HackTricks Press
Search K

Appearance

FZ - Sub-GHz โ€‹

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Try Hard Security Group

โ›“๏ธ External Link
https://discord.gg/tryhardsecurity

Intro <a href="#kfpn7" id="kfpn7"></a> โ€‹

Flipper Zero can receive and transmit radio frequencies in the range of 300-928 MHz with its built-in module, which can read, save, and emulate remote controls. These controls are used for interaction with gates, barriers, radio locks, remote control switches, wireless doorbells, smart lights, and more. Flipper Zero can help you to learn if your security is compromised.

Sub-GHz hardware <a href="#kfpn7" id="kfpn7"></a> โ€‹

Flipper Zero has a built-in sub-1 GHz module based on a ๏ปฟ๏ปฟCC1101 chip and a radio antenna (the maximum range is 50 meters). Both the CC1101 chip and the antenna are designed to operate at frequencies in the 300-348 MHz, 387-464 MHz, and 779-928 MHz bands.

Actions โ€‹

Frequency Analyser โ€‹

โ„น๏ธ

How to find which frequency is the remote using

When analysing, Flipper Zero is scanning signals strength (RSSI) at all the frequencies available in frequency configuration. Flipper Zero displays the frequency with the highest RSSI value, with signal strength higher than -90 dBm.

To determine the remote's frequency, do the following:

  1. Place the remote control very close to the left of Flipper Zero.
  2. Go to Main Menu โ†’ Sub-GHz.
  3. Select Frequency Analyzer, then press and hold the button on the remote control you want to analyze.
  4. Review the frequency value on the screen.

Read โ€‹

โ„น๏ธ

Find info about the frequency used (also another way to find which frequency is used)

The Read option listens on the configured frequency on the indicated modulation: 433.92 AM by default. If something is found when reading, info is given in the screen. This info could be use to replicate the signal in the future.

While Read is in use, it's possible to press the left button and configure it.
At this moment it has 4 modulations (AM270, AM650, FM328 and FM476), and several relevant frequencies stored:

You can set any that interests you, however, if you are not sure which frequency could be the one used by the remote you have, set Hopping to ON (Off by default), and press the button several times until Flipper captures it and give you the info you need to set the frequency.

โŒ

Switching between frequencies takes some time, therefore signals transmitted at the time of switching can be missed. For better signal reception, set a fixed frequency determined by Frequency Analyzer.

Read Raw โ€‹

โ„น๏ธ

Steal (and replay) a signal in the configured frequency

The Read Raw option records signals send in the listening frequency. This can be used to steal a signal and repeat it.

By default Read Raw is also in 433.92 in AM650, but if with the Read option you found that the signal that interest you is in a different frequency/modulation, you can also modify that pressing left (while inside the Read Raw option).

Brute-Force โ€‹

If you know the protocol used for example by the garage door it's possible to generate all the codes and send them with the Flipper Zero. This is an example that support general common types of garages: https://github.com/tobiabocchi/flipperzero-bruteforce

Add Manually โ€‹

โ„น๏ธ

Add signals from a configured list of protocols

List of supported protocols <a href="#id-3iglu" id="id-3iglu"></a> โ€‹

Princeton_433 (works with the majority of static code systems)433.92Static
Nice Flo 12bit_433433.92Static
Nice Flo 24bit_433433.92Static
CAME 12bit_433433.92Static
CAME 24bit_433433.92Static
Linear_300300.00Static
CAME TWEE433.92Static
Gate TX_433433.92Static
DoorHan_315315.00Dynamic
DoorHan_433433.92Dynamic
LiftMaster_315315.00Dynamic
LiftMaster_390390.00Dynamic
Security+2.0_310310.00Dynamic
Security+2.0_315315.00Dynamic
Security+2.0_390390.00Dynamic

Supported Sub-GHz vendors โ€‹

Check the list in https://docs.flipperzero.one/sub-ghz/supported-vendors

Supported Frequencies by region โ€‹

Check the list in https://docs.flipperzero.one/sub-ghz/frequencies

Test โ€‹

โ„น๏ธ

Get dBms of the saved frequencies

Reference โ€‹

Try Hard Security Group

โ›“๏ธ External Link
https://discord.gg/tryhardsecurity
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: