[ Sub-GHz on the Flipper Zero ]

Sub-GHz is the Flipper Zero talking to the low-power radio world that
runs on the bands below one gigahertz: garage remotes, gate fobs, wireless
doorbells, weather and TPMS sensors, and a pile of cheap 433 MHz gadgets. The
radio behind it is a CC1101, a flexible transceiver that covers
roughly 300–928 MHz.

What it is good for is simple and narrow: reading a signal from a remote,
sensor, or fob you own, saving that capture, and, where the law and the
design allow, transmitting it back. On your own gear it is the clearest way to
see how much of the everyday radio world was never secured at all.

Two ideas carry this whole guide. The first is that you have to be on the right
frequency to hear anything. The second is the difference
between a fixed and a rolling code, which is the reason
an old gate remote replays and your car key does not. Read both, and read the
legal section before you transmit.

Sub-GHz is not one frequency, it is a set of bands, and picking the right one
matters: listen on the wrong frequency and you capture nothing. The common
ones:

  315 MHz     common in North America: car fobs, some garage remotes
  433.92 MHz  the global workhorse: gates, sensors, cheap remotes
  868 MHz     common in Europe: alarms, sensors, some gate motors
  915 MHz     North American ISM band: sensors, industrial gear

Which band a device uses tends to follow the region it was sold in, but the
only reliable answer is to measure. Hold the Flipper close to the remote, open
Sub-GHz > Frequency Analyzer, press the remote's button, and the Flipper
reads back the strongest frequency it hears. Note that number, then switch to
Read on that frequency. Guessing wastes time; the analyzer takes seconds.

The Sub-GHz app gives you two ways to capture, and the difference matters.

  Read      Decodes a known protocol. The Flipper recognises the
            encoding (Princeton, CAME, NICE, Holtek, and many more),
            shows you the button and the decoded value, and saves a
            small, clean file. Try this first: if the protocol is
            known, this is the tidy, portable result.
  Read RAW  Records the raw on and off timings of the signal without
            decoding them. Reach for it when Read shows nothing, when
            the protocol is unknown, or when you want an exact sample
            of an odd signal. The file is larger and less portable,
            but it captures things the decoder cannot name.

Rule of thumb: start with Read, and fall back to Read RAW when the decoder
comes up empty.

This is the most important idea in Sub-GHz, and it is a security lesson rather
than a trick.

Fixed code. An older remote sends the exact same code every time you
press the button. The Flipper can read that code, save it, and transmit it
back, and the receiver cannot tell the copy from the original. Old garage
doors, cheap gates, and simple remotes work this way. On a device you own,
this is the classic read, save, replay demo.

Rolling code. A modern remote sends a different code on every single
press, generated from a shared secret and a counter. KeeLoq and the
schemes in modern cars and garage openers work this way. The Flipper can still
record a press, but by the time you replay it the receiver has already moved
on and that code is dead. It opens nothing. That is the system working exactly
as designed, and it is why you cannot replay your own modern car key.

The read, save, replay flow, and where a rolling code stops it:

       [ remote you own ]
              |
              v  press the button
   +----------------+     +----------------+     +----------------+
   |   1. READ      | --> |   2. SAVE      | --> |   3. REPLAY    |
   | capture signal |     | store on SD in |     | transmit it    |
   | (decoded/RAW)  |     | /subghz /.sub  |     | back out       |
   +----------------+     +----------------+     +----------------+

   fixed code:   same code every press  -> replay works
   rolling code: new code every press   -> captured code is dead

Captures do not live in the app, they live on the microSD card. Every Sub-GHz
file you save lands in the top-level subghz folder as a .sub
file you can copy off the card, back up, and share.

  — Name as you capture. “garage-fixed-433” tells you more in six
    months than “signal_07” ever will. Fold the frequency and the device
    into the name while you still remember them.
  — Back up the card. Copy the whole subghz folder to your computer
    before a big session, so a bad delete costs you nothing.
  — Compare against collections. The FlipperZero_Stuff repo gathers
    community Sub-GHz capture collections, handy for seeing how a known
    protocol should look next to your own capture.

The internal CC1101 is fine for learning and for strong, nearby signals, but
its antenna and sensitivity are modest. The 18-pin GPIO header lets you add an
external CC1101 module for better range and a cleaner capture of weak or
distant signals.

  — Wiring. External-radio boards sit on the Flipper's GPIO header over
    SPI. Pre-built add-on boards exist, so you are not wiring a bare module
    by hand.
  — Firmware. Custom firmware (Momentum, Unleashed, RogueMaster) exposes
    the external CC1101 as a radio choice inside the Sub-GHz app.
  — Worth it? If you only read remotes across a desk, the internal radio
    is enough. If you are chasing weak or distant signals on your own gear,
    an external board is a genuine upgrade.

Reading a signal is passive and generally fine. Transmitting is where the law
lives, so read this before you press send.

  — Owned or authorized only. Read, save, and replay against your own
    remotes and sensors, or ones you have explicit written permission to
    test. Everything else is unauthorized, and the tool does not change that.
  — Transmitting is regulated. Which bands and power levels you may
    transmit on vary by region. Custom firmware can unlock frequencies your
    region forbids; staying inside your local rules is on you.
  — Jamming is illegal. Deliberately drowning out a signal breaks the law
    in the US (FCC rules) and in most other countries. It is not covered
    here, and it is not clever.

None of this is legal advice. The short version: do you own it, or do you have
it in writing.

Why won't my car key replay on the Flipper?
Because it uses a rolling code. Every press sends a new code, so the one you
captured is already dead by the time you transmit it. That is the security
design working, not a broken Flipper. Old fixed-code remotes you own will
replay; modern cars and garage openers will not.

What frequency is my remote on?
Measure it. Open Sub-GHz > Frequency Analyzer, hold the remote close, and
press its button; the Flipper reports the strongest frequency it hears. It is
usually 315 MHz in North America or 433.92 MHz almost everywhere, but reading
it beats guessing.

Should I use Read or Read RAW?
Try Read first. If the protocol is known it decodes cleanly and saves a small
file. If Read shows nothing, or the protocol is unusual, switch to Read RAW to
capture the raw timings instead.

Is an external CC1101 board worth it?
For reading nearby remotes, the internal radio is plenty. For weak or distant
signals on gear you own, an external CC1101 on the GPIO header gives you better
range and sensitivity, and it is worth it.

Is transmitting Sub-GHz legal?
It depends on your region and the band. Reading is passive; transmitting is
regulated, and jamming is illegal in the US and most countries. Operate only on
devices you own or are authorized to test, and stay within your local rules.