Cheat sheet

Named protocols, not exploits.

Band, encoding, what stock firmware is for, and the legal line. Filter is a map — it will not teach you how to steal a car.

Bands you will actually meet

IR 38 kHz
LED envelope
125 kHz
LF RFID
13.56 MHz
NFC
315 MHz
US SRD
433.92
ISM/SRD
868 MHz
EU SRD
915 MHz
US ISM
2.4 GHz
BLE

24 / 24

Name	Family	Band	Encoding	On Flipper	Legal line
Generic OOK / ASK burst	Sub-GHz	433.92 MHz (also 315)	OOK/ASK, often 2–10 kb/s	Read RAW, many named static parsers	Listen widely; transmit only to gear you own, in-region
EV1527 / PT2262-style static	Sub-GHz	315 / 433.92 MHz	Fixed DIP or burned ID, repeated frame	Parse + replay as the original button, if you own it	Your remote, your relay. Not a neighbor's gate.
ISM weather sensors	Sub-GHz	433.92 / 915 MHz	Mostly FSK or OOK, vendor-specific	Read RAW; some apps decode named brands	Clear-text telemetry in ISM is usually fine to receive
EU 868 MHz SRD	Sub-GHz	868 MHz	Often FSK; duty-cycle limited	Receive if the region pack allows; watch duty cycle	Stay in the allocation for your country
US 915 MHz ISM	Sub-GHz	902–928 MHz	FSK, OOK, LoRa and others	Read RAW; LoRa is not a Flipper-native stack	Part 15 device — no jamming, no out-of-band TX
Rolling code (KeeLoq-class and later)	Sub-GHz	315 / 433 / 868 / 915 MHz	Encrypted hopping code or challenge–response	Will not legitimately 'solve' these on stock firmware	Out of scope. Capture is not access. Do not pursue.
Tire pressure sensors (TPMS)	Sub-GHz	315 / 433 MHz	FSK/ASK, vendor IDs	Some community parsers exist	Receiving a broadcast is one thing; spoofing a vehicle is not a lab
EM4100 / EM4102	RFID	125 kHz	Manchester, public 40-bit-class ID	Read, save, emulate your own tag	Own tags only. UID ≠ authorization on a real door.
Atmel/Microchip T5577	RFID	125 kHz	Configurable LF emulator chip	Write a format onto a blank you purchased	Blanks you bought. Not someone else's fob.
HID Prox / Indala-class	RFID	125 kHz	Proprietary proximity formats	May read an ID; that is not an invitation to copy	Workplace badges are out of scope
ISO 11784/85 FDX-B	RFID	134.2 kHz	Animal ID, 15-digit style numbers	Read the ID; confirm against paperwork	Read your animal. Do not rewrite an implant.
NTAG213 / 215 / 216	NFC	13.56 MHz	ISO 14443A, NFC Forum Type 2, NDEF	Read/write NDEF on blanks you own	The friendly lab. Lock bits can be permanent.
MIFARE Ultralight	NFC	13.56 MHz	Type 2, small user EEPROM	NDEF read/write when the tag is yours	Event tickets you do not own are not blanks
MIFARE Classic 1K/4K	NFC	13.56 MHz	Crypto-1 sectors, Key A/B	UID + history lesson. Not a badge copier.	Academic weakness ≠ permission. No live access systems.
MIFARE DESFire / Plus	NFC	13.56 MHz	AES (and older 3DES) applications	May see a UID; the app data stays closed	Leave it. This is not a dumping target.
ISO 15693 vicinity	NFC	13.56 MHz	Longer-range NFC Forum Type 5	Read when supported; treat as not-yours until it is	Inventory tags in a store are not your tags
EMV contactless / wallets	NFC	13.56 MHz	ISO 14443 + EMV kernel	Detect and stop	Always out of scope. Access-device / fraud statutes.
NEC / NEC extended	Infrared	~38 kHz carrier, 940 nm-class LED	Pulse-distance, address + command	Learn a button, save, replay to your device	Your TV. Not a lecture-hall gag.
Sony SIRC	Infrared	~40 kHz carrier typical	PWM, 12/15/20-bit	Capture and replay; hold-to-repeat is protocol	Own equipment only
Philips RC5 / RC6	Infrared	~36 kHz	Manchester, toggle bit	Learn from the original remote	Own equipment only
Samsung IR	Infrared	~38 kHz	NEC-like timings, vendor address	Universal TV library or learn	Own equipment only
USB HID keyboard (DuckyScript)	HID	USB 2.0	HID keycodes, host keymap matters	Bad USB app, scripts on SD	Your computer. Never a stranger's USB port.
iButton DS1990A	1-Wire	1-Wire contact	64-bit ROM ID	Read / emulate your own button	Same rule as LF RFID — no one else's door token
Bluetooth LE advertisements	BLE	2.4 GHz	ADV packets, GATT after connect	Scan / some app-level tools; not a full sniffer	Scanning is not pairing. Don't spam crowded rooms.

Glossary

The words the lessons keep using. Same search box filters this list.

CFAAComputer Fraud and Abuse Act: US federal statute that criminalizes unauthorized access to computers and related systems. BadUSB against a machine you do not admin, and many other Flipper-shaped tricks, land here plus state computer-crime laws.
FCC Part 15: US rules for unlicensed transmitters. A Flipper is not a license to jam, flood, or operate outside the band your country allocated. Receiving and transmitting are treated differently; jamming is illegal.
ISM / SRD bands: Unlicensed industrial, scientific, medical (and short-range device) allocations. Hobby Sub-GHz lives here: 315, 433.92, 868, 902–928 MHz depending on region. Crowded does not mean 'fair game.'
OOK / ASK: On-off keying / amplitude-shift keying: bits ride a carrier that is simply on or off (or two amplitudes). Dominates bargain remotes and many sensors. Easy to see as dashed bursts. Not a security property.
FSK: Frequency-shift keying: 0 and 1 are two nearby frequencies. More robust against noise than OOK. Weather stations and some alarms use it. Still just modulation.
Static code: The same ID bits every button press (PT2262, EV1527 and cousins). Capturing it is the same as pressing the button — which is why those chips are disappearing from anything that protects property. Valid lab: a desk relay you purchased.
Rolling codehopping code, challenge–response: The valid packet changes so yesterday's capture is not tomorrow's key. KeeLoq-class and later garage/vehicle systems. Stock firmware is not an oracle. This bench stops when the frame changes every press.
IR carrier: The ~36–40 kHz (often 38 kHz) pulse train a remote LED uses so the receiver can ignore ambient light. The message is the envelope of that carrier, not the carrier itself. Not encryption.
NEC (IR): A common consumer-IR encoding: 9 ms burst, 4.5 ms space, then address and command. Huge share of TVs. Flipper can guess it or keep RAW timings either way.
UID: The identifier a tag announces. A name tag, not a password. If a door only checks UID, the door is the broken design — and still not your lab.
EM4100: Cheap 125 kHz tag that endlessly repeats a public ID. Original chips are not a writable credential. Practice on tags you own or purchased blanks.
T5577: A writable 125 kHz blank sold for hobby readers. In scope when you bought the blank and you are not minting someone else's fob onto it.
NDEF: NFC Forum user-data format: URI, text, vCard, and so on, sitting on Type 1–5 tags. How a sticker stores a URL. Not EMV, not a sector key.
NTAG213 / 215 / 216: Cheap NFC Forum Type 2 blanks. The intended write lab: a URL you control, verified with a phone. Lock bits can be permanent — know that before you lock.
MIFARE Classic / Crypto-1: Legacy 13.56 MHz chip whose cipher was broken in the academic literature around 2008. History lesson for building owners. Not a license to dump a live badge, hotel key, or transit card.
DESFire / Plus: Newer NXP access chips with AES (and older 3DES) applications. Flipper may see a UID; the app data stays closed. Leave it.
EMV contactless: Bank cards, phone wallets, watches. Detect and stop. Access-device and fraud statutes. Never a lab in this manual.
GPIO: General-purpose pins on the Flipper header. 3.3 V CMOS logic. The 5 V pin is power for modules, not a 5 V-tolerant input. 12 V automotive will kill it.
UART: Asynchronous serial: TX, RX, GND. TX goes to the other device's RX. Common ground is not optional. Start at 115200 8N1 unless the datasheet says otherwise.
HIDUSB keyboard, DuckyScript: Human Interface Device. In BadUSB mode the host sees a keyboard. Two different 'HID' words exist — HID Prox is an old LF badge format; USB HID is keystrokes. This glossary means the latter unless the family is RFID.
DuckyScript: Text language for HID payloads. STRING types glyphs according to the host keymap; DELAY exists because the OS needs time to open Run or Spotlight. Own machines only.
Emulate vs write: Read demodulates a tag. Save stores the dump on the SD card. Emulate: the Flipper coil plays a waveform. Write: program a blank you purchased. Emulation of someone else's credential is still copying an access device.
RAW capture: Timings (IR) or samples (Sub-GHz) without a successful named-protocol parse. Enough to replay to the same device you own. A named parser is convenience, not a requirement.