How to Hack Infrared Protocols with the Flipper Zero: NEC, RC5, Sony, and Raw Analysis

Introduction

The Infrared (IR) module in the Flipper Zero is often underestimated. Unlike Sub-GHz and NFC which get most of the attention, the IR blaster is a powerful tool for analyzing, capturing, and crafting infrared remote control signals. It covers the 38 kHz band used by virtually all consumer electronics remotes and supports major protocols like NEC, RC5, RC6, and Sony SIRC, plus raw signal capture for unknown or proprietary remotes. This guide covers IR protocol internals, complete capture and replay workflows, building universal remotes, brute force attacks, and the analysis techniques that turn IR from a simple remote copier into a protocol debugging tool.

IR Hardware in the Flipper Zero

• Transmitter: High-power IR LED, 940 nm wavelength, 38 kHz carrier modulation
• Receiver: 38 kHz IR photodiode with integrated demodulator (TSOP series equivalent)
• Range: 5-10 meters typical, line of sight required
• Carrier frequency: Fixed at 38 kHz (configurable in raw mode via timing manipulation)
• Supported protocols: NEC, NECext (42-bit), NEC42, Samsung32, RC5, RC6, RC6A, Sony (8/12/15/20-bit), SIRC, Panasonic (Kaseikyo), Sharp, Pioneer, JVC, Bose wave

How IR Remote Protocols Work

IR remotes modulate data onto a 38 kHz carrier. The 38 kHz carrier is not the data — it is a frequency that the IR receiver is tuned to detect. The actual data is encoded in the timing of bursts of 38 kHz light.

Common encoding methods:

• Pulse Distance: A pulse of fixed length, then a variable-length gap. The gap duration encodes 0 or 1. (NEC uses this.)
• Pulse Width: A variable-length pulse, then a fixed gap. The pulse duration encodes 0 or 1. (Sony uses this.)
• Manchester: A transition in the middle of each bit period. High-to-low = 1, low-to-high = 0. (RC5/RC6 use this.)
• Biphase (Manchester variant): Similar to Manchester with different timing. (RC6 uses a variant.)

Step 1: Capture IR Signals

1. Navigate to Infrared > Learn New Remote.
2. Select Read mode.
3. Point the original remote at the front of the Flipper (the IR receiver window is on the front, near the bottom).
4. Press a button on the remote.
5. The Flipper analyzes the signal and displays:

• Protocol detected: NEC, RC5, Sony, Samsung, etc.
• Address: The device address (which device the remote controls)
• Command: The button code (which button was pressed)
• Raw timing data: Microsecond-level pulse and gap durations

1. Save the button with a descriptive name: TV_Samsung_Power.
2. Repeat for each button you want to capture.

Tips for clean captures:

• Point the remote directly at the Flipper, 5-10 cm away
• Avoid fluorescent lights — they emit 38 kHz noise that interferes with IR
• Capture in a dim room for best results
• If capture fails, try Raw mode instead of protocol detection

Step 2: Understand Captured Protocol Details

NEC Protocol (Most Common)

NEC is the most widely used IR protocol in consumer electronics:

• Carrier: 38 kHz
• Bit encoding: Pulse distance
• Pulse: 562.5 us (fixed for every bit)
• Logic 0 gap: 562.5 us (total bit time: 1.125 ms)
• Logic 1 gap: 1687.5 us (total bit time: 2.25 ms)
• Frame structure: 9 ms leading burst, 4.5 ms gap, 8-bit address, 8-bit address inverse, 8-bit command, 8-bit command inverse, 562.5 us trailing pulse
• Repeat code: When a button is held, the full code is sent once, then 9 ms burst + 2.25 ms gap + 562.5 us pulse repeats every 110 ms

When the Flipper reads an NEC signal, it shows:

• Address: the device type (e.g., 0x04 for some Samsung TVs)
• Command: the button function (e.g., 0x08 for power)

Samsung32 Protocol

Samsung's variant of NEC uses a 32-bit frame:

• 8-bit address, 8-bit address inverse, 8-bit command, 8-bit command (NOT inverted — this is the difference from NEC)
• Different timing: 4500 us leading mark, 4500 us space

RC5 Protocol (Philips)

• Carrier: 36 kHz
• Bit encoding: Manchester (biphase)
• Bit time: 1.778 ms (889 us per half-bit)
• Frame: 14 bits (2 start bits + 1 toggle bit + 5 address bits + 6 command bits)
• Start bits: Always 1,1 — identifies the start of the frame
• Toggle bit: Flips between 0 and 1 on each new button press (detects held vs. repeated presses)

RC6 Protocol (Microsoft/Philips)

• Similar to RC5 but with a variable-length leader pulse
• Mode bits (3 bits) indicate command type
• Toggle bit uses a wider pulse for distinction
• Used by Windows Media Center remotes and some Philips devices

Sony SIRC Protocol

• Carrier: 40 kHz
• Bit encoding: Pulse width
• Logic 0: 600 us pulse + 600 us gap
• Logic 1: 1200 us pulse + 600 us gap
• Frame: 2400 us start burst, then 12 data bits (7 command + 5 address)
• Some Sony devices use 15-bit (8 command + 7 address) or 20-bit (7 command + 5 address + 8 extended)

Step 3: Emulate Captured IR Signals

1. Navigate to Infrared > Saved Remotes.
2. Select your saved remote.
3. Select the button to transmit.
4. Point the Flipper at the target device and press OK.

The Flipper transmits the exact signal that was captured. For protocol-based signals, it regenerates the proper timing. For raw captures, it replays the exact microsecond timing.

Universal Remote mode:

1. Infrared > Universal Remote
2. Select a device type (TV, AC, Audio, Projector)
3. The Flipper cycles through common codes for major brands
4. When the target device responds (powers on, changes volume), stop and save the working code set

Step 4: Build a Custom Universal Remote Database

The Flipper stores IR remotes in a structured folder system on the SD card:

/infrared/ TV/ Samsung_32.ir LG_42.ir AC/ Mitsubishi_HEAVY.ir Audio/ Sony_Receiver.ir

Creating a remote file manually:

IR files use a text format:

Filetype: IR signals file Version: 1 # name: Power type: parsed protocol: NEC address: 04 00 00 00 command: 08 00 00 00 # name: Vol+ type: parsed protocol: NEC address: 04 00 00 00 command: 02 00 00 00

Fields explained:

• name: Button label shown on the Flipper screen
• type: parsed (known protocol) or raw (timing data)
• protocol: The protocol name (NEC, RC5, Samsung32, etc.)
• address: Device address in hex (4 bytes, little-endian)
• command: Button command in hex (4 bytes, little-endian)

Raw format for unknown protocols:

name: Custom type: raw frequency: 38000 duty_cycle: 0.33 data: 9000 4500 562 562 562 1687 562 562 ...

The data field contains alternating mark and space durations in microseconds. Positive = IR LED on (mark), negative or implied gap = IR LED off (space).

Step 5: Brute Force IR Attacks

For devices where you do not have the original remote, you can brute force the command space:

NEC brute force:

NEC has 256 possible commands (8 bits) and 256 possible addresses (8 bits). A full brute force is 65,536 combinations — too many to send manually but possible with automation.

1. Use the IR Blaster app from the App Catalog.
2. Set the protocol to NEC, fixed address (or cycle through common addresses).
3. Cycle through all 256 command codes.
4. Monitor the target device for a response (power LED, screen change, relay click).

Common NEC addresses by device type:

• Samsung TVs: 0x07, 0xE0, 0xBD (varies by model series)
• LG TVs: 0x04, 0x31
• Sony TVs: 0x01, 0x11
• Panasonic TVs: 0x02, 0x20
• Generic AC units: Varies widely, often 0xC0-0xCF range

Address sweep attack:

If you know the command (e.g., Power = 0x08 for NEC) but not the address:

1. Send command 0x08 with address 0x00, then 0x01, 0x02... through 0xFF
2. One of them will likely trigger the device
3. This takes about 10 minutes at 5 signals per second

Step 6: IR Signal Analysis for Protocol Debugging

Export raw captures for analysis:

1. Connect the Flipper via qFlipper.
2. Navigate to the SD card > infrared folder.
3. Copy the .ir files to your PC.
4. Open in a text editor to see the timing data.

Analyze timing with Python:

# Parse a raw IR signal and plot it import matplotlib.pyplot as plt data = [9000, -4500, 562, -562, 562, -1687, 562, -562] # From .ir file times = [0] levels = [0] for i, duration in enumerate(data): times.append(times[-1] + abs(duration)) levels.append(1 if duration > 0 else 0) times.append(times[-1]) levels.append(levels[-1]) plt.figure(figsize=(12, 3)) plt.step(times, levels, where='post') plt.xlabel('Time (us)') plt.ylabel('IR LED') plt.title('IR Signal Timing') plt.show()

Identify unknown protocols:

1. Capture the signal in raw mode.
2. Look at the timing pattern:

• Fixed pulse + variable gap = Pulse Distance (likely NEC variant)
• Variable pulse + fixed gap = Pulse Width (likely Sony)
• Middle transitions = Manchester (likely RC5/RC6)

1. Measure the bit time:

• ~1.125 ms total per bit = NEC-like
• ~1.778 ms per bit = RC5
• ~600 us mark + 600/1200 us gap = Sony

1. Look for the leader pulse:

• 9 ms mark + 4.5 ms gap = NEC
• 2.4 ms mark = Sony
• No leader, starts with double-1 = RC5

Step 7: Convert Between IR Protocols

Some devices use non-standard protocols that are variants of standard ones. By editing the .ir file, you can create working signals:

NEC with non-standard timing:

If a device uses NEC-like encoding but with different timing:

1. Capture in raw mode.
2. Examine the timing. If the pulse is 500 us instead of 562.5 us, the device likely still decodes it correctly.
3. Edit the raw timing to match, or try the standard NEC parsed format first.

Extended NEC (NEC42):

Some devices use 16-bit addresses instead of 8-bit:

• The address field is 16 bits (no inverse)
• Command is 8 bits + 8-bit inverse
• Total frame: 42 bits
• Use protocol: NECext or NEC42 in the .ir file

Step 8: Long-Range IR Transmission

The stock Flipper IR LED has limited range. For longer distances:

• External IR LED: Connect a high-power IR LED to the GPIO pins. Drive it with a transistor for more current.
• Multiple LEDs: Wire 2-3 IR LEDs in series with a current-limiting resistor to the GPIO 5V pin.
• IR blaster base station: Build a base with multiple IR LEDs aimed in different directions, controlled by the Flipper's GPIO.

GPIO IR output pin:

The Flipper can output IR signals on GPIO pin A7 (PA7). Use this to drive external IR hardware.

Step 9: Air Conditioner Specific Tricks

AC remotes are more complex than TV remotes because a single button sends the complete state of the unit:

• Power on/off
• Temperature setpoint
• Mode (cool, heat, dry, fan)
• Fan speed
• Swing direction
• Timer settings

This means a 32-byte packet is common for AC units. The Flipper handles these large frames in raw mode.

AC universal remote building:

1. Capture every button on the AC remote in raw mode.
2. Create a .ir file with all buttons organized by function.
3. Name buttons descriptively: Cool_22C_Low, Heat_25C_Auto
4. The Flipper can then fully control the AC without the original remote.

Tips for IR Mastery

• Test in the dark: IR signals reflect off surfaces. Testing in a dark room lets you see the faint purple glow of the IR LED in a phone camera (most phone cameras detect IR).
• Record everything: Every remote in your house, every device at work. Build a personal IR database.
• Learn the protocols: Once you recognize NEC timing by eye, you can identify devices quickly without the Flipper's protocol detection.
• Use a logic analyzer: For deep analysis, connect a 38 kHz IR receiver module to a cheap logic analyzer (Saleae clone, $10). This gives you precise timing data and lets you compare Flipper output to original remote output.
• Combine with Sub-GHz: Many devices (garage door openers, smart outlets) use both IR and Sub-GHz. If the IR power button does not work (some devices disable IR when powered off), the Sub-GHz remote might.
• Check the IRDB: The Flipper IR Database (github.com/UberGuidoZ/Flipper) has thousands of pre-made .ir files for common devices. Download and test before spending time capturing.

Conclusion

The Flipper Zero's infrared module is far more than a TV remote copier. With support for major protocols, raw signal capture, custom .ir file creation, brute force attacks, and protocol analysis, it is a complete IR research tool. Understanding the timing differences between NEC, RC5, Sony, and raw signals lets you build universal remotes, debug unknown protocols, and control virtually any IR device. The 38 kHz carrier, 940 nm wavelength, and microsecond-precise timing make the Flipper's IR output indistinguishable from original remotes. Build your IR database, learn to read timing data by eye, and you will have the most capable universal remote ever made — with the added benefit of understanding exactly how every signal works.