How to Hack Sub-GHz Radios with the Flipper Zero: Protocols, Analysis, and Signal Crafting

Introduction

The Sub-GHz radio module in the Flipper Zero is its most capable wireless interface. Operating from 300 MHz to 928 MHz (region-dependent), it can transmit and receive on the same frequencies used by garage door openers, car key fobs, wireless alarm sensors, weather stations, remote-controlled outlets, and industrial telemetry systems. This guide goes far beyond capture-and-replay. You will learn how Sub-GHz protocols work, how to analyze unknown signals, how rolling-code systems defend against replay attacks, and the legitimate testing techniques security professionals use to assess wireless systems.

Legal and Ethical Boundaries

Sub-GHz transmission is regulated by law in every country. The Flipper Zero's frequency range is locked by region firmware:

• US/CA (FCC): 304-348 MHz, 387-464 MHz, 779-928 MHz
• EU (CE): 304-348 MHz, 387-464 MHz, 867-960 MHz (transmission limited to specific bands)
• JP: 312-315 MHz, 426-430 MHz, 920-928 MHz

Legal rules:

• Transmitting on licensed frequencies without authorization is illegal
• Testing your own devices on your own property is legal in most jurisdictions
• Never capture and replay signals for devices you do not own
• Jamming (intentional interference) is illegal everywhere

Sub-GHz Hardware in the Flipper Zero

• CC1101 transceiver: Texas Instruments sub-GHz radio chip, handles modulation, demodulation, and digital baseband processing
• Antenna: Integrated PCB trace antenna tuned for 433 MHz and 868/915 MHz with acceptable performance across the range
• Modulation support: OOK (On-Off Keying), ASK (Amplitude Shift Keying), FSK (Frequency Shift Keying), GFSK (Gaussian FSK), MSK (Minimum Shift Keying)

Step 1: Understand the Frequency Landscape

Before transmitting, know what frequency your target device uses. Common allocations:

• 315 MHz: Car key fobs (North America), wireless doorbells, alarm sensors
• 433.92 MHz: Garage door openers, weather stations, wireless outlets, alarm systems, car remotes (Europe)
• 868.3 MHz: European smart home devices, LoRa, some alarm systems
• 915 MHz: US ISM band, some smart home and industrial devices
• 348 MHz: Some European car manufacturers

Frequency identification:

1. Check the device FCC ID (for US devices). Look it up at fccid.io to find the exact frequency and modulation.
2. Use the Frequency Analyzer app on Flipper: it scans and displays active frequencies in real time.
3. Use an RTL-SDR (if available) with SDR# or CubicSDR to visually identify the transmission frequency.

Step 2: Capture and Analyze Raw Signals

1. Navigate to Sub-GHz > Read on the Flipper.
2. Set the frequency to match your target (or use Hopping Mode to scan multiple frequencies).
3. Press the button on your remote while near the Flipper.
4. The Flipper displays the captured signal with key parameters:

• Frequency: The exact carrier frequency detected
• Modulation: OOK, ASK, or FSK
• Data rate: Bits per second (common: 500-5000 bps)
• Raw hex payload: The captured data bytes

1. Save the capture with a descriptive name including the device and frequency.

Hopping mode:

Set the Flipper to cycle through common frequencies (315, 433.92, 868.3 MHz). It captures any signal it detects. This is useful when you do not know the target frequency.

Step 3: Decode the Protocol

The Flipper Zero supports decoding several common protocols automatically:

• CAME: 12-bit or 24-bit fixed code (common European gates)
• NICE: 12-bit or 24-bit fixed code
• Linear: 10-bit or 24-bit (garage door openers)
• Holtek: HT12E encoder protocol (wireless outlets, alarm sensors)
• Princeton: PT2262 / EV1527 (wireless outlets, PIR sensors)
• KeeLoq: Rolling code (many garage doors and car remotes)

If the protocol is unknown:

1. Capture the signal multiple times (press the button 5-10 times).
2. Compare the hex payloads. If they are identical every time, it is likely a fixed code system.
3. If the payload changes every time with some consistent bits, it is likely a rolling code system.
4. Export the raw captures to your computer via qFlipper for deeper analysis in Universal Radio Hacker (URH).

Step 4: Fixed Code Systems - Analysis and Replay

Fixed code systems transmit the same code every time. They are the easiest to analyze and the most vulnerable.

Capture and replay:

1. Capture the signal on the Flipper.
2. Go to Saved Signals, select the capture.
3. Tap Send. The Flipper transmits the captured code.
4. If the target device responds, it is a simple fixed-code replay.

Manual code entry:

If you know the code (from a DIP switch on the remote or from analysis):

1. Go to Sub-GHz > Add Manually.
2. Select the protocol (CAME, NICE, Holtek, etc.).
3. Enter the code in decimal or hex.
4. Set the frequency and modulation.
5. Save and send.

Brute force attack (protocol-specific):

For 12-bit fixed codes (like CAME 12-bit), only 4096 possible codes exist. The Flipper can brute force the entire space:

1. Sub-GHz > Add Manually > CAME 12-bit
2. Use the CAME Bruteforce app (available in the Flipper App Catalog) to cycle through all codes
3. This takes 15-30 minutes depending on data rate and pauses

Note: Brute forcing is noisy and generates many transmissions. Use only on your own devices and in an RF-quiet location.

Step 5: Rolling Code Systems - How They Work

Rolling code (hopping code) systems are designed to defeat replay attacks. Every button press generates a unique, never-repeating code sequence.

How it works:

1. The remote and receiver share a secret encryption key and a synchronization counter.
2. When you press the button, the remote increments its counter, encrypts it with the key, and transmits the encrypted value plus a serial number.
3. The receiver decrypts the code, checks that the counter is higher than the last valid code, and accepts it.
4. Even if an attacker captures a code, replaying it fails because the counter has already advanced.

KeeLoq is the most common rolling code system:

• Used in millions of garage door openers and car remotes
• 64-bit encryption key
• 16-bit counter
• Previously vulnerable to side-channel attacks but modern implementations have patched these

What the Flipper can do with rolling codes:

1. Capture: The Flipper captures rolling code signals and stores them.
2. Identify: It recognizes KeeLoq and other rolling code protocols.
3. Signal backup: Captured signals can be saved and analyzed but not replayed to open the device (by design).
4. Analysis: Export to URH for protocol inspection.

What the Flipper cannot do:

• Decrypt rolling codes without the secret key
• Bypass the counter mechanism
• Clone a rolling code remote without the manufacturer's programming procedure

Step 6: Advanced Signal Analysis with Universal Radio Hacker

For unknown protocols or detailed analysis, export captures to Universal Radio Hacker (URH) on your PC.

1. Connect Flipper via USB, open qFlipper, navigate to the Sub-GHz saved signals folder.
2. Copy .sub files to your PC.
3. Open URH and import the raw signal files.
4. URH displays the signal waveform and can:

• Decode bit streams automatically
• Identify modulation type with higher accuracy
• Compare multiple captures side by side
• Reverse engineer custom protocols by identifying preamble, sync word, payload, and checksum patterns

Signal anatomy you are looking for:

• Preamble: Alternating 1s and 0s (01010101...) used by the receiver to lock onto the signal
• Sync word: A fixed pattern marking the start of data
• Payload: The data bits (serial number, button code, counter, etc.)
• Checksum/CRC: Error detection bits at the end

Step 7: Generate Custom Sub-GHz Signals

For devices using custom or unknown protocols, you can manually craft signals:

1. Go to Sub-GHz > Read > RAW
2. Capture in raw mode to record the exact timing of every pulse
3. The Flipper stores raw timing data (microsecond pulse durations)
4. Edit the raw file or create a new one with modified timing

Raw signal file format (.sub):

Filetype: Flipper SubGHz RAW File Version: 0 Frequency: 433920000 Preset: FuriHalSubGhzPresetOok650Async Protocol: RAW RAW_Data: 1234 -567 890 -1234 567 ...

Positive numbers = high pulse duration in microseconds. Negative numbers = low pulse duration.

Creating a custom signal:

1. Analyze the timing pattern from a known capture
2. Determine the bit encoding: short pulse = 0, long pulse = 1 (or vice versa)
3. Convert the payload to pulse timing
4. Write a new .sub file with the custom payload
5. Copy to the Flipper's SubGHz folder via qFlipper
6. Play back the signal

Step 8: Use the Frequency Analyzer for Reconnaissance

1. Open Sub-GHz > Frequency Analyzer
2. Place the Flipper near the area of interest
3. The display shows a real-time bar graph of signal strength across the Sub-GHz bands
4. Active frequencies show peaks
5. Note the frequencies where you see activity

Applications:

• Identify what wireless devices operate in your environment
• Find interfering signals that affect your own devices
• Map the RF landscape of a facility for security assessment
• Detect unauthorized wireless devices

Step 9: Extend Range with External Antennas

The Flipper's internal antenna is functional but limited. For serious range:

• 433 MHz tuned antenna: Adds 3-6 dB gain, roughly doubling range
• Yagi directional antenna: 6-12 dB directional gain, 5-10x range in one direction
• Low-noise amplifier (LNA): Boosts received signal strength for weak transmitters
• Power amplifier (check legal limits): Boosts transmit power (may require license)

Antenna connection: The CC1101 chip has solder pads for an external antenna. This requires opening the Flipper and adding a U.FL or SMA connector. This mod voids warranty but dramatically improves performance.

Tips for Sub-GHz Success

• Distance matters: Capture signals as close to the transmitter as possible. The Flipper's receiver is sensitive but weak transmitters fade fast.
• Line of sight: Sub-GHz penetrates walls but attenuates significantly. Position the Flipper with minimal obstructions.
• Battery level affects TX power: A low battery reduces transmit output. Keep the Flipper charged for maximum range.
• Save everything: Name captures descriptively: Garage_433.92_CAME_2026-05-07. The .sub files are tiny.
• Use the App Catalog: Apps like SubGHz Bruteforcer, Weather Station decoder, and TPMS reader extend capabilities.
• Combine with RTL-SDR: Use an RTL-SDR for wideband spectrum analysis, then use the Flipper for targeted capture and replay.
• Know your modulation: OOK is simplest (presence/absence of carrier). FSK requires the correct frequency deviation setting to decode properly.

Conclusion

The Flipper Zero's Sub-GHz radio is a powerful tool for understanding and testing wireless systems. Fixed-code devices can be captured, analyzed, and replayed with ease. Rolling-code systems resist simple replay but can still be analyzed for protocol understanding. With raw signal recording, Universal Radio Hacker analysis, and the ability to craft custom transmissions, the Flipper provides a complete sub-GHz testing platform in your pocket. Use it responsibly, know your legal boundaries, and always test only your own equipment.