P), USB-OTG (USB-C) — plus the broader DIY landscape.

The Cap LoRa-1262 is the flagship and gets its own dedicated volume (Vol 5) for the LoRa radio + GNSS subsystem details. This volume covers the broader ecosystem at the catalog level: which Caps exist, which Grove Units are most useful, which HAT modules don’t fit (a common confusion), and how to wire up DIY add-ons.

2. Cap modules — 14-pin EXT bus daughter cards

2.1 Cap LoRa-1262 (the flagship — full details in Vol 5)

M5Stack SKU U214. Combines SX1262 LoRa radio + AT6668 multi-constellation GNSS on one daughter card mating to the EXT bus. Vendor price ~$24-30; commonly sold as part of the Cardputer ADV + Cap LoRa-1262 “Mesh Kit” bundle for ~$115.

Capsule specs (full coverage in Vol 5):

LoRa: SX1262 transceiver, 868-923 MHz tuned, +22 dBm TX (~163 mA peak), −147 dBm RX sensitivity at SF12/BW125, CSS + FSK/GFSK/MSK/GMSK/OOK modulation modes.
GNSS: ATGM336H-6N (AT6668) multi-constellation: GPS + GLONASS + Galileo + BeiDou + QZSS + SBAS. CEP50 <1.5 m. TTFF ~23 s cold / ~1 s hot.
Antenna: RP-SMA female connector. Ships with 3 dBi rubber-duck antenna.
Mechanical: 84 × 24 × 15.2 mm, 22.1 g. Mates flush to Cardputer ADV underside via 14-pin 2.54 mm header.

Use case: this Cap is the reason the Cardputer ADV is a viable Meshtastic + off-grid mesh platform. Without it, the Cardputer ADV is “just” an ESP32-S3 handheld.

2.2 Legacy Caps (EOL)

Two Caps predated the LoRa-1262 and are now end-of-life:

Cap LoRa868 v1.0 — single-band 868 MHz LoRa only, no GNSS. Superseded by the LoRa-1262.
LoRa+GPS Cap (early variant) — LoRa + early GPS-only (not multi-constellation). Superseded.

Don’t buy these used unless the price is essentially free — the LoRa-1262 is strictly better and software support has moved forward.

2.3 Future / community-discussed Caps

M5Stack has signaled more Caps coming but specific announcements are not shipping as of 2026-05-13. Community-discussed Cap concepts (none currently for sale):

NRF24 Cap — Nordic nRF24L01+ 2.4 GHz module on EXT. Enables micro:bit / wireless-keyboard-attacks (KeySweeper-style) / RC quadcopter sniffing. The most-requested community concept.
RTL-SDR Cap — RTL2832 receive-only SDR with USB-OTG output back to the Cardputer for spectrum display. Tricky because of the bandwidth (~2.5 Msps overruns S3 DSP without offloading).
E-paper Cap — always-on status display below the main TFT. Niche but interesting for low-power deployments.
Battery-booster Cap — stacks an additional 2000 mAh LiPo underneath. ~3500 mAh total for multi-day deployments.
Solar-harvesting Cap — 5V solar cell + LiPo charger controller for permanent outdoor relay use. Vol 9 § 3.3 covers a DIY solar-relay build that doesn’t require a Cap.
Cellular Cap (NB-IoT / LTE-M) — would fill the cellular gap for off-grid deployments where LoRa isn’t enough.

If you want any of these today, the DIY route (§ 6.3) is the only path — design your own daughterboard against the EXT pinout (Vol 3 § 4).

3. Grove Units — top-edge HY2.0-4P modules

Grove Units are M5Stack’s standardized peripheral modules — small PCB modules with a 4-pin HY2.0 cable. Plug-and-play. Two protocol classes: I²C (most common) and UART (PortC convention).

3.1 Curated Grove Unit catalog

The most useful Grove Units for Cardputer ADV use cases, in approximate order of utility:

Unit	Chip	Bus	Use case	Approx. price
Unit RFID2	WS1850S	I²C	NFC/RFID read/write — Mifare, NTAG, FeliCa. Used by Bruce RFID module.	~$10-12
CC1101 Sub-GHz Unit	TI CC1101	SPI (via Grove + bit-bang or PbHub-mapped)	433/868 MHz fixed-code replay (garage doors, weather, key fobs). The Flipper-style sub-GHz path.	~$10
Unit C6L	ESP32-C6 + SX1262	UART	Standalone Meshtastic node / USB Meshtastic radio. Complements the Cap LoRa-1262 for dual-radio Meshtastic.	~$15
433 MHz Tx+Rx Pair	Generic ASK modules	GPIO	Replay/jam fixed-code 433 MHz (garage doors, cheap weather stations). Cheaper than CC1101 for narrow use cases.	~$5 pair
Unit ENV IV	SHT40 + BMP280	I²C	Temperature + humidity + pressure for ESPHome / Home Assistant.	~$10
Unit GPS V2	u-blox AT6558	UART	Standalone GNSS (if not using Cap LoRa-1262’s AT6668).	~$12
Atomic GPS Kit	u-blox NEO-M8N	UART	Higher-grade GNSS with backup battery for faster TTFF.	~$20
Unit ToF / ToF4M	VL53L0X / VL53L1X	I²C	Distance ranging (0-2 m / 0-4 m).	~$8
Unit IR (with RX)	Generic 940 nm	GPIO	IR transmit AND receive (Cardputer ADV’s onboard IR is TX-only). Required for IR code learning.	~$5
Unit OLED 0.42”	SSD1306 128×64	I²C	Second tiny screen for status displays / debugging.	~$5
Unit ATOMS3R / Atom Echo	ESP32-S3	UART	Co-processor / second independent radio. Atom Echo has a mic + speaker.	~$15-20
PaHub	TCA9548A	I²C	6× I²C channel mux — multiple I²C sensors at conflicting addresses.	~$5
PbHub	ATmega328 + GPIO	I²C	6× digital I/O channels — switches, GPIO inputs, simple actuators. Cannot bus-bridge I²C.	~$8
Unit Thermal MLX90640	MLX90640	I²C	32 × 24 IR thermal camera @ 16 fps. Cardputer’s 240×135 screen scales it 8× into a colorful thermal map.	~$50
Unit Servo / Stepper / Relay / DAC	Various	I²C / GPIO	Actuator family.	$5-15 each
Unit Joystick / Encoder / Heart	Various	I²C	Input device family.	~$5 each
NB-IoT / 4G LTE / Cat-M Unit	Various modems	UART	Cellular for off-grid where LoRa / Wi-Fi won’t reach.	$30-60
RS485 / RS232 / CAN Unit	Standard transceivers	UART (RS-485 / CAN)	Industrial bus interfacing.	~$10

Other Grove Units exist (M5Stack has ~200+ Units catalogued) but the above 17 cover the most-asked-about Cardputer ADV use cases.

3.2 I²C bus management for multiple Grove Units

The Grove port is single — only one Unit at a time. To use multiple Units simultaneously, two options:

PaHub I²C mux — fan out the I²C bus to 6 channels. Same physical bus, but each channel can host a separate I²C device tree (including duplicate-address devices).
Mix Grove (single Unit) + EXT-bus I²C — Cap-class daughterboards expose I²C on the primary bus; Grove hosts the secondary I²C bus when re-tasked. Two distinct buses, four distinct address spaces (primary + secondary + Grove + EXT-Cap-internal).

PaHub is the simpler path for most users. EXT-side I²C is for cases where Caps demand it.

3.3 PaHub vs PbHub — when to use which

	PaHub	PbHub
Chip	TCA9548A	ATmega328 + GPIO array
Bus	I²C (bridges 6 channels)	I²C-master-control of GPIO (6 channels)
Use case	Multiple I²C devices	Multiple GPIO outputs / inputs (LEDs, switches, simple actuators)
Pitfall	PbHub cannot bridge I²C — common confusion. Only does GPIO.	Same — confusion goes the other way too.

If you need to hang 6 BME280s off the Cardputer ADV: PaHub. If you need to drive 6 LED indicators or read 6 button states: PbHub. Common mistake: buying PbHub expecting I²C bridging, or vice versa.

4. HAT modules do NOT fit Cardputer ADV

Important compatibility warning:

M5Stack “HAT” modules are designed for the StickC / StickC Plus / StickC Plus 2 / Stick S3 product family — pocket-form-factor sticks with 8-pin pogo connectors at the bottom.

The Cardputer ADV does NOT have HAT pins. The Cardputer ADV has Grove + EXT + USB-OTG — no pogo connector at all.

Documentation, tutorials, or product listings that say “use the X HAT for Cardputer” are wrong. Common ones encountered:

“Cardputer Thermal HAT” — actually a StickC Thermal HAT; doesn’t physically connect to Cardputer ADV.
“Cardputer ENV HAT” — same; use Unit ENV IV via Grove instead.

Workarounds:

Find the Grove Unit equivalent of the HAT — most HAT functions have a Grove Unit cognate.
Solder a custom adapter from HAT-pin pinout to Grove (rare; usually not worth it).
Wire the HAT’s chip directly to the Cardputer ADV’s Grove / EXT pins (for HATs that are essentially I²C chip + breakout — bypass the HAT pogo connector and wire to the chip pads directly).

When buying anything labeled “Cardputer X HAT”, verify against the M5Stack product page that it actually mates to the Cardputer ADV. If it shows 8-pin pogo pads, it’s a Stick-family HAT, not for Cardputer.

5. M5MonsterC5 — 5 GHz / Wi-Fi 6 coprocessor add-on

The single most-impactful add-on for Cardputer ADV pentest work: M5MonsterC5.

Spec	Value
Form factor	Grove-port-mating PCB
Coprocessor chip	ESP32-C5
Frequencies	2.4 GHz and 5 GHz Wi-Fi (Wi-Fi 6)
Interface to Cardputer ADV	UART at 921600 baud
Release date	Early 2026
Approximate price	~$25-35

Why it matters: the Cardputer ADV’s on-board ESP32-S3 is 2.4 GHz only (Vol 2 § 2.1). 5 GHz Wi-Fi networks are invisible to it. The M5MonsterC5’s ESP32-C5 coprocessor adds 5 GHz capability — scan, monitor, inject — and the results stream back to the Cardputer via UART for the on-screen UI.

Firmware integration: Marauder and Bruce have native M5MonsterC5 support. Marauder Settings → “5 GHz Coprocessor → MonsterC5 (UART)” routes 5 GHz scan results into the main scan-list UI. The C5 side runs its own firmware (typically a Marauder-equivalent build for C5 silicon); UART protocol is documented in the M5MonsterC5 + community-firmware repos.

Limitations vs a Linux laptop with a monitor-mode adapter: smaller — the C5 has limitations on packet-injection rates, no full 802.11ax / 6E support yet, and the UART throughput caps detailed analysis. For handheld 5 GHz work, M5MonsterC5 is the answer. For intensive 5 GHz pentest, a Linux laptop is still the better tool.

Alternative: M5Stack’s own “Cap ESP32-C5” if/when announced — would mount via EXT instead of Grove, possibly with higher UART throughput. Not shipping as of 2026-05-13.

6. DIY hardware patterns

6.1 Grove I²C sensor breakout (cut-and-wire)

For sensors not available as M5Stack Grove Units, cut a Grove HY2.0 cable and wire to a generic I²C sensor breakout.

Grove cable          Sensor breakout
───────────         ────────────────
Black   (GND)  ────  GND
Red     (5V)   ────  VCC (5V tolerant) OR via AMS1117-3.3 ── VCC (3.3V only)
Yellow  (G1)   ────  SDA
White   (G2)   ────  SCL

Notes:

Yellow / white assignment may differ — verify with multimeter. Some Grove cables swap.
Add 4.7 kΩ pull-ups SDA→3.3V and SCL→3.3V if the breakout lacks them (newer breakouts include them).
Use Wire1.begin(2, 1) in Arduino for the secondary I²C bus on G1/G2.

Worked example: BME280 (temperature + humidity + pressure). $5 module from AliExpress. Standard Adafruit_BME280 library, change to Wire1 and 0x76 address. Done.

6.2 CC1101 sub-GHz add-on (Bruce-compatible)

CC1101 from AliExpress (~~$5) + small whip antenna (~~$2) gives the Cardputer ADV Flipper-style sub-GHz capability:

Option A — bit-banged SPI on Grove (slow, works for low-rate capture):

CC1101 pin    Grove pin    Function
─────────    ─────────    ──────────
VCC          Red          5V (with onboard 3.3V regulator on most CC1101 modules)
GND          Black        GND
CSN          Yellow       Chip-select (G1, bit-banged)
SCK          White        Clock (G2, bit-banged)
MOSI         (via PbHub)  Data out
MISO         (via PbHub)  Data in
GDO0         (via PbHub)  Interrupt

Requires PbHub for additional GPIO. Slow (CC1101 bit-banged maxes at ~1 MHz effective).

Option B — proper SPI on EXT when LoRa Cap is removed (full-speed):

CC1101 pin    EXT bus pin    Function
─────────    ───────────    ──────────
VCC          Pin 1 (3V3)    3.3V power
GND          Pin 14 (GND)   Ground
CSN          Pin 5 (CS)     Chip-select (GPIO 5)
SCK          Pin 11 (SCK)   Clock (GPIO 40)
MOSI         Pin 12 (MOSI)  Data out (GPIO 14)
MISO         Pin 10 (MISO)  Data in (GPIO 39)
GDO0         Pin 4 (INT)    Interrupt (GPIO 4)
GDO2         (leave open or wire to a spare GPIO for advanced use)

Hand-solder a 14-pin header to a CC1101 module + a small carrier PCB → custom CC1101-on-EXT module. Drop-in replacement for the Cap LoRa-1262 (electrically). Bruce Settings → SubGHz Pinout → “CC1101 on EXT” maps the driver to these pins.

Capability with CC1101:

433.92 MHz ASK/OOK key-fob replay (~80% of older garage doors, ~90% of cheap weather stations)
868 MHz ASK replay
Spectrum sniffing / RSSI monitoring across 300-928 MHz
Jamming (legal posture in Vol 11 § 7 applies — authorized scope only)
Cannot replay rolling-code (KeeLoq, AES Toyota / Honda fobs) naively; advanced RollJam-class attacks technically possible but FCC §333-violating

6.3 Custom Cap on EXT bus (own daughterboard)

For ambitious builders: design your own 14-pin Cap PCB. M5Stack publishes the mechanical reference in the Cardputer-Adv Structure Files PDF (header position, mating dimensions, available height under the Cap, lead frame).

Process:

Read the Structure Files PDF for the mechanical envelope.
Reference the EXT pinout (Vol 3 § 4) for electrical assignments.
Design in KiCad / EasyEDA / Altium. The PCB must be ~84 × 24 mm to match the Cap LoRa-1262 form factor (or smaller).
Add a 14-pin male 2.54 mm header at the correct position for mating.
Order from JLCPCB / PCBWay / OSHPark for ~$5-15 for a small run.
Hand-assemble or use JLCPCB SMD assembly service.

Community Cap concepts (most not yet shipping):

NRF24 Cap (KeySweeper-style 2.4 GHz keyboard attacks)
RTL-SDR Cap (receive-only SDR)
E-paper Cap (always-on status display)
Battery-booster Cap (stacked LiPo for multi-day deployments)
Solar-harvesting Cap (5V solar + charger controller for outdoor relay)

6.4 USB-C OTG accessories

Connect via USB-C-to-A adapter:

USB keyboards — bigger, faster typing. Comfortable for MicroHydra REPL sessions, long Evil Portal HTML edits, etc.
USB-to-Serial adapters (FTDI / CH340 / CP210x / PL2303) — Cardputer becomes a portable serial console for router/switch/industrial-controller debugging.
USB MIDI controllers — feed audio codec from MIDI keyboard input.
USB mass-storage thumb drives — read/write thumb drive contents. Bruce file manager supports this.
USB HID inspection — BadUSB Hunter (NEMO + M5Launcher) inspects plugged-in HID devices, warns if they’re surreptitious-keyboard-class.

Power budget warning: 5V boost is ~500 mA total. High-current USB peripherals (USB Wi-Fi adapters, large external HDDs) will brownout the device. Use a powered USB-C hub for high-current setups.

What does NOT work:

USB Wi-Fi adapters (no CDC-ECM driver in stock firmware)
USB Ethernet adapters (no driver)
Webcams (no UVC driver)
External GPUs / displays (obviously)

6.5 Bypass Cap LoRa-1262 and feed own SX1262 / SX1276

If you’re not using the official Cap, the entire EXT bus is free. Wire a bare SX1262 or SX1276 LoRa module (~$3 AliExpress) directly to the EXT-bus SPI + CS + RESET + IRQ + BUSY pins per the Cap LoRa-1262 pinout (Vol 5 § 3).

Use cases:

433 MHz LoRa for EU LoRa-APRS — the Cap antenna is tuned 868-923 MHz; for 433 MHz you need a different antenna + matching network. Easier to wire your own SX1262 module + 433 MHz antenna than to re-antenna the Cap.
Custom frequency tuning for research / regulatory experiments.
Higher-power external PA — bare SX1262 + an external power amplifier for >+22 dBm output (legality depends on region; check Vol 11 § 3).

RadioLib library + M5Cardputer drivers work unchanged with correct pin mapping. M5Stack’s official driver functions take pin numbers as parameters; just supply the EXT-bus pins (Vol 3 § 4.1).

7. Module-selection decision tree

                    Need ____?
                       │
        ┌──────────────┼──────────────┐
        │              │              │
   LoRa + GNSS?    Sub-GHz fixed-     5 GHz Wi-Fi?
        │         code (433/868)?         │
        ↓              │              ↓
  Cap LoRa-1262        ↓        M5MonsterC5 (Grove)
                  CC1101 Grove   (or future Cap C5 if M5
                  Unit OR        ships one)
                  CC1101 on EXT
                  (Cap removed)
                       │
        ┌──────────────┼──────────────┐
        │              │              │
     NFC?         Environment?      Cellular?
        │              │              │
        ↓              ↓              ↓
   Unit RFID2    Unit ENV IV    NB-IoT / 4G LTE
   or PN532      (SHT40 + BMP280)  Grove Unit
   Grove I²C
                       │
                    Need MORE
                    than one
                    Unit at once?
                       │
                       ↓
                Use PaHub (I²C mux)
                or split Grove + EXT
                (Cap + Grove)

The Cap LoRa-1262 is the single most-impactful add-on. M5MonsterC5 is the second (5 GHz). Beyond those, Grove Units cover the long tail.

8. Resources

Vendor

M5Stack Grove Units catalog: https://shop.m5stack.com/collections/m5stack-units
Cap LoRa-1262 product page: https://shop.m5stack.com/products/cap-lora1262-with-m5stack-cardputer-adv-edition
Cardputer-Adv Structure Files PDF: https://docs.m5stack.com/
M5MonsterC5 product page: vendor-specific

Community / firmware integrations

Bruce firmware (CC1101 + RFID2 + M5MonsterC5 support): https://github.com/BruceDevices/firmware
PN532 Grove integration: https://github.com/Jojorel/RFID-PN532-i2c-CARDPUTER
Cardputer Wiki module reviews: https://cardputer.wiki/

Forward references

Cap LoRa-1262 + LoRa CSS theory + GNSS detail: Vol 5
Module-specific recipes (Mifare crack, CC1101 replay, thermal camera): Vol 9
Custom Cap design (firmware side): Vol 10

This is Volume 4 of a twelve-volume series. Next: Vol 5 covers the Cap LoRa-1262 in full — SX1262 LoRa radio + AT6668 GNSS + CSS modulation theory + link budget + regional rules.

M5Stack Cardputer ADV Volume 4 — Module Ecosystem

Contents