⚠️ My remote isn't supported | How to add new Sub-GHz protocol in Flipper Zero

Abstract

Flipper’s firmware is deeply under development, new features and protocols added everyday. We need your help to analyze and collect new protocols. Please follow this guide to create a report of your unsuported remote. Your report will help developers to implement new Sub-GHz protocols.

По вопросу “Flipper не видит мой брелок”

1. Finding the frequency

Different wireless keyfobs operates on various radio frequencies depends on your country, and system manufacturer. For example it can be:

  • 315 MHz
  • 318 MHz
  • 433.4 MHz
  • 433.92 MHz
  • 434.42 MHz
  • 868.36 MHz
  • … etc

To analyze your remote, you need to know the exact frequency it operates and configure Flipper Zero on this freq.

2. Finding the modulation

Not only frequency but modulation may be different. Keyfobs operates on the same frequency may be completely different in modulation. For example:

  • Amplitude-shift Keying — ASK (OOK, AM). Simple modulation, no need additional configuration to decode the signal.
  • Frequency-shift Keying — 2-FSK (FM). Tricky modulation, you need to know frequency deviation config to decode signal.
  • … etc

To capture your signal, you need to configure the correct modulation settings on Flipper Zero. Because Flipper is not SDR, you need to configure the right modulation before capturing the signal, otherwise, you will not receive the correct data. You cannot change the modulation on capturing signal as you can do on SDR.

3. Static or Dynamic code

When we know the physical characteristics of your signal (Freq, and Modulation), the next step is to find out the logical level — digital protocol. There are hundreds of digital radio protocols. Sub-GHz digital radio protocols can be divided into two major types:

  • Static codes — every time you press the button on your remote, it sends the same code
  • Dynamic (Rolling) codes — different codes on every button press, for security reasons

Flipper Zero supports lots of Static and Rolling codes. Flipper can hijack and decode many of Rolling codes, but for security reasons, we prevent saving the decoded dynamics codes in stock firmware.

To capture and decode protocol that Flipper Zero understand, go to Sub-GHz —> Read. But not every protocol can be captured this way, for protocols Flipper do not know, you can use Read RAW

4. Capturing RAW signal

When Flipper doesn’t know your protocol yet, you can capture it using Read RAW feature. This feature will save raw data without decoding and parsing it. You can analyze this data on PC, send it to developers and replay captured signal, But keep in mind, that you still need to configure the right Freq/Modulation for capturing correct data.


How to report my unsupported keyfob remote

For adding new protocols, we need your help. Please collect this data and create a new topic on this forum.

  1. Create a new topic in Sub-GHz section. Name the subject with the name of your wireless system brand name.

  2. Find the exact frequency of your system

  3. Attach the high resolution photo of your remote, to make FCC ID can be seen clearly.

  4. [Optional] Teardown photo of PCB and chips will be useful too. But no need to damage your main keyfobs for this.

  5. If Flipper Zero supports your freqency in default configuration, and your signal is ASK (OOK, AM) modulation, please capture the RAW signa on Flipper. Press each button on your remote for 10 times, and record the RAW signal of each button pressed on a different file and attach this files to your topic on forum.

  6. [Optional] Your remote may have the function of binding it to the new system (Master Code send). Record this signal too, if you know how.

  7. If frequency or modulation is cannot be configured on Flipper Zero out of the box, for example 2-FSK(FM), please record your signal using SDR. For example, using RTL-SDR and Universal Radio Hacker. Save signal and attach it to forum topic.

8 Likes

That is a great write up. I show some steps for using these technics in my talks about demoding ford with rtl433, urh, and inspectrum. Please feel free to share. I hope I can help add some tools to the flipperzero very excited to start using it.

3 Likes

is it a hardware limitations that keeps Flipper from being an SDR? or is it software that is/can be under development?

Hardware

Cool so in theory a module could be built integrating that hardware via the gpio pins?

@caffeinatedinsanity the Flipper does not have a fraction of the CPU needed to do realtime SDR signal processing…

the only reason it can some of what it does now is because the hard signal processing (demodulation, etc) is being done by the CC1101 radio chip

2 Likes

Hello everyone,

I am following a developer on GitHub who is manufacturing his own 434/868 Mhz antenna for a Raspberry Pi. He also analyzed many commmon protocols for 434/868 Mhz.
All information and code is public available @ GitHub:
Phunkafizer/RaspyRFM: Software for the RaspyRFM module with examples (github.com)
Maybe it will help to add more protocols to the Flipper Zero.

And for all German people here: Many description can be found at his website:
Funksteckdosen mit dem Raspberry PI steuern – Seegel Systeme (seegel-systeme.de)

At the moment I cant do much because I have not much time so I would maybe implement a Lacrosse Interface myself but at the moment I just cant wait until maybe someone else could do it.

he only looked at static protocols, they are of little interest, because to add them, it is enough to record raw and a little time