As the LoRa communication technology is widely applied, the security issues of LoRa networks have become crucial. To detect certain non-compliant LoRa private networks and to assess the security performance of enterprise private LoRa protocols, this paper focuses on the problems of reverse engineering of unknown protocols and network topology restoration for LoRa. This paper proposes a method that combines RSSI fingerprint features with a weight-based data packet similarity calculation to differentiate network nodes, extract frequent sequences from different node information, and thereby delineate the frame format of unknown protocols, extract key protocol fields, and analyze the semantics of key fields. Through protocol reverse engineering, it discovers links in private LoRa networks, determines node identities, and restores the network topology structure. This paper improves the success rate of extracting address fields in unknown protocols and effectively identifies the number and behavior of network nodes.