Sub-GHz Replay: Fixed Code vs Rolling Code Explained

The Core Difference

This determines whether Flipper's basic "record and replay" actually works against a given remote, and understanding it prevents a lot of confused troubleshooting.

Fixed Code

The remote transmits the exact same bit pattern every single time you press the button. Flipper's Sub-GHz > Read function captures this pattern once, and Saved/Replay sends that identical pattern back — the receiver can't tell the difference between the original remote and Flipper's replay, because there IS no difference. This is how most older garage doors, simple RF outlets, and budget gate remotes work.

Rolling Code (aka Hopping Code)

The remote and receiver share a synchronized counter/algorithm (KeeLoq is the most common implementation). Each button press transmits a code that's cryptographically derived from an incrementing counter — the receiver expects the NEXT valid code in the sequence and rejects anything else, including a replay of a previously-valid code. This is standard on most car key fobs and modern garage door openers (post-mid-2000s, roughly) specifically to prevent basic replay attacks.

Why "Just Record and Replay" Fails on Rolling Code

If you record a rolling-code transmission and replay it later, the receiver has already seen that exact code (or a code with a lower counter value than what it currently expects) and rejects it as invalid/stale. This isn't a Flipper limitation — it's the rolling code system working exactly as designed to prevent this specific attack.

How Flipper Identifies Which Type You're Dealing With

When you use Read on a Sub-GHz signal, Flipper's protocol decoder attempts to match the capture against known protocols. If it identifies a known fixed-code protocol (Princeton, Linear, that sort of thing), it'll show the protocol name and the capture is straightforwardly replayable. If it shows a KeeLoq or similar rolling-code protocol identification, straightforward replay won't work against the original receiver.

What Flipper CAN Do With Rolling Code (Legitimately)

De Bruijn sequence attacks against fixed-code systems that use short enough codes (this is different from rolling code — it's a brute-force optimization for short fixed codes, included in Flipper's "brute force" apps for legacy garage door codes specifically, not for defeating rolling code encryption)
Analysis/learning your own system's behavior for legitimate diagnostic purposes — confirming your own garage door's remote is transmitting correctly, for instance

The Practical Takeaway

If a remote is more than ~15-20 years old or is a cheap/simple accessory (basic RF outlet, older gate control), it's very likely fixed-code and Flipper's basic capture/replay works fine for legitimate personal use (cloning your own remote as a backup). If it's a car key fob or a modern garage door opener, it's almost certainly rolling code, and simple replay against it won't function — this is intentional security design, not something to work around.

Related Guides

Loading_