04 · 16 min
Sub-GHz radio
ISM bands, ASK/OOK versus FSK, static codes versus rolling codes, and how to listen without turning the Flipper into a transmitter you should not be.
Sub-GHz on Flipper means unlicensed ISM and SRD bands below 1 GHz: commonly 300–348, 387–464, and 779–928 MHz, depending on region. Cheap sensors, doorbells, and old remotes live here because the chips cost cents and a small whip antenna is enough.
Bands you will see on a datasheet
| Band | Where it shows up | Typical occupants |
|---|---|---|
| 315 MHz | US/JP short-range | Older alarm fobs, some automotive accessories |
| 433.92 MHz | Worldwide ISM/SRD | Weather stations, cheap remotes, sensors |
| 868 MHz | EU SRD | Alarms, meters, some sensors |
| 915 MHz | US ISM | Telemetry, some sensors, LoRa gear |
Modulation in one page
- OOK / ASK: carrier on or off (or two amplitudes). Dominates bargain remotes and many sensors. Easy to see on a waterfall as dashed lines.
- FSK: two frequencies for 0 and 1. More robust against noise. Weather stations and some alarms use it.
- The bitrate and the preamble matter as much as the band. A 433.92 MHz OOK burst at 3 kb/s is a different world from 100 kb/s FSK.
Static codes versus rolling codes
A static-code encoder (PT2262, EV1527, and cousins) sends the same DIP-switch bits every time. If you own that remote, capturing and replaying it is the same as pressing the button. That is why those chips are disappearing from anything that protects property.
A rolling-code or challenge–response system shares a secret and a counter (or a fresh challenge) between the fob and the receiver. A packet you recorded is already spent, or it never was valid without the current challenge. That is the entire point. KeeLoq-era automotive and modern garage systems are in this family. Stock Flipper firmware is not a rolling-code oracle, and this bench will not treat 'how do I get around that' as a lab.
Listen-first labs
- Tune Read RAW on a band you are allowed to use
- Catch a weather sensor you own or that is broadcasting in the clear
- Note frequency, modulation, and repeat count
- Save a file named after the device
Do not treat as labs
- Vehicle keyless entry or immobilizers
- A gate, garage, or alarm that is not yours
- Jamming a receiver 'to see if it drops'
- Firmware forks sold as car or gate kits
What Flipper is good at here
Identifying a frequency. Parsing a handful of known static protocols. Saving raw. Acting as the remote for a static-code device you own. Teaching you why 'I captured the packet' is not the same as 'I have access' once the designer spends a dollar on cryptography.
Related labs