I am dealing with these types of sensors on a professional level so, I thought I could add to your experiments.
As mentioned above these sensors are very sensitive to organic compounds, which get emitted by silicon bases materials.

This can go as far as tainting the sensors completely and rendering them useless. I remember a oversized project to qualify new glues for the whole production, after having to scrap 5k+ sensors because of tainting. They said the sensors where “poisoned”

A standard approach is to get rid of some residual compounds is to heat the sensor to a higher temperature to get rid of these compounds, then lowering the temp. to get a reading.

This is all not low power application but I guess BOSCH is going this approach. The reason why you get different resistive values after you experimented with preheat phase times, seems to me as a typical finding after a longer heating phases, which “cleaned” the sensor.
The reason why you get higher values with longer preheat times is weird though. Maybe they use the known thermal mass of the sensor to estimate the die temperature from the heating time with known power. But this would be a very crude approach, but would explain your results. The longer the preheat phase, the hotter the senor, changing your results.

Normally the antennas are tuned for "no cutout" but also no GND-Fill. The datasheet gives some info: "... It is necessary to ensure that the antenna is exposed, preferably vertically upward"...avoiud traces underneath the module."
With the SMD-modules of the nrf24l01 I tried the 3 options: No pcb, with empty pcb and with traces and gndfill (f*ckup on my part).
Results where: No difference with no PCB or empty PCB, Superbad with traces or GND Fill.
The PCB-trace antennas are much more effected by traces and cables in the vicinity.

Some manufactureres even specify detailed the PCB zones. Check the Bluegiga BLE121LR Datasheet Page 23 for some nice graphs and pictures.
This considerations should also apply to other 2.4ghz antennas (not pcb-antennas). So Maybe a GND PLane with via stiching?

https://www.silabs.com/documents/public/data-sheets/BLE121LR-DataSheet.pdf

@Omemanti Good find about the BMP to recover the Ebyte module. Can you point me to an aliexpress link? "stm32" "bluepill" are not the magic chinese keywords..

@Calvin-Khung Hi Calvin, I read your comments here and on Stackoverflow/exchange. I honestly think that you dont have the right skills to do this. The exploited vulnerability in the blog is quite sofisticated. I think you have to start getting your debugger configured correctly. Your say you have an st-link v2 which lets me to belive you have a cheap chinese clone.
This clone has not all debugging features included, as you might saw in my posts earlier. You are much better of with a Black magic probe or a J-Link.
Have you got a halted NRF51 yet?

@Calvin-Khung Hi Calvin, I read your comments here and on Stackoverflow/exchange. I honestly think that you dont have the right skills to do this. The exploited vulnerability in the blog is quite sofisticated. I think you have to start getting your debugger configured correctly. Your say you have an st-link v2 which lets me to belive you have a cheap chinese clone.
This clone has not all debugging features included, as you might saw in my posts earlier. You are much better of with a Black magic probe or a J-Link.
Have you got a halted NRF51 yet?

Normally the antennas are tuned for "no cutout" but also no GND-Fill. The datasheet gives some info: "... It is necessary to ensure that the antenna is exposed, preferably vertically upward"...avoiud traces underneath the module."
With the SMD-modules of the nrf24l01 I tried the 3 options: No pcb, with empty pcb and with traces and gndfill (f*ckup on my part).
Results where: No difference with no PCB or empty PCB, Superbad with traces or GND Fill.
The PCB-trace antennas are much more effected by traces and cables in the vicinity.

Some manufactureres even specify detailed the PCB zones. Check the Bluegiga BLE121LR Datasheet Page 23 for some nice graphs and pictures.
This considerations should also apply to other 2.4ghz antennas (not pcb-antennas). So Maybe a GND PLane with via stiching?

https://www.silabs.com/documents/public/data-sheets/BLE121LR-DataSheet.pdf

@alowhum where did you get stuck? Whats your process?

@Omemanti Good find about the BMP to recover the Ebyte module. Can you point me to an aliexpress link? "stm32" "bluepill" are not the magic chinese keywords..

@ileneken3
It is a struggle indeed. I wanted to stay "low cost" with clone stlink and clone jlink.
As this is in preparation for a local hackspace workshop the entry level should be as low as possible.
And I suceeded to get this running for under 10€. (only one Jlink needed to unlock the modules once)

I am using platform.io and arduino, which use openocd internally. No need for nrfgo or an second programm and take the hex somewhere else.
Highly recommend platform.io for this! Flashing & Serial output are superfast, nice IDE and my dev-cycle speed up by an order of magnitude.

Question:
I am using an second device for USB-Serial convertion to get some print-msg out of the nrf52832.
Is there any way to do this over the programmer?

You can define the RX/TX pins in the nrf52832 to the pins you want.
Hardware Workaround by Neverdie: Connector Board -openhardware.io

@toyman @Omemanti

For Documentations sake:
I was having the same problems of the Ebyte E73 Module of being locked.
The ST_LinkV2 Clone Firmware are not able to recover the modules as the swd implementation is missing some direct register write capabilities.
The nfrjprog and nor openocd are working with the ST_LinkV2.

As suggested in this thread somewhere, I was able to get the modules unlocked with the Jlink clone and nrfjprog.
see also :
https://github.com/micooke/arduino-nRF5-smartwatches/blob/master/nrf52_disable_read_protection.txt

That (pirated) Firmware is working with swd and is able to recover the modules. Had to solve some dll-issues before, but got it working.
After the recovery with nrfjprog the stlink and the jlink are working as expected with openocd.

To find out if your wiring etc. is fine and it is really the locked devices you get this when starting your openocd interface.
The voltage is fine but the breakpoints are recognized.

Info : STLINK v2 JTAG v17 API v2 SWIM v4 VID 0x0483 PID 0x3748
Info : using stlink api v2
Info : Target voltage: 3.241270
Info : nrf52.cpu: hardware has 0 breakpoints, 2 watchpoints
Error: timed out while waiting for target halted
TARGET: nrf52.cpu - Not halted

It should be

Info : nrf52.cpu: hardware has 6 breakpoints, 4 watchpoints

Hi Neverdie, I am following you progress with the e-byte nrf52832 modules closely. Very nice work!
Following a problem I still have I wanted to ask you how you specify the TX-RX?
I am working with the board libary with platform.io and arduino code. Which internally is using arduino-nrf5 from sandeepmistry.

Did you just change the variant.h?
https://github.com/sandeepmistry/arduino-nRF5/blob/master/variants/Generic/variant.h

Appreciate your help!
Thanks!

I am dealing with these types of sensors on a professional level so, I thought I could add to your experiments.
As mentioned above these sensors are very sensitive to organic compounds, which get emitted by silicon bases materials.

This can go as far as tainting the sensors completely and rendering them useless. I remember a oversized project to qualify new glues for the whole production, after having to scrap 5k+ sensors because of tainting. They said the sensors where “poisoned”

A standard approach is to get rid of some residual compounds is to heat the sensor to a higher temperature to get rid of these compounds, then lowering the temp. to get a reading.

This is all not low power application but I guess BOSCH is going this approach. The reason why you get different resistive values after you experimented with preheat phase times, seems to me as a typical finding after a longer heating phases, which “cleaned” the sensor.
The reason why you get higher values with longer preheat times is weird though. Maybe they use the known thermal mass of the sensor to estimate the die temperature from the heating time with known power. But this would be a very crude approach, but would explain your results. The longer the preheat phase, the hotter the senor, changing your results.

that is a nice edge connector. Where did you find them? I have a hard time finding a cheap source..

Did you have any concerns about the reception? My first test with components on the other side of the nrf-smd module where not that good.
Yours works as did mine but how is the "reception"? Do you get a lot of failed acks?