Reverse-Engineering Unknown RF Protocols with RTL-SDR and Universal Radio Hacker (URH)

A Flipper Zero will capture and replay a fixed-code garage remote in seconds, but the moment you're facing a signal it doesn't recognize — an unusual modulation, a protocol nobody's written a decoder for, or a device you're trying to understand rather than just clone — you need a tool built for actual protocol analysis. Universal Radio Hacker (URH) is a free, open-source application built exactly for that gap: it takes raw IQ samples from an RTL-SDR (or HackRF, LimeSDR, USRP) and walks you through demodulation, bit-level decoding, and protocol reconstruction, all in one interface. This guide covers the workflow from a raw capture to a decoded, resendable protocol.

Why URH Instead of a Flipper Zero for This

The Flipper's Sub-GHz tools are excellent for known protocols and quick capture/replay of fixed and rolling codes, but they're a black box by design — you get a waveform and a replay button, not a bit-level breakdown of preamble, sync word, and payload structure. URH exists specifically to open that box: it shows you the raw signal, lets you experiment with different demodulation schemes (ASK, FSK, PSK) and bit lengths interactively, and exports the decoded protocol as something you can analyze, document, or feed into your own transmitter code. If you already own an RTL-SDR from an ADS-B or SDR getting-started project, you have everything you need hardware-wise to start.

Installing URH

URH runs on Windows, macOS, and Linux, and installs cleanly via pip:

pip install urh

On Linux you'll also need the RTL-SDR drivers (librtlsdr) installed and your user added to the appropriate udev group so URH can access the dongle without root. Launch it with urh from a terminal, or find it in your applications menu after installation.

Capturing a Signal

1. Open URH's Spectrum Analyzer view first and identify the center frequency of your target signal — for North American garage remotes and sensors this is commonly 315 MHz or 390 MHz; for European devices, 433.92 MHz is far more common.
2. Switch to the Record view, set your sample rate (2 MHz is a reasonable default for an RTL-SDR on most sub-GHz remotes), and trigger the transmission you want to capture — press the remote button, trip the sensor, whatever generates the signal.
3. Save the recording, then open it in the Interpretation view, which is where the actual decoding work happens.

Demodulating and Decoding

The Interpretation view shows your raw signal as a waveform. From here:

• Modulation type: URH will often auto-detect ASK (On-Off Keying, common on cheap remotes) versus FSK (frequency shift keying, common on more modern sensors and some rolling-code systems). If auto-detection guesses wrong, the decoded bitstream will look like noise — try the other modulation type before assuming the capture is bad.
• Bit length and sample rate: Adjust the "samples per symbol" slider until the bit grid lines up cleanly with the waveform's transitions. This is the single most important adjustment in the whole workflow; get it wrong and every downstream decode will drift.
• Preamble and sync detection: URH highlights repeating bit patterns across multiple captures of the same button press, which is how you separate a fixed preamble from the actual payload that (on a rolling-code system) changes between transmissions.

Once you have a clean bitstream, switch to the Analysis view, which groups multiple captures of the same signal side by side. Capture the same button press five or six times: bits that stay constant across all captures are almost certainly preamble, address, or command bits; bits that change on every capture in a way that doesn't repeat are your rolling-code counter or cryptographic payload — and that distinction alone tells you whether you're looking at a fixed-code system you could resend later, or a rolling-code system where a raw replay won't work at all.

From Decoded Protocol to Transmission

URH's Generator view lets you take the decoded protocol structure and build new messages with URH itself transmitting them back out through a supported SDR (note: an RTL-SDR is receive-only; transmitting requires a HackRF, LimeSDR, or similar transmit-capable device). This is where the workflow diverges sharply depending on what you found: if the payload bits stayed constant across all your captures, you've got a fixed-code signal you can document and, on hardware you own and have explicit authorization to test, resend. If the payload changed unpredictably every time, you're looking at a rolling-code or encrypted scheme, and URH's value shifts from "help me resend this" to "help me understand and document exactly how this protocol is structured" — genuinely useful for security research and for writing your own compatible devices, not for defeating the rolling-code protection itself.

A Note on Scope and Legality

Capturing and analyzing RF signals with an SDR is legal in the US and most jurisdictions when you're not interfering with licensed spectrum use and you're working with your own devices or devices you have explicit permission to test. Transmitting is a different matter: retransmitting on frequencies and with power levels outside unlicensed ISM band allowances, or transmitting a signal you don't have rights to send (someone else's garage remote, a manufacturer's proprietary protocol on hardware you don't own), can cross into interference or unauthorized-access territory depending on what the signal controls. Treat URH the way you'd treat any protocol analysis tool: fine for understanding your own hardware, fine for documented security research on systems you're authorized to test, and not a shortcut around access controls on things that aren't yours.

Where This Fits Alongside Other SDR and Flipper Tools

URH isn't a replacement for RTL-SDR basics, the Flipper Zero's Sub-GHz tools, or a HackRF for wideband work — it's the missing analysis layer between "I captured a signal" and "I understand this protocol well enough to do something useful with it." Pair it with a frequency analyzer sweep (Flipper's built-in RSSI scanner or URH's own Spectrum Analyzer) to find your target frequency first, then bring the capture into URH for the bit-level work that neither the Flipper's UI nor a bare RTL-SDR waterfall display is built to do.