A friend stopped by recently and saw the Flipper Zero on my desk. The conversation drifted to remote controls, and he said to me, half-seriously, “Anyway, anyone can open my garage door with a gadget like that.” ” Bet accepted. With his explicit consent and using his own equipment, we spent some time figuring it out. The result surprised me, and above all, it clearly illustrates the difference between what we think a gadget can do and what it actually does.
> The basics in 30 seconds. The Flipper Zero easily reads and replay fixed-code remote controls (older garage doors, no encryption). When faced with a rolling code (KeeLoq and similar systems), a simple replay fails: each press generates a different code. My friend’s gate uses KeeLoq—so it’s not vulnerable to replay attacks. The Flipper remains an excellent learning tool, but it doesn’t magically open everything that transmits at 433 or 868 MHz.
What the Flipper Can—and Cannot—Do with Radio
The Flipper features a CC1101 radio chip that covers the most common Sub-GHz bands: ~300–348, ~387–464, and ~779–928 MHz. In France, almost all modern gate remote controls operate on 433.92 MHz or 868 MHz—right within its range.
The first pitfall—and it’s a structural one—is that gate openers installed before 2008 often used other bands (26.995 MHz, 30.875 MHz, 40.685 MHz, etc.). ARCEP banned these frequencies for short-range domestic use effective January 1, 2008, and more importantly, they are outside the CC1101’s range: the Flipper doesn’t go below ~300 MHz. So if you’re testing a very old setup and the Flipper remains silent, it’s not a configuration issue—it simply can’t pick up signals on those bands. You’d need an RTL-SDR to listen in on them.
The Right Approach: Frequency Analyzer First, Read Next
My first instinct was the wrong one: opening Sub-GHz → Read and pressing the remote control. Nothing happened. That’s normal: Read only listens to one frequency at a time (433.92 MHz by default). If the remote is transmitting on a different frequency, you won’t hear a thing.
The right diagnostic tool is the Frequency Analyzer:
- Sub-GHz → Frequency Analyzer, with the remote control held against the Flipper, hold down the button.
- It displays the actual frequency detected. Note: it’s only reliable while the button is held down; between button presses, it displays ambient noise (random values).
On my friend’s door, the analyzer settled around 868.xxx MHz—not the “theoretical” 868.35 I had in mind. Lesson: Trust the measurement, not the table.
Once I knew the frequency, I went back to Read → Config, where a second pitfall awaited me: modulation. By default, Read is set to AM650 (OOK). However, many 868 MHz remote controls transmit in FM (2-FSK). As long as I was in AM mode, it picked up a signal (the little reception icon lit up) but didn’t decode any protocol. Once I switched to FM, everything worked as it should.
> Annoying detail: The official firmware resets Read to 433.92 / AM650 every time you enter the menu. It doesn’t remember the last frequency. That’s one of the reasons I eventually switched to community-developed firmware (see below).
Read the results in the .sub file
Each saved capture ends up in subghz/ on the SD card as a .sub file—and it’s plain text. That’s where the actual audit deliverable is located. Here’s the header of the door capture, with the actual key redacted:
Filetype: Flipper SubGhz Key File
Frequency: 868xxxxxx
Preset: FurixxxxxxxxxxxxxxxxxAsync
Protocol: KeeLoq
Bit: 64
Key: XX XX XX XX XX XX XX XX
Manufacture: xxxxxx
Three lines settle the matter:
Frequency: 868xxxxxxx→ 868.xxx MHz, consistent with the analyzer.Preset: …xxxxxxxxxxxsync→ FM, which explains why decoding in AM failed.Protocol: KeeLoq→ rolling code. MotorManufacturer: xxxxxx.
Fixed Code vs. Rolling Code: Why It Makes All the Difference
This is the crux of the matter. Two worlds coexist on these bands.
The fixed code (older encoders like the PT2262, and some CAME / Nice / Cardin models from before ~2010) has no encryption: the remote control always sends the same data frame. The Flipper performs Read → Save → Send, and the gate reopens. Reading = cloning. On these systems, my friend’s bet would have been a sure win.
The rolling code (KeeLoq, Somfy, Nice FloR-S, Hörmann BiSecur, Chamberlain Security+…) includes an encrypted counter: each press produces a different frame, and the receiver rejects any code it has already seen or that is earlier than its counter. A raw replay won’t open anything.
Since my friend’s door uses KeeLoq, the verdict is: not vulnerable to simple replay attacks. His bet is lost—and that’s actually quite reassuring for him.
“But KeeLoq is broken, isn’t it?”
Yes and no, and this is where we need to be honest rather than sensationalist.
KeeLoq does indeed have long-documented cryptographic weaknesses. Academic research from 2007–2008 demonstrated slide/meet-in-the-middle attacks capable of recovering the key (Indesteege et al., EUROCRYPT 2008), and, most importantly, side-channel attacks capable of extracting a receiver’s manufacturer key and then cloning a remote control remotely by intercepting two messages (Eisenbarth, Kasper, Moradi, Paar et al., 2008). More recently, “timeless” replay attacks such as RollBack (Csikor et al., 2024) and the classic RollJam (Kamkar, 2015) — capturing by jamming to desynchronize — call into question the practical robustness of rolling codes.
But—and this is the important point—none of this is “push-button” on a Flipper. Extracting the manufacturer key requires power consumption analysis on the receiver; RollJam/RollBack rely on jamming, which is illegal (see below) and, in any case, is not a technique I will detail here. For a fact-based audit report, the door is therefore classified as: properly configured access control (rolling code, non-replayable), with the residual risk of advanced KeeLoq attacks that go beyond the scope of a simple gadget.
The Legal Framework, Because It’s Not Optional
This is the part I consider non-negotiable as soon as you step outside the realm of your own hardware.
The 433 MHz and 868 MHz bands are unlicensed bands (ISM/SRD): they can be used without a license, but under certain conditions—with power and duty cycle limits (typically 25 mW PER on 868 MHz, 10 mW and a 10% duty cycle on 433 MHz), in accordance with the EN 300 220 standard and the European RED Regulation 2014/53/EU. Listening (Read, Frequency Analyzer) is passive and poses no problem.
However:
- Replaying a code to open a door is acceptable only on your own system, or with the explicit written authorization of the owner. This is precisely what distinguishes white-hat testing from other activities: the scope and consent, not the intent.
- Jamming (essential for RollJam-type attacks) is prohibited in France; SRD devices themselves offer no guarantee of protection against interference and must not jam other uses.
- The official firmware deliberately limits transmission on certain frequencies depending on the region. Community firmware removes this limitation, but you then become liable under ARCEP regulations.
In my case: my friend’s device, which was right next to me, and he agreed to the test. Nothing was broadcast beyond his door. Period.
Why I Switched to Unleashed
Two annoying details in the original firmware got the better of me: the automatic frequency reset in Read mode, and the lack of favorites. The community-developed Unleashed firmware fixes both issues (saving the last frequency/modulation, persistent favorites), and adds Sub-GHz protocols, a much more comprehensive MIFARE key dictionary for RFID, and support for external modules.
The switch can be done cleanly using qFlipper:
- Back up the SD card (full copy to the PC—screenshots, dumps, settings).
- Back up the internal storage via qFlipper (Backup: device keys, Bluetooth pairing).
- Download the
.tgzfile for the latest release from the officialDarkFlippers/unleashed-firmwarerepository (theflipper-z-f7-update-…tgzfile, standard version—not the SDK, not the source code). - qFlipper → Install from file → select the
.tgzfile. The SD card contents are preserved.
Useful reminder: custom firmware does not add any radio functionality. It unlocks the software, not the hardware. The garage door on an old 27/40 MHz band will remain inaccessible, whether you use custom firmware or not.
What I’ve Learned
- The Flipper is a great educational tool for understanding Sub-GHz, but it’s not the magic wand shown in clickbait videos.
- The method that works: Frequency Analyzer to find the frequency, Read with the correct modulation (test AM and FM), then read the
.subfile for the protocol. - Fixed code → replayable → vulnerable. Rolling code → replay ineffective → secure. That’s the one-line audit verdict.
- With garage doors, it’s the older systems (often 433 MHz AM, fixed code) where you’ll find replayable systems. Newer KeeLoq/AES systems hold up well against a simple Flipper.
- And most importantly: written consent + scope. Without that, we’re no longer in the white-hat realm.
My next step: switching from Sub-GHz to RFID/NFC, where the Flipper is truly formidable against poorly configured access badges. That will be the subject of another article.
Sources and References
- Flipper Zero — official Sub-GHz documentation: docs.flipper.net
- Firmware Unleashed (official repository): github.com/DarkFlippers/unleashed-firmware
- ARCEP / ANFR — 433 MHz and 868 MHz unlicensed bands (ISM/SRD, conditions of use, EN 300 220 standard): ARCEP Decision No. 02-939 (arcep.fr); National Frequency Band Allocation Table, Annex A7 (anfr.fr); Prohibition of former domestic bands (26.995 / 30.875 / 40.685 MHz) effective January 1, 2008.
- ARCEP — Radio Jammers (reminder of the legal framework, Art. L.33-3 and L.42 et seq. of the CPCE): arcep.fr
- S. Indesteege, N. Keller, O. Dunkelman, E. Biham — “A Practical Attack on KeeLoq”, EUROCRYPT 2008: iacr.org
- T. Eisenbarth, T. Kasper, A. Moradi, C. Paar et al. — “Physical Cryptanalysis of KeeLoq Code Hopping Applications”, IACR ePrint 2008/058: eprint.iacr.org/2008/058
- L. Csikor et al. — “RollBack: A New Time-Agnostic Replay Attack Against Automotive Remote Keyless Entry”, ACM TCPS, 2024.
- RED 2014/53/EU — European Directive on Radio Equipment.