diff --git a/builder/family/beken-72xx.py b/builder/family/beken-72xx.py
index 1976cb0..fba38f7 100644
--- a/builder/family/beken-72xx.py
+++ b/builder/family/beken-72xx.py
@@ -333,12 +333,10 @@ queue.AddLibrary(
     base_dir=join(FUNC_DIR, "mbedtls"),
     srcs=[
         "+<mbedtls/library/*.c>",
-        "+<mbedtls_ui/*.c>",
         "+<mbedtls-port/src/*.c>",
     ],
     includes=[
         "+<mbedtls/include>",
-        "+<mbedtls_ui>",
         "+<mbedtls-port/inc>",
     ],
     options=dict(
diff --git a/builder/frameworks/base.py b/builder/frameworks/base.py
index 7423ae3..2a32870 100644
--- a/builder/frameworks/base.py
+++ b/builder/frameworks/base.py
@@ -14,6 +14,10 @@ board: PlatformBoardConfig = env.BoardConfig()
 platform: PlatformBase = env.PioPlatform()
 family: Family = env["FAMILY_OBJ"]
 
+# TODO remove include path prepending ("!<...>")
+# Move common core sources (env.AddCoreSources()) and Arduino libs
+# below per-family sources (to maintain child families taking precedence)
+
 # Include SDK builder scripts
 # No environment options that follow later will be considered
 found = False
diff --git a/builder/utils/cores.py b/builder/utils/cores.py
index d16c924..0c04d18 100644
--- a/builder/utils/cores.py
+++ b/builder/utils/cores.py
@@ -75,7 +75,13 @@ def env_add_arduino_libraries(env: Environment, queue, name: str, path: str) ->
             "+<**/*.c*>",
         ],
         includes=[
-            "!<*/*>" if name.startswith("common") else "!<*>",
+            "!<*/.>",
+            "!<*/*>",
+        ]
+        if name.startswith("common")
+        else [
+            "!<.>",
+            "!<*>",
         ],
     )
     return True
diff --git a/cores/beken-72xx/arduino/libraries/LT/LT.cpp b/cores/beken-72xx/arduino/libraries/LT/LT.cpp
index a9ff92a..706d043 100644
--- a/cores/beken-72xx/arduino/libraries/LT/LT.cpp
+++ b/cores/beken-72xx/arduino/libraries/LT/LT.cpp
@@ -1,9 +1,10 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-19. */
 
-#include <LibreTuyaAPI.h>
-#include <libraries/Flash/Flash.h>
+#include <LT.h>
 
 // can't include <flash.h> as it collides with <Flash.h> on Windows -_-
+#include <Flash/Flash.h>
+
 #define REG_FLASH_BASE		 0x00803000
 #define REG_FLASH_OPERATE_SW (REG_FLASH_BASE + 0 * 4)
 #define REG_FLASH_RDID		 (REG_FLASH_BASE + 4 * 4)
@@ -15,6 +16,8 @@
 
 extern "C" {
 
+#include <include.h>
+
 #include <flash_pub.h>
 #include <param_config.h>
 #include <start_type_pub.h>
diff --git a/cores/beken-72xx/arduino/libraries/Serial/SerialClass.cpp b/cores/beken-72xx/arduino/libraries/Serial/Serial.cpp
similarity index 98%
rename from cores/beken-72xx/arduino/libraries/Serial/SerialClass.cpp
rename to cores/beken-72xx/arduino/libraries/Serial/Serial.cpp
index 843ad94..6e90c20 100644
--- a/cores/beken-72xx/arduino/libraries/Serial/SerialClass.cpp
+++ b/cores/beken-72xx/arduino/libraries/Serial/Serial.cpp
@@ -1,6 +1,8 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-23. */
 
-#include "SerialClass.h"
+#include "Serial.h"
+
+#include <Arduino.h>
 
 extern "C" {
 
diff --git a/cores/beken-72xx/arduino/libraries/Serial/SerialClass.h b/cores/beken-72xx/arduino/libraries/Serial/Serial.h
similarity index 92%
rename from cores/beken-72xx/arduino/libraries/Serial/SerialClass.h
rename to cores/beken-72xx/arduino/libraries/Serial/Serial.h
index 19ef39c..5c77c4d 100644
--- a/cores/beken-72xx/arduino/libraries/Serial/SerialClass.h
+++ b/cores/beken-72xx/arduino/libraries/Serial/Serial.h
@@ -2,7 +2,7 @@
 
 #pragma once
 
-#include <Arduino.h>
+#include <api/ArduinoAPI.h>
 #include <api/HardwareSerial.h>
 #include <api/RingBuffer.h>
 
@@ -34,5 +34,3 @@ class SerialClass : public HardwareSerial {
 
 	using Print::write;
 };
-
-#define HAS_SERIAL_CLASS 1
diff --git a/cores/beken-72xx/arduino/libraries/WiFi/WiFi.cpp b/cores/beken-72xx/arduino/libraries/WiFi/WiFi.cpp
index 6091204..5770868 100644
--- a/cores/beken-72xx/arduino/libraries/WiFi/WiFi.cpp
+++ b/cores/beken-72xx/arduino/libraries/WiFi/WiFi.cpp
@@ -1,6 +1,6 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-26. */
 
-#include "WiFiPriv.h"
+#include "WiFiPrivate.h"
 
 WiFiClass::WiFiClass() {
 	memset(&data, 0x00, sizeof(WiFiData));
@@ -15,8 +15,8 @@ void WiFiClass::dataInitialize() {
 	if (data.statusIp)
 		return;
 	LT_DM(WIFI, "Data init");
-	data.configSta	   = zalloc(sizeof(network_InitTypeDef_st));
-	data.configAp	   = zalloc(sizeof(network_InitTypeDef_ap_st));
+	data.configSta	   = calloc(1, sizeof(network_InitTypeDef_st));
+	data.configAp	   = calloc(1, sizeof(network_InitTypeDef_ap_st));
 	data.statusIp	   = malloc(sizeof(IPStatusTypedef));
 	data.statusLink	   = malloc(sizeof(LinkStatusTypeDef));
 	STA_CFG->dhcp_mode = DHCP_CLIENT;
diff --git a/cores/beken-72xx/arduino/libraries/WiFi/WiFiAP.cpp b/cores/beken-72xx/arduino/libraries/WiFi/WiFiAP.cpp
index c1111f7..119f58d 100644
--- a/cores/beken-72xx/arduino/libraries/WiFi/WiFiAP.cpp
+++ b/cores/beken-72xx/arduino/libraries/WiFi/WiFiAP.cpp
@@ -1,6 +1,6 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-07-01. */
 
-#include "WiFiPriv.h"
+#include "WiFiPrivate.h"
 
 bool WiFiClass::softAP(const char *ssid, const char *passphrase, int channel, bool ssidHidden, int maxClients) {
 	if (!enableAP(true))
diff --git a/cores/beken-72xx/arduino/libraries/WiFi/WiFiData.h b/cores/beken-72xx/arduino/libraries/WiFi/WiFiData.h
index b572acb..88dbe0c 100644
--- a/cores/beken-72xx/arduino/libraries/WiFi/WiFiData.h
+++ b/cores/beken-72xx/arduino/libraries/WiFi/WiFiData.h
@@ -5,11 +5,14 @@
 #include <Arduino.h>
 
 extern "C" {
-
+#define _ARCH_H_
+#define _GENERIC_H_
 #include <FreeRTOS.h>
+#include <include.h>
 #include <rw_msg_pub.h>
 #include <semphr.h>
-
+#undef _ARCH_H_
+#undef _GENERIC_H_
 } // extern "C"
 
 typedef struct {
@@ -19,7 +22,7 @@ typedef struct {
 	SemaphoreHandle_t scanSem;
 	void *statusIp;
 	void *statusLink;
-	rw_evt_type lastStaEvent;
-	rw_evt_type lastApEvent;
+	uint32_t lastStaEvent; // TODO revert this type back to rw_evt_type
+	uint32_t lastApEvent;
 	bool apEnabled;
 } WiFiData;
diff --git a/cores/beken-72xx/arduino/libraries/WiFi/WiFiEvents.cpp b/cores/beken-72xx/arduino/libraries/WiFi/WiFiEvents.cpp
index 5836c1e..41e563f 100644
--- a/cores/beken-72xx/arduino/libraries/WiFi/WiFiEvents.cpp
+++ b/cores/beken-72xx/arduino/libraries/WiFi/WiFiEvents.cpp
@@ -1,6 +1,6 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-07-10. */
 
-#include "WiFiPriv.h"
+#include "WiFiPrivate.h"
 
 #include <vector>
 
diff --git a/cores/beken-72xx/arduino/libraries/WiFi/WiFiGeneric.cpp b/cores/beken-72xx/arduino/libraries/WiFi/WiFiGeneric.cpp
index 20ec5e3..e070e4c 100644
--- a/cores/beken-72xx/arduino/libraries/WiFi/WiFiGeneric.cpp
+++ b/cores/beken-72xx/arduino/libraries/WiFi/WiFiGeneric.cpp
@@ -1,6 +1,6 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-26. */
 
-#include "WiFiPriv.h"
+#include "WiFiPrivate.h"
 
 bool WiFiClass::modePriv(WiFiMode mode, WiFiModeAction sta, WiFiModeAction ap) {
 	__wrap_bk_printf_disable();
@@ -73,7 +73,8 @@ WiFiMode WiFiClass::getMode() {
 }
 
 WiFiStatus WiFiClass::status() {
-	rw_evt_type status = data.lastStaEvent;
+	// TODO remove the cast
+	rw_evt_type status = (rw_evt_type)data.lastStaEvent;
 	if (status == RW_EVT_STA_CONNECTED && STA_CFG->dhcp_mode == DHCP_DISABLE)
 		status = RW_EVT_STA_GOT_IP;
 	return eventTypeToStatus(status);
diff --git a/cores/beken-72xx/arduino/libraries/WiFi/WiFiPrivate.h b/cores/beken-72xx/arduino/libraries/WiFi/WiFiPrivate.h
index 0b9a5d2..afd86f4 100644
--- a/cores/beken-72xx/arduino/libraries/WiFi/WiFiPrivate.h
+++ b/cores/beken-72xx/arduino/libraries/WiFi/WiFiPrivate.h
@@ -2,7 +2,8 @@
 
 #pragma once
 
-#include <api/WiFi/WiFi.h>
+#include <WiFi.h>
+#include <sdk_private.h>
 
 extern "C" {
 
diff --git a/cores/beken-72xx/arduino/libraries/WiFi/WiFiSTA.cpp b/cores/beken-72xx/arduino/libraries/WiFi/WiFiSTA.cpp
index 9200a1f..f9f3adf 100644
--- a/cores/beken-72xx/arduino/libraries/WiFi/WiFiSTA.cpp
+++ b/cores/beken-72xx/arduino/libraries/WiFi/WiFiSTA.cpp
@@ -1,6 +1,6 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-27. */
 
-#include "WiFiPriv.h"
+#include "WiFiPrivate.h"
 
 WiFiStatus
 WiFiClass::begin(const char *ssid, const char *passphrase, int32_t channel, const uint8_t *bssid, bool connect) {
diff --git a/cores/beken-72xx/arduino/libraries/WiFi/WiFiScan.cpp b/cores/beken-72xx/arduino/libraries/WiFi/WiFiScan.cpp
index 1ac5619..be808a4 100644
--- a/cores/beken-72xx/arduino/libraries/WiFi/WiFiScan.cpp
+++ b/cores/beken-72xx/arduino/libraries/WiFi/WiFiScan.cpp
@@ -1,6 +1,6 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-27. */
 
-#include "WiFiPriv.h"
+#include "WiFiPrivate.h"
 
 static void scanHandler(void *ctx, uint8_t param) {
 	LT_HEAP_I();
diff --git a/cores/beken-72xx/arduino/src/ArduinoFamily.h b/cores/beken-72xx/arduino/src/ArduinoFamily.h
index 118d1b4..88c4184 100644
--- a/cores/beken-72xx/arduino/src/ArduinoFamily.h
+++ b/cores/beken-72xx/arduino/src/ArduinoFamily.h
@@ -2,20 +2,5 @@
 
 #pragma once
 
-#ifdef __cplusplus
-#include "WCharacterFixup.h"
-#endif
-
-#define delay delayMilliseconds // change delay()'s signature - it's defined as static inline in WVariant.h
-#include <api/ArduinoAPI.h>
-#include <core/LibreTuyaAPI.h>
-#undef delay
-
-// Include family-specific code
-#include "WVariant.h"
-
-// Define available serial ports
-#ifdef __cplusplus
-#include "SerialClass.h"
-#include <core/SerialExtern.h>
-#endif
+// Provide GPIO names to variant.cpp files
+#define LT_VARIANT_INCLUDE "gpio_pub.h"
diff --git a/cores/beken-72xx/arduino/src/MD5Impl.h b/cores/beken-72xx/arduino/src/MD5Impl.h
deleted file mode 100644
index 11d2134..0000000
--- a/cores/beken-72xx/arduino/src/MD5Impl.h
+++ /dev/null
@@ -1,5 +0,0 @@
-/* Copyright (c) Kuba Szczodrzyński 2022-07-11. */
-
-#pragma once
-
-#define LT_MD5_USE_HOSTAPD 1
diff --git a/cores/beken-72xx/arduino/src/WVariant.h b/cores/beken-72xx/arduino/src/WVariant.h
deleted file mode 100644
index cbe3777..0000000
--- a/cores/beken-72xx/arduino/src/WVariant.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/* Copyright (c) Kuba Szczodrzyński 2022-06-18. */
-
-#pragma once
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#include "sdk_extern.h"
-#include "sdk_mem.h"
-
-// define an inline delay() which overrides BDK's delay()
-static inline __attribute__((always_inline)) void delay(unsigned long ms) {
-	delayMilliseconds(ms);
-}
-
-// from fixups/arch_main.c
-extern unsigned char __bk_rf_is_init;
-
-#ifdef __cplusplus
-} // extern "C"
-#endif
diff --git a/cores/beken-72xx/arduino/src/lt_defs.h b/cores/beken-72xx/arduino/src/lt_defs.h
index 28cb3fa..6250f1c 100644
--- a/cores/beken-72xx/arduino/src/lt_defs.h
+++ b/cores/beken-72xx/arduino/src/lt_defs.h
@@ -3,5 +3,6 @@
 #error "Don't include this file directly"
 
 #define LT_ARD_HAS_WIFI	  1
-#define LT_ARD_HAS_MD5	  1
 #define LT_ARD_HAS_SERIAL 1
+
+#define LT_ARD_MD5_HOSTAPD 1
diff --git a/cores/beken-72xx/arduino/src/main.cpp b/cores/beken-72xx/arduino/src/main.cpp
index f4b2be3..baf3ff7 100644
--- a/cores/beken-72xx/arduino/src/main.cpp
+++ b/cores/beken-72xx/arduino/src/main.cpp
@@ -7,20 +7,14 @@ extern "C" {
 #include <rtos_pub.h>
 #include <sys_rtos.h>
 
-extern int uart_print_port;
-
-} // extern "C"
-
 beken_thread_t mainThread;
 
-void initArduino() {
-	// set default UART output port
-	uart_print_port = LT_UART_DEFAULT_PORT - 1;
 #if LT_AUTO_DOWNLOAD_REBOOT && defined(PIN_SERIAL1_RX) && defined(PIN_SERIAL1_TX)
+void lt_init_arduino() {
 	// initialize auto-download-reboot parser
 	Serial1.begin(115200);
-#endif
 }
+#endif
 
 bool startMainTask() {
 	OSStatus ret = rtos_create_thread(
@@ -36,3 +30,5 @@ bool startMainTask() {
 	vTaskStartScheduler();
 	return true;
 }
+
+} // extern "C"
diff --git a/cores/beken-72xx/arduino/src/wiring.c b/cores/beken-72xx/arduino/src/wiring.c
index 2e1ee54..a1f5d48 100644
--- a/cores/beken-72xx/arduino/src/wiring.c
+++ b/cores/beken-72xx/arduino/src/wiring.c
@@ -1,6 +1,8 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-19. */
 
 #include <Arduino.h>
+#include <include.h>
+
 #include <arm_arch.h>
 #include <bk_timer.h>
 #include <bk_timer_pub.h>
diff --git a/cores/beken-72xx/arduino/src/wiring_analog.c b/cores/beken-72xx/arduino/src/wiring_analog.c
index be67415..71971df 100644
--- a/cores/beken-72xx/arduino/src/wiring_analog.c
+++ b/cores/beken-72xx/arduino/src/wiring_analog.c
@@ -1,6 +1,8 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-20. */
 
 #include <Arduino.h>
+
+#include <gpio_pub.h>
 #include <pwm_pub.h>
 #include <saradc_pub.h>
 
diff --git a/cores/beken-72xx/arduino/src/wiring_digital.c b/cores/beken-72xx/arduino/src/wiring_digital.c
index 6ebce50..27f0016 100644
--- a/cores/beken-72xx/arduino/src/wiring_digital.c
+++ b/cores/beken-72xx/arduino/src/wiring_digital.c
@@ -2,6 +2,8 @@
 
 #include <Arduino.h>
 
+#include <gpio_pub.h>
+
 void pinMode(pin_size_t pinNumber, PinMode pinMode) {
 	PinInfo *pin = pinInfo(pinNumber);
 	if (!pin)
diff --git a/cores/beken-72xx/arduino/src/wiring_irq.c b/cores/beken-72xx/arduino/src/wiring_irq.c
index cc20170..7455da1 100644
--- a/cores/beken-72xx/arduino/src/wiring_irq.c
+++ b/cores/beken-72xx/arduino/src/wiring_irq.c
@@ -2,6 +2,8 @@
 
 #include <Arduino.h>
 
+#include <gpio_pub.h>
+
 static void *irqHandlerList[PINS_COUNT] = {NULL};
 static void *irqHandlerArgs[PINS_COUNT] = {NULL};
 static bool irqChangeList[PINS_COUNT];
diff --git a/cores/beken-72xx/base/config/lwipopts.h b/cores/beken-72xx/base/config/lwipopts.h
index c60d282..13eaa4d 100644
--- a/cores/beken-72xx/base/config/lwipopts.h
+++ b/cores/beken-72xx/base/config/lwipopts.h
@@ -2,9 +2,7 @@
 
 #pragma once
 
-#include "lwip-2.0.2/port/lwipopts.h"
-
-#include <sys/time.h>
+#include_next "lwipopts.h"
 
 // mDNS support
 #undef MEMP_NUM_UDP_PCB
diff --git a/cores/beken-72xx/base/fixups/generic.h b/cores/beken-72xx/base/fixups/generic.h
new file mode 100644
index 0000000..d812710
--- /dev/null
+++ b/cores/beken-72xx/base/fixups/generic.h
@@ -0,0 +1,11 @@
+/* Copyright (c) Kuba Szczodrzyński 2023-03-01. */
+
+#include_next "generic.h"
+
+#pragma once
+
+// allow lwIP to define these (Beken, why)
+#undef htons
+#undef ntohs
+#undef htonl
+#undef ntohl
diff --git a/cores/beken-72xx/base/lt_family_api.c b/cores/beken-72xx/base/lt_family_api.c
index 45deff9..2eff384 100644
--- a/cores/beken-72xx/base/lt_family_api.c
+++ b/cores/beken-72xx/base/lt_family_api.c
@@ -4,6 +4,13 @@
 
 #include <start_type_pub.h>
 
+extern int uart_print_port;
+
+void lt_init_family() {
+	// set default UART output port
+	uart_print_port = LT_UART_DEFAULT_PORT - 1;
+}
+
 ResetReason lt_get_reset_reason() {
 	switch (bk_misc_get_start_type()) {
 		case RESET_SOURCE_POWERON:
diff --git a/cores/beken-72xx/base/sdk_private.h b/cores/beken-72xx/base/sdk_private.h
index 193a980..cfe3247 100644
--- a/cores/beken-72xx/base/sdk_private.h
+++ b/cores/beken-72xx/base/sdk_private.h
@@ -2,6 +2,10 @@
 
 #pragma once
 
+#ifdef __cplusplus
+extern "C" {
+#endif // __cplusplus
+
 // most stuff is here
 #include <include.h>
 // other includes
@@ -22,3 +26,10 @@
 #define os_printf	printf
 #define warning_prf printf
 #define fatal_prf	printf
+
+// from fixups/arch_main.c
+extern unsigned char __bk_rf_is_init;
+
+#ifdef __cplusplus
+} // extern "C"
+#endif
diff --git a/cores/common/arduino/libraries/api/LT/LT.cpp b/cores/common/arduino/libraries/api/LT/LT.cpp
index a17a8fc..022093b 100644
--- a/cores/common/arduino/libraries/api/LT/LT.cpp
+++ b/cores/common/arduino/libraries/api/LT/LT.cpp
@@ -1,6 +1,6 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-06. */
 
-#include "LibreTuyaClass.h"
+#include "LT.h"
 
 /**
  * @brief Get LibreTuya version string.
diff --git a/cores/common/arduino/libraries/api/LT/LT.h b/cores/common/arduino/libraries/api/LT/LT.h
index cb0ab3b..045ab3c 100644
--- a/cores/common/arduino/libraries/api/LT/LT.h
+++ b/cores/common/arduino/libraries/api/LT/LT.h
@@ -2,10 +2,9 @@
 
 #pragma once
 
-#ifdef __cplusplus
+#include <Arduino.h>
 
-#include "LibreTuyaAPI.h"
-#include <core/ChipType.h>
+#ifdef __cplusplus
 
 /**
  * @brief Flash chip ID structure.
diff --git a/cores/common/arduino/libraries/api/WiFi/WiFi.h b/cores/common/arduino/libraries/api/WiFi/WiFi.h
index cd1b8e5..bd29349 100644
--- a/cores/common/arduino/libraries/api/WiFi/WiFi.h
+++ b/cores/common/arduino/libraries/api/WiFi/WiFi.h
@@ -22,7 +22,7 @@
 #pragma once
 
 #include <Arduino.h>
-#include <api/Events.h>
+#include <Events.h>
 #include <api/IPAddress.h>
 #include <api/IPv6Address.h>
 #include <vector>
@@ -34,6 +34,11 @@
 #include <WiFiData.h>
 #endif
 
+#include <WiFiClient.h>
+#include <WiFiClientSecure.h>
+#include <WiFiServer.h>
+#include <WiFiUdp.h>
+
 class WiFiClass {
   public:
 #ifdef LT_ARD_HAS_WIFI
diff --git a/cores/common/arduino/libraries/api/WiFi/WiFiScan.cpp b/cores/common/arduino/libraries/api/WiFi/WiFiScan.cpp
index aabf052..6cd2952 100644
--- a/cores/common/arduino/libraries/api/WiFi/WiFiScan.cpp
+++ b/cores/common/arduino/libraries/api/WiFi/WiFiScan.cpp
@@ -24,7 +24,7 @@ int16_t WiFiClass::scanComplete() {
 void WiFiClass::scanInit() {
 	if (scan)
 		return;
-	scan = (WiFiScanData *)zalloc(sizeof(WiFiScanData));
+	scan = (WiFiScanData *)calloc(1, sizeof(WiFiScanData));
 }
 
 void WiFiClass::scanDelete() {
diff --git a/cores/common/arduino/libraries/common/MD5/MD5.h b/cores/common/arduino/libraries/common/MD5/MD5.h
index 88e484e..2971867 100644
--- a/cores/common/arduino/libraries/common/MD5/MD5.h
+++ b/cores/common/arduino/libraries/common/MD5/MD5.h
@@ -3,23 +3,22 @@
 #pragma once
 
 #include <Arduino.h>
-#include <MD5Impl.h>
 
 // available built-in implementations
-#if LT_MD5_USE_POLARSSL
+#if LT_ARD_MD5_POLARSSL
 #include "MD5PolarSSLImpl.h"
 #endif
-#if LT_MD5_USE_MBEDTLS
+#if LT_ARD_MD5_MBEDTLS
 #include "MD5MbedTLSImpl.h"
 #endif
-#if LT_MD5_USE_HOSTAPD
+#if LT_ARD_MD5_HOSTAPD
 #include "MD5HostapdImpl.h"
 #endif
 
 // common API
 #ifdef __cplusplus
 extern "C" {
-#endif
+#endif // __cplusplus
 
 #ifndef LT_MD5_CTX_T
 #define LT_MD5_CTX_T void
@@ -33,5 +32,5 @@ void MD5Update(LT_MD5_CTX_T *context, const unsigned char *buf, unsigned len);
 void MD5Final(unsigned char digest[16], LT_MD5_CTX_T *context);
 
 #ifdef __cplusplus
-}
+} // extern "C"
 #endif
diff --git a/cores/common/arduino/libraries/common/MD5/MD5HostapdImpl.h b/cores/common/arduino/libraries/common/MD5/MD5HostapdImpl.h
index 76624da..d187482 100644
--- a/cores/common/arduino/libraries/common/MD5/MD5HostapdImpl.h
+++ b/cores/common/arduino/libraries/common/MD5/MD5HostapdImpl.h
@@ -6,6 +6,11 @@
 extern "C" {
 #endif
 
+#include <stdint.h>
+
+typedef uint32_t u32;
+typedef uint8_t u8;
+
 #include <crypto/md5_i.h>
 #define LT_MD5_CTX_T struct MD5Context
 
diff --git a/cores/common/arduino/libraries/common/MD5/MD5MbedTLSImpl.cpp b/cores/common/arduino/libraries/common/MD5/MD5MbedTLSImpl.cpp
index 2db16c0..56744c5 100644
--- a/cores/common/arduino/libraries/common/MD5/MD5MbedTLSImpl.cpp
+++ b/cores/common/arduino/libraries/common/MD5/MD5MbedTLSImpl.cpp
@@ -1,11 +1,9 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-07-11. */
 
-#if LT_ARD_HAS_MD5
+#if LT_ARD_MD5_MBEDTLS
 
 #include "MD5.h"
 
-#if LT_MD5_USE_MBEDTLS
-
 extern "C" {
 
 void MD5Init(LT_MD5_CTX_T *context) {
@@ -23,6 +21,4 @@ void MD5Final(unsigned char digest[16], LT_MD5_CTX_T *context) {
 
 } // extern "C"
 
-#endif // LT_MD5_USE_MBEDTLS
-
-#endif // LT_ARD_HAS_MD5
+#endif // LT_ARD_MD5_MBEDTLS
diff --git a/cores/common/arduino/libraries/common/MD5/MD5PolarSSLImpl.cpp b/cores/common/arduino/libraries/common/MD5/MD5PolarSSLImpl.cpp
index b7265d5..d6642df 100644
--- a/cores/common/arduino/libraries/common/MD5/MD5PolarSSLImpl.cpp
+++ b/cores/common/arduino/libraries/common/MD5/MD5PolarSSLImpl.cpp
@@ -1,11 +1,9 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-06-03. */
 
-#if LT_ARD_HAS_MD5
+#if LT_ARD_MD5_POLARSSL
 
 #include "MD5.h"
 
-#if LT_MD5_USE_POLARSSL
-
 extern "C" {
 
 void MD5Init(LT_MD5_CTX_T *context) {
@@ -23,6 +21,4 @@ void MD5Final(unsigned char digest[16], LT_MD5_CTX_T *context) {
 
 } // extern "C"
 
-#endif // LT_MD5_USE_POLARSSL
-
-#endif // LT_ARD_HAS_MD5
+#endif // LT_ARD_MD5_POLARSSL
diff --git a/cores/common/arduino/libraries/common/WiFiClient/LwIPClient.cpp b/cores/common/arduino/libraries/common/WiFiClient/LwIPClient.cpp
index a6ee121..d4b5101 100644
--- a/cores/common/arduino/libraries/common/WiFiClient/LwIPClient.cpp
+++ b/cores/common/arduino/libraries/common/WiFiClient/LwIPClient.cpp
@@ -4,6 +4,8 @@
 
 #include "LwIPClient.h"
 
+#include <WiFi.h>
+
 #define MAX_SOCK_NUM				4
 #define WIFI_CLIENT_CONNECT_TIMEOUT 3000
 #define WIFI_CLIENT_READ_TIMEOUT	3000
diff --git a/cores/common/arduino/libraries/common/WiFiClient/LwIPClient.h b/cores/common/arduino/libraries/common/WiFiClient/LwIPClient.h
index 0cbd125..9593fc9 100644
--- a/cores/common/arduino/libraries/common/WiFiClient/LwIPClient.h
+++ b/cores/common/arduino/libraries/common/WiFiClient/LwIPClient.h
@@ -2,9 +2,11 @@
 
 #pragma once
 
-#include <api/WiFi/WiFi.h>
-#include <api/WiFiClient.h>
-#include <lwip/LwIPRxBuffer.h>
+#if LT_ARD_HAS_WIFI && LT_HAS_LWIP
+
+#include "WiFiClient.h"
+
+#include "LwIPRxBuffer.h"
 #include <memory>
 
 class SocketHandle;
@@ -54,3 +56,7 @@ class LwIPClient : public IWiFiClient {
 
 	using Print::write;
 };
+
+typedef LwIPClient WiFiClient;
+
+#endif
diff --git a/cores/common/arduino/libraries/common/WiFiClient/MbedTLSClient.cpp b/cores/common/arduino/libraries/common/WiFiClient/MbedTLSClient.cpp
index 8f91310..ecc67c4 100644
--- a/cores/common/arduino/libraries/common/WiFiClient/MbedTLSClient.cpp
+++ b/cores/common/arduino/libraries/common/WiFiClient/MbedTLSClient.cpp
@@ -4,15 +4,21 @@
 
 #include "MbedTLSClient.h"
 
+#include <WiFi.h>
+
 extern "C" {
 
 #include <mbedtls/debug.h>
+#include <mbedtls/net.h>
+#include <mbedtls/pk.h>
 #include <mbedtls/platform.h>
 #include <mbedtls/sha256.h>
 #include <mbedtls/ssl.h>
 
 } // extern "C"
 
+#define _clientKeyC ((mbedtls_pk_context *)_clientKey)
+
 MbedTLSClient::MbedTLSClient() : WiFiClient() {
 	init(); // ensure the context is zero filled
 }
@@ -27,25 +33,42 @@ MbedTLSClient::~MbedTLSClient() {
 }
 
 void MbedTLSClient::stop() {
+	if (!_sslCtx)
+		return;
 	LT_VM(SSL, "Stopping SSL");
 
-	if (_sslCfg.ca_chain) {
-		mbedtls_x509_crt_free(&_caCert);
+	if (_sslCfg->ca_chain) {
+		mbedtls_x509_crt_free(_caCert);
 	}
-	if (_sslCfg.key_cert) {
-		mbedtls_x509_crt_free(&_clientCert);
-		mbedtls_pk_free(&_clientKey);
+	if (_sslCfg->key_cert) {
+		mbedtls_x509_crt_free(_clientCert);
+		mbedtls_pk_free(_clientKeyC);
 	}
-	mbedtls_ssl_free(&_sslCtx);
-	mbedtls_ssl_config_free(&_sslCfg);
+	mbedtls_ssl_free(_sslCtx);
+	mbedtls_ssl_config_free(_sslCfg);
+
+	free(_sslCtx);
+	free(_sslCfg);
+	free(_caCert);
+	free(_clientCert);
+	free(_clientKey);
+	_sslCtx = NULL;
+
 	LT_HEAP_I();
 }
 
 void MbedTLSClient::init() {
+	if (!_sslCtx) {
+		_sslCtx		= (mbedtls_ssl_context *)malloc(sizeof(mbedtls_ssl_context));
+		_sslCfg		= (mbedtls_ssl_config *)malloc(sizeof(mbedtls_ssl_config));
+		_caCert		= (mbedtls_x509_crt *)malloc(sizeof(mbedtls_x509_crt));
+		_clientCert = (mbedtls_x509_crt *)malloc(sizeof(mbedtls_x509_crt));
+		_clientKey	= (mbedtls_pk_context *)malloc(sizeof(mbedtls_pk_context));
+	}
 	// Realtek AmbZ: init platform here to ensure HW crypto is initialized in ssl_init
 	mbedtls_platform_set_calloc_free(calloc, free);
-	mbedtls_ssl_init(&_sslCtx);
-	mbedtls_ssl_config_init(&_sslCfg);
+	mbedtls_ssl_init(_sslCtx);
+	mbedtls_ssl_config_init(_sslCfg);
 }
 
 int MbedTLSClient::connect(IPAddress ip, uint16_t port, int32_t timeout) {
@@ -129,7 +152,7 @@ int MbedTLSClient::connect(
 	// mbedtls_ssl_conf_dbg(&_sslCfg, debug_cb, NULL);
 
 	ret = mbedtls_ssl_config_defaults(
-		&_sslCfg,
+		_sslCfg,
 		MBEDTLS_SSL_IS_CLIENT,
 		MBEDTLS_SSL_TRANSPORT_STREAM,
 		MBEDTLS_SSL_PRESET_DEFAULT
@@ -144,14 +167,14 @@ int MbedTLSClient::connect(
 #endif
 
 	if (_insecure) {
-		mbedtls_ssl_conf_authmode(&_sslCfg, MBEDTLS_SSL_VERIFY_NONE);
+		mbedtls_ssl_conf_authmode(_sslCfg, MBEDTLS_SSL_VERIFY_NONE);
 	} else if (rootCABuf) {
-		mbedtls_x509_crt_init(&_caCert);
-		mbedtls_ssl_conf_authmode(&_sslCfg, MBEDTLS_SSL_VERIFY_REQUIRED);
-		ret = mbedtls_x509_crt_parse(&_caCert, (const unsigned char *)rootCABuf, strlen(rootCABuf) + 1);
-		mbedtls_ssl_conf_ca_chain(&_sslCfg, &_caCert, NULL);
+		mbedtls_x509_crt_init(_caCert);
+		mbedtls_ssl_conf_authmode(_sslCfg, MBEDTLS_SSL_VERIFY_REQUIRED);
+		ret = mbedtls_x509_crt_parse(_caCert, (const unsigned char *)rootCABuf, strlen(rootCABuf) + 1);
+		mbedtls_ssl_conf_ca_chain(_sslCfg, _caCert, NULL);
 		if (ret < 0) {
-			mbedtls_x509_crt_free(&_caCert);
+			mbedtls_x509_crt_free(_caCert);
 			LT_RET(ret);
 		}
 	} else if (_useRootCA) {
@@ -173,7 +196,7 @@ int MbedTLSClient::connect(
 				return -1;
 			pskBin[i / 2] |= c << (4 * ((i & 1) ^ 1));
 		}
-		ret = mbedtls_ssl_conf_psk(&_sslCfg, pskBin, len / 2, (const unsigned char *)pskIdent, strlen(pskIdent));
+		ret = mbedtls_ssl_conf_psk(_sslCfg, pskBin, len / 2, (const unsigned char *)pskIdent, strlen(pskIdent));
 		LT_RET_NZ(ret);
 #else
 		return -1;
@@ -183,33 +206,33 @@ int MbedTLSClient::connect(
 	}
 
 	if (!_insecure && clientCert && clientKey) {
-		mbedtls_x509_crt_init(&_clientCert);
-		mbedtls_pk_init(&_clientKey);
+		mbedtls_x509_crt_init(_clientCert);
+		mbedtls_pk_init(_clientKeyC);
 		LT_VM(SSL, "Loading client cert");
-		ret = mbedtls_x509_crt_parse(&_clientCert, (const unsigned char *)clientCert, strlen(clientCert) + 1);
+		ret = mbedtls_x509_crt_parse(_clientCert, (const unsigned char *)clientCert, strlen(clientCert) + 1);
 		if (ret < 0) {
-			mbedtls_x509_crt_free(&_clientCert);
+			mbedtls_x509_crt_free(_clientCert);
 			LT_RET(ret);
 		}
 		LT_VM(SSL, "Loading private key");
-		ret = mbedtls_pk_parse_key(&_clientKey, (const unsigned char *)clientKey, strlen(clientKey) + 1, NULL, 0);
+		ret = mbedtls_pk_parse_key(_clientKeyC, (const unsigned char *)clientKey, strlen(clientKey) + 1, NULL, 0);
 		if (ret < 0) {
-			mbedtls_x509_crt_free(&_clientCert);
+			mbedtls_x509_crt_free(_clientCert);
 			LT_RET(ret);
 		}
-		mbedtls_ssl_conf_own_cert(&_sslCfg, &_clientCert, &_clientKey);
+		mbedtls_ssl_conf_own_cert(_sslCfg, _clientCert, _clientKeyC);
 	}
 
 	LT_VM(SSL, "Setting TLS hostname");
-	ret = mbedtls_ssl_set_hostname(&_sslCtx, host);
+	ret = mbedtls_ssl_set_hostname(_sslCtx, host);
 	LT_RET_NZ(ret);
 
-	mbedtls_ssl_conf_rng(&_sslCfg, ssl_random, NULL);
-	ret = mbedtls_ssl_setup(&_sslCtx, &_sslCfg);
+	mbedtls_ssl_conf_rng(_sslCfg, ssl_random, NULL);
+	ret = mbedtls_ssl_setup(_sslCtx, _sslCfg);
 	LT_RET_NZ(ret);
 
 	_sockTls = fd();
-	mbedtls_ssl_set_bio(&_sslCtx, &_sockTls, mbedtls_net_send, mbedtls_net_recv, NULL);
+	mbedtls_ssl_set_bio(_sslCtx, &_sockTls, mbedtls_net_send, mbedtls_net_recv, NULL);
 	mbedtls_net_set_nonblock((mbedtls_net_context *)&_sockTls);
 
 	LT_HEAP_I();
@@ -218,7 +241,7 @@ int MbedTLSClient::connect(
 	if (_handshakeTimeout == 0)
 		_handshakeTimeout = timeout;
 	unsigned long start = millis();
-	while (ret = mbedtls_ssl_handshake(&_sslCtx)) {
+	while (ret = mbedtls_ssl_handshake(_sslCtx)) {
 		if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
 			LT_RET(ret);
 		}
@@ -235,10 +258,10 @@ int MbedTLSClient::connect(
 		LT_DM(
 			SSL,
 			"Protocol %s, ciphersuite %s",
-			mbedtls_ssl_get_version(&_sslCtx),
-			mbedtls_ssl_get_ciphersuite(&_sslCtx)
+			mbedtls_ssl_get_version(_sslCtx),
+			mbedtls_ssl_get_ciphersuite(_sslCtx)
 		);
-		ret = mbedtls_ssl_get_record_expansion(&_sslCtx);
+		ret = mbedtls_ssl_get_record_expansion(_sslCtx);
 		if (ret >= 0)
 			LT_DM(SSL, "Record expansion: %d", ret);
 		else {
@@ -247,7 +270,7 @@ int MbedTLSClient::connect(
 	}
 
 	LT_VM(SSL, "Verifying certificate");
-	ret = mbedtls_ssl_get_verify_result(&_sslCtx);
+	ret = mbedtls_ssl_get_verify_result(_sslCtx);
 	if (ret) {
 		char buf[512];
 		memset(buf, 0, sizeof(buf));
@@ -257,17 +280,17 @@ int MbedTLSClient::connect(
 	}
 
 	if (rootCABuf)
-		mbedtls_x509_crt_free(&_caCert);
+		mbedtls_x509_crt_free(_caCert);
 	if (clientCert)
-		mbedtls_x509_crt_free(&_clientCert);
+		mbedtls_x509_crt_free(_clientCert);
 	if (clientKey != NULL)
-		mbedtls_pk_free(&_clientKey);
+		mbedtls_pk_free(_clientKeyC);
 	return 0; // OK
 }
 
 size_t MbedTLSClient::write(const uint8_t *buf, size_t size) {
 	int ret = -1;
-	while ((ret = mbedtls_ssl_write(&_sslCtx, buf, size)) <= 0) {
+	while ((ret = mbedtls_ssl_write(_sslCtx, buf, size)) <= 0) {
 		if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE && ret < 0) {
 			LT_RET(ret);
 		}
@@ -281,12 +304,12 @@ int MbedTLSClient::available() {
 	if (!connected())
 		return peeked;
 
-	int ret = mbedtls_ssl_read(&_sslCtx, NULL, 0);
+	int ret = mbedtls_ssl_read(_sslCtx, NULL, 0);
 	if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE && ret < 0) {
 		stop();
 		return peeked ? peeked : ret;
 	}
-	return mbedtls_ssl_get_bytes_avail(&_sslCtx) + peeked;
+	return mbedtls_ssl_get_bytes_avail(_sslCtx) + peeked;
 }
 
 int MbedTLSClient::read(uint8_t *buf, size_t size) {
@@ -307,7 +330,7 @@ int MbedTLSClient::read(uint8_t *buf, size_t size) {
 		peeked = true;
 	}
 
-	int ret = mbedtls_ssl_read(&_sslCtx, buf, size);
+	int ret = mbedtls_ssl_read(_sslCtx, buf, size);
 	if (ret < 0) {
 		stop();
 		return peeked ? peeked : ret;
@@ -337,6 +360,9 @@ void MbedTLSClient::setInsecure() {
 	_insecure	   = true;
 }
 
+// TODO only allocate _caCert, _clientCert and _clientKey when one
+// of the following functions is used
+
 void MbedTLSClient::setPreSharedKey(const char *pskIdent, const char *psk) {
 	_pskIdentStr = pskIdent;
 	_pskStr		 = psk;
@@ -437,7 +463,7 @@ void MbedTLSClient::setAlpnProtocols(const char **alpnProtocols) {
 }
 
 bool MbedTLSClient::getFingerprintSHA256(uint8_t result[32]) {
-	const mbedtls_x509_crt *cert = mbedtls_ssl_get_peer_cert(&_sslCtx);
+	const mbedtls_x509_crt *cert = mbedtls_ssl_get_peer_cert(_sslCtx);
 	if (!cert) {
 		LT_EM(SSL, "Failed to get peer certificate");
 		return false;
diff --git a/cores/common/arduino/libraries/common/WiFiClient/MbedTLSClient.h b/cores/common/arduino/libraries/common/WiFiClient/MbedTLSClient.h
index 5b0c629..6f7a263 100644
--- a/cores/common/arduino/libraries/common/WiFiClient/MbedTLSClient.h
+++ b/cores/common/arduino/libraries/common/WiFiClient/MbedTLSClient.h
@@ -2,25 +2,21 @@
 
 #pragma once
 
-#include <api/WiFi/WiFi.h>
-#include <api/WiFiClient.h>
-#include <api/WiFiClientSecure.h>
+#if LT_ARD_HAS_WIFI && LT_HAS_MBEDTLS
 
-#include <WiFiClient.h> // extend family's WiFiClient impl
+#include "WiFiClientSecure.h"
 
-extern "C" {
-
-#include <mbedtls/net.h>
-
-} // extern "C"
+struct mbedtls_ssl_context;
+struct mbedtls_ssl_config;
+struct mbedtls_x509_crt;
 
 class MbedTLSClient : public WiFiClient, public IWiFiClientSecure {
   private:
-	mbedtls_ssl_context _sslCtx;
-	mbedtls_ssl_config _sslCfg;
-	mbedtls_x509_crt _caCert;
-	mbedtls_x509_crt _clientCert;
-	mbedtls_pk_context _clientKey;
+	mbedtls_ssl_context *_sslCtx = NULL;
+	mbedtls_ssl_config *_sslCfg;
+	mbedtls_x509_crt *_caCert;
+	mbedtls_x509_crt *_clientCert;
+	void *_clientKey;
 	uint32_t _handshakeTimeout = 0;
 
 	void init();
@@ -86,3 +82,7 @@ class MbedTLSClient : public WiFiClient, public IWiFiClientSecure {
 	using WiFiClient::connect;
 	using WiFiClient::read;
 };
+
+typedef MbedTLSClient WiFiClientSecure;
+
+#endif
diff --git a/cores/common/arduino/libraries/common/WiFiClient/WiFiClient.h b/cores/common/arduino/libraries/common/WiFiClient/WiFiClient.h
index 8a60dea..e0650b8 100644
--- a/cores/common/arduino/libraries/common/WiFiClient/WiFiClient.h
+++ b/cores/common/arduino/libraries/common/WiFiClient/WiFiClient.h
@@ -72,3 +72,7 @@ class IWiFiClient : public Client {
 
 	using Print::write;
 };
+
+#if LT_ARD_HAS_WIFI && LT_HAS_LWIP
+#include "LwIPClient.h"
+#endif
diff --git a/cores/common/arduino/libraries/common/WiFiClient/WiFiClientSecure.h b/cores/common/arduino/libraries/common/WiFiClient/WiFiClientSecure.h
index 2391d77..296a416 100644
--- a/cores/common/arduino/libraries/common/WiFiClient/WiFiClientSecure.h
+++ b/cores/common/arduino/libraries/common/WiFiClient/WiFiClientSecure.h
@@ -47,3 +47,7 @@ class IWiFiClientSecure {
 	virtual void setAlpnProtocols(const char **alpnProtocols)			 = 0;
 	virtual bool getFingerprintSHA256(uint8_t result[32])				 = 0;
 };
+
+#if LT_ARD_HAS_WIFI && LT_HAS_MBEDTLS
+#include "MbedTLSClient.h"
+#endif
diff --git a/cores/common/arduino/libraries/common/WiFiServer/LwIPServer.h b/cores/common/arduino/libraries/common/WiFiServer/LwIPServer.h
index 5e63571..d1787ff 100644
--- a/cores/common/arduino/libraries/common/WiFiServer/LwIPServer.h
+++ b/cores/common/arduino/libraries/common/WiFiServer/LwIPServer.h
@@ -2,10 +2,9 @@
 
 #pragma once
 
-#include <api/WiFi/WiFi.h>
-#include <api/WiFiServer.h>
+#if LT_ARD_HAS_WIFI && LT_HAS_LWIP
 
-#include <WiFiClient.h>
+#include "WiFiServer.h"
 
 class LwIPServer : public IWiFiServer<WiFiClient> {
   private:
@@ -45,3 +44,7 @@ class LwIPServer : public IWiFiServer<WiFiClient> {
 	bool getNoDelay();
 	bool hasClient();
 };
+
+typedef LwIPServer WiFiServer;
+
+#endif
diff --git a/cores/common/arduino/libraries/common/WiFiServer/WiFiServer.h b/cores/common/arduino/libraries/common/WiFiServer/WiFiServer.h
index 4dde9d5..0b8dbc1 100644
--- a/cores/common/arduino/libraries/common/WiFiServer/WiFiServer.h
+++ b/cores/common/arduino/libraries/common/WiFiServer/WiFiServer.h
@@ -70,3 +70,7 @@ class IWiFiServer : public Print { // arduino::Server is useless anyway
 
 	using Print::write;
 };
+
+#if LT_ARD_HAS_WIFI && LT_HAS_LWIP
+#include "LwIPServer.h"
+#endif
diff --git a/cores/common/arduino/libraries/common/WiFiUdp/LwIPUdp.cpp b/cores/common/arduino/libraries/common/WiFiUdp/LwIPUdp.cpp
index 575e0e1..6e2dede 100644
--- a/cores/common/arduino/libraries/common/WiFiUdp/LwIPUdp.cpp
+++ b/cores/common/arduino/libraries/common/WiFiUdp/LwIPUdp.cpp
@@ -17,7 +17,6 @@
 #if LT_ARD_HAS_WIFI && LT_HAS_LWIP
 
 #include "LwIPUdp.h"
-#include <errno.h>
 
 extern "C" {
 
diff --git a/cores/common/arduino/libraries/common/WiFiUdp/LwIPUdp.h b/cores/common/arduino/libraries/common/WiFiUdp/LwIPUdp.h
index 687afe0..b60f18d 100644
--- a/cores/common/arduino/libraries/common/WiFiUdp/LwIPUdp.h
+++ b/cores/common/arduino/libraries/common/WiFiUdp/LwIPUdp.h
@@ -2,8 +2,10 @@
 
 #pragma once
 
-#include <api/WiFi/WiFi.h>
-#include <api/WiFiUdp.h>
+#if LT_ARD_HAS_WIFI && LT_HAS_LWIP
+
+#include "WiFiUdp.h"
+
 #include <cbuf.h>
 
 class LwIPUDP : public IWiFiUDP {
@@ -41,3 +43,7 @@ class LwIPUDP : public IWiFiUDP {
 	IPAddress remoteIP();
 	uint16_t remotePort();
 };
+
+typedef LwIPUDP WiFiUDP;
+
+#endif
diff --git a/cores/common/arduino/libraries/common/WiFiUdp/WiFiUdp.h b/cores/common/arduino/libraries/common/WiFiUdp/WiFiUdp.h
index 84d9aef..28e0180 100644
--- a/cores/common/arduino/libraries/common/WiFiUdp/WiFiUdp.h
+++ b/cores/common/arduino/libraries/common/WiFiUdp/WiFiUdp.h
@@ -30,3 +30,7 @@ class IWiFiUDP : public UDP {
 	virtual IPAddress remoteIP()								= 0;
 	virtual uint16_t remotePort()								= 0;
 };
+
+#if LT_ARD_HAS_WIFI && LT_HAS_LWIP
+#include "LwIPUdp.h"
+#endif
diff --git a/cores/common/arduino/libraries/ext/HTTPClient/HTTPClient.cpp b/cores/common/arduino/libraries/ext/HTTPClient/HTTPClient.cpp
index 6fd8f24..c99ea3c 100644
--- a/cores/common/arduino/libraries/ext/HTTPClient/HTTPClient.cpp
+++ b/cores/common/arduino/libraries/ext/HTTPClient/HTTPClient.cpp
@@ -42,10 +42,6 @@
 /// Cookie jar support
 #include <time.h>
 
-extern "C" {
-#include "strptime.h"
-}
-
 #ifdef HTTPCLIENT_1_1_COMPATIBLE
 class TransportTraits {
   public:
diff --git a/cores/common/arduino/src/Arduino.h b/cores/common/arduino/src/Arduino.h
index f276e1d..285d593 100644
--- a/cores/common/arduino/src/Arduino.h
+++ b/cores/common/arduino/src/Arduino.h
@@ -25,19 +25,14 @@ using std::min;
 
 // Include family-specific code
 #include <ArduinoFamily.h>
-// Include board variant
-#include "variant.h"
 
-/**
- * @brief Run mainTask & start OS kernel (family-defined).
- * Return false if an error occured; else do not return and
- * and keep the OS kernel running.
- */
-extern int startMainTask(void);
+// Additional Wiring headers
+#include "wiring_compat.h"
+#include "wiring_custom.h"
 
 // Define available serial ports
 #if defined(__cplusplus) && LT_ARD_HAS_SERIAL
-#include <SerialClass.h>
+#include <Serial.h>
 
 #if HAS_SERIAL0
 extern SerialClass Serial0;
diff --git a/cores/common/arduino/src/Events.h b/cores/common/arduino/src/Events.h
index dc128e4..0966039 100644
--- a/cores/common/arduino/src/Events.h
+++ b/cores/common/arduino/src/Events.h
@@ -23,7 +23,7 @@
 #pragma once
 
 #include <Arduino.h>
-#include <api/WiFi/WiFiEvents.h>
+#include <WiFiEvents.h>
 #include <functional>
 
 typedef enum {
diff --git a/cores/common/arduino/src/HardwareI2C.h b/cores/common/arduino/src/HardwareI2C.h
index eded4cf..9c0479d 100644
--- a/cores/common/arduino/src/HardwareI2C.h
+++ b/cores/common/arduino/src/HardwareI2C.h
@@ -2,7 +2,7 @@
 
 #include <api/Stream.h>
 
-class ITwoWire : public Stream {
+class HardwareI2C : public Stream {
   protected:
 	int8_t _sda	   = -1;
 	int8_t _scl	   = -1;
diff --git a/cores/common/arduino/src/main.c b/cores/common/arduino/src/main.c
index ae8d831..80f72eb 100644
--- a/cores/common/arduino/src/main.c
+++ b/cores/common/arduino/src/main.c
@@ -2,19 +2,9 @@
 
 #include <Arduino.h>
 
-// Arduino framework initialization.
-// May be redefined by family files.
-void initArduino() __attribute__((weak));
-
-// Weak empty variant initialization function.
-// May be redefined by variant files.
-void initVariant() __attribute__((weak));
-
 int main() {
 	// initialize Arduino framework
-	initArduino();
-	// optionally initialize per-variant code
-	initVariant();
+	lt_init_arduino();
 	// start the main task and OS kernel
 	if (!startMainTask()) {
 		LT_F("Couldn't start the main task");
@@ -32,8 +22,6 @@ void mainTask(const void *arg) {
 
 	for (;;) {
 		loop();
-		if (serialEventRun)
-			serialEventRun();
 		yield();
 	}
 }
diff --git a/cores/common/arduino/src/wiring_compat.h b/cores/common/arduino/src/wiring_compat.h
index b49470c..6d4197c 100644
--- a/cores/common/arduino/src/wiring_compat.h
+++ b/cores/common/arduino/src/wiring_compat.h
@@ -4,9 +4,16 @@
 
 #include <Arduino.h>
 
+#ifdef __cplusplus
+extern "C" {
+#endif // __cplusplus
+
 #if LT_HAS_FREERTOS
+// dirty hack to avoid including BDK's arch.h (from FreeRTOS/portable.h)
+#define _ARCH_H_
 #include <FreeRTOS.h>
 #include <task.h>
+#undef _ARCH_H_
 #endif
 
 // Definitions for error constants.
@@ -44,3 +51,7 @@ BaseType_t xTaskCreateUniversal(
 #ifdef __cplusplus
 String ipToString(const IPAddress &ip);
 #endif
+
+#ifdef __cplusplus
+} // extern "C"
+#endif
diff --git a/cores/common/arduino/src/wiring_custom.h b/cores/common/arduino/src/wiring_custom.h
index 3acca1b..8cf1a17 100644
--- a/cores/common/arduino/src/wiring_custom.h
+++ b/cores/common/arduino/src/wiring_custom.h
@@ -44,6 +44,13 @@ extern PinInfo pinTable[];
 
 // Custom Wiring methods
 
+/**
+ * @brief Run mainTask & start OS kernel (family-defined).
+ * Return false if an error occured; else do not return and
+ * and keep the OS kernel running.
+ */
+bool startMainTask(void);
+
 void mainTask(const void *arg); // implemented in main.cpp
 void runPeriodicTasks();		// implemented in wiring_custom.c
 
diff --git a/cores/common/base/config/lwipopts.h b/cores/common/base/config/lwipopts.h
index 6bd6a5c..9e5c6fe 100644
--- a/cores/common/base/config/lwipopts.h
+++ b/cores/common/base/config/lwipopts.h
@@ -1,5 +1,7 @@
 /* Copyright (c) Kuba Szczodrzyński 2022-08-26. */
 
+#pragma once
+
 #define LWIP_TIMEVAL_PRIVATE 0
 #define LWIP_NETIF_HOSTNAME	 1 // to support hostname changing
 #define LWIP_SO_RCVBUF		 1 // for ioctl(FIONREAD)
@@ -9,6 +11,8 @@
 
 #include_next "lwipopts.h"
 
+#include <sys/time.h>
+
 // set lwIP debugging options according to LT config
 #if LT_DEBUG_LWIP
 #undef LWIP_DEBUG
@@ -64,24 +68,24 @@
 #undef IP6_DEBUG
 #undef MDNS_DEBUG
 
+#undef LWIP_DONT_PROVIDE_BYTEORDER_FUNCTIONS
 
 /** Set this to 1 to support DNS names (or IP address strings) to set sntp servers
  * One server address/name can be defined as default if SNTP_SERVER_DNS == 1:
  * \#define SNTP_SERVER_ADDRESS "pool.ntp.org"
  */
-#define SNTP_SERVER_DNS            1
+#define SNTP_SERVER_DNS 1
 
-#define SNTP_SET_SYSTEM_TIME_US(sec, us)  \
-    do { \
-        struct timeval tv = { .tv_sec = sec, .tv_usec = us }; \
-        settimeofday(&tv, NULL); \
-    } while (0);
-
-#define SNTP_GET_SYSTEM_TIME(sec, us) \
-    do { \
-        struct timeval tv = { .tv_sec = 0, .tv_usec = 0 }; \
-        gettimeofday(&tv, NULL); \
-        (sec) = tv.tv_sec;  \
-        (us) = tv.tv_usec; \
-    } while (0);
+#define SNTP_SET_SYSTEM_TIME_US(sec, us)                                                                               \
+	do {                                                                                                               \
+		struct timeval tv = {.tv_sec = sec, .tv_usec = us};                                                            \
+		settimeofday(&tv, NULL);                                                                                       \
+	} while (0);
 
+#define SNTP_GET_SYSTEM_TIME(sec, us)                                                                                  \
+	do {                                                                                                               \
+		struct timeval tv = {.tv_sec = 0, .tv_usec = 0};                                                               \
+		gettimeofday(&tv, NULL);                                                                                       \
+		(sec) = tv.tv_sec;                                                                                             \
+		(us)  = tv.tv_usec;                                                                                            \
+	} while (0);
diff --git a/cores/common/base/libretuya.h b/cores/common/base/libretuya.h
index 369b03d..b72eae8 100644
--- a/cores/common/base/libretuya.h
+++ b/cores/common/base/libretuya.h
@@ -3,7 +3,9 @@
 #pragma once
 
 // C standard libraries
+#include <errno.h>
 #include <inttypes.h>
+#include <math.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stddef.h>
@@ -35,7 +37,7 @@
 
 // Types & macros
 #include "lt_chip.h"   // ChipType enum
-#include "lt_config.h" // configuration macros
+#include "lt_config.h" // platform configuration options
 #include "lt_types.h"  // other types & enums
 // Family-specific macros
 #include <lt_family.h>
diff --git a/cores/common/base/lt_family_api.h b/cores/common/base/lt_family_api.h
index a2fd48b..4611ddb 100644
--- a/cores/common/base/lt_family_api.h
+++ b/cores/common/base/lt_family_api.h
@@ -8,6 +8,27 @@
 extern "C" {
 #endif // __cplusplus
 
+/**
+ * @brief Initialize the family core (optional).
+ * This method is family-specific; the family core can do whatever it wants to.
+ * This method is empty if not implemented, and shouldn't be called manually.
+ */
+void lt_init_family() __attribute__((weak));
+
+/**
+ * @brief Initialize the board (variant).
+ * This method is empty if not implemented (which is usually the case),
+ * and shouldn't be called manually.
+ */
+void lt_init_variant() __attribute__((weak));
+
+/**
+ * @brief Initialize the family's Arduino core (optional).
+ * This method is family-specific; the family core can do whatever it wants to.
+ * This method is empty if not implemented, and shouldn't be called manually.
+ */
+void lt_init_arduino() __attribute__((weak));
+
 /**
  * @brief Get the reason of last chip reset.
  */
diff --git a/cores/common/base/lt_main.c b/cores/common/base/lt_main.c
index 7f1d566..df8ce0b 100644
--- a/cores/common/base/lt_main.c
+++ b/cores/common/base/lt_main.c
@@ -12,6 +12,9 @@ void __libc_init_array(void);
 int main(void);
 
 int lt_main(void) {
+	// early initialize the family and variant
+	lt_init_family();
+	lt_init_variant();
 	// print a startup banner
 	LT_BANNER();
 	// initialize C library
diff --git a/cores/realtek-amb/arduino/libraries/Serial/SerialClass.h b/cores/realtek-amb/arduino/libraries/Serial/SerialClass.h
index e159f04..6118580 100644
--- a/cores/realtek-amb/arduino/libraries/Serial/SerialClass.h
+++ b/cores/realtek-amb/arduino/libraries/Serial/SerialClass.h
@@ -42,5 +42,3 @@ class SerialClass : public HardwareSerial {
 
 	using Print::write;
 };
-
-#define HAS_SERIAL_CLASS 1
diff --git a/cores/realtek-amb/arduino/src/lt_defs.h b/cores/realtek-amb/arduino/src/lt_defs.h
index 969894e..a1d88b4 100644
--- a/cores/realtek-amb/arduino/src/lt_defs.h
+++ b/cores/realtek-amb/arduino/src/lt_defs.h
@@ -3,7 +3,6 @@
 #error "Don't include this file directly"
 
 #define LT_ARD_HAS_WIFI		  1
-#define LT_ARD_HAS_MD5		  1
 #define LT_ARD_HAS_SOFTSERIAL 1
 #define LT_ARD_HAS_SERIAL	  1
 
diff --git a/docs/reference/config.md b/docs/reference/config.md
index af5f7ef..be30ec0 100644
--- a/docs/reference/config.md
+++ b/docs/reference/config.md
@@ -113,7 +113,6 @@ The meaning of most flags is as follows:
 - `LT_HAS_LWIP2` - LwIP v2.0.0 or newer
 - `LT_HAS_FREERTOS` - FreeRTOS supported and used
 - `LT_HAS_MBEDTLS` - mbedTLS in SDK
-- `LT_ARD_HAS_MD5` - MD5 library implemented, `MD5Impl.h` available
 - `LT_ARD_HAS_WIFI` - WiFi library implemented, `WiFiData.h` available
 - `LT_ARD_HAS_SOFTSERIAL` - SoftwareSerial library implemented, `SoftwareSerial.h` available
 - `LT_HEAP_FUNC` - function name used to get available heap size (for `LT_HEAP_I()`)