Case studies · real beginner mysteries
"Wait, why did that happen?"
Almost everyone new to the Flipper hits the same handful of confusing moments. None of them are bugs. Each one is a piece of RF explaining itself — once you know what you're looking at.
The gate that appears to accept a replay
This is a hypothetical diagnostic example, not a verified incident involving a particular gate. In a counter-based model, a previously unused valid message may be accepted if it falls within the receiver’s forward window. Once consumed, the same message is stale.
A forward window does not make an old counter fresh again. If an identical capture seems to work intermittently, investigate the actual protocol, whether a file contains multiple frames, whether receiver state changed, and whether you are observing the same operation. Do not claim a diagnosis from “works once” alone.
Rejected stale messages do not normally advance the receiver counter. Real products have implementation-specific synchronization and recovery behaviour, and operational fob experiments can cause loss of access. Use the simulator to explore the model; use the manufacturer’s documented process for genuine remote provisioning or repair.
Read the primary sources: Microchip HCS301: synchronization model (PDF) · Flipper: demodulated RAW recordings · Flipper: static and dynamic protocol support. Course review: 10 September 2026.
The car fob that won't clone
- Symptom
- You try to copy your car key fob so you have a spare. The Flipper reads something, but the copy never unlocks the car.
- What's happening
- Modern car fobs are rolling code too, so the same one-time-password logic applies — provisioning and immobilizer behaviour depend on the specific vehicle and require its documented service procedure.
- What to do
- Add a spare the way cars actually do it: programming, not cloning.
It's tempting to think of a spare remote as a photocopy, but that's not how cars work. The fob and the car share a secret that was paired at the factory or by a dealer, and — like the gate above — each press is a throwaway code, so a recording can't stand in for the real thing. Cloning the radio signal was never the mechanism for adding a car remote.
The real path to a spare is enrolling a new fob into the car, which depends on the make and model. Some cars have an owner-accessible programming sequence in the manual; many require dealer or locksmith tooling that talks to the car's computer directly. Your owner's manual (or the dealer) is the authority. The Flipper is a superb tool for understanding what your fob transmits; it isn't a key-cutting machine.
The garage remote that copied perfectly — and still works
- Symptom
- You capture an older garage-door remote, replay it, and it opens the door every single time. Unlike the gate, it never stops.
- What's happening
- This remote is fixed code same every press. There's no counter to move past.
- What to do
- Nothing's wrong — enjoy it, and understand what it means.
Plenty of older openers (and cheap gate remotes) send the identical message on every press — often a simple protocol like Princeton with a 24-bit key. Because the message never changes, a recording of it is just as valid tomorrow as today. That's exactly why fixed-code devices are the perfect first capture in Module 3: they behave predictably and teach the whole capture-save-replay loop on your own hardware.
Frequency Analyzer says 433.92, but Read shows nothing
- Symptom
- The Frequency Analyzer clearly locks onto your remote at 433.92 MHz. But when you switch to Read and press the button, nothing decodes.
- What's happening
- You have the right frequency but the wrong modulation, or a protocol the decoder doesn't recognise.
- What to do
- Change the preset; if that fails, capture with Read RAW.
Finding the frequency is only half the job. Read has to decode the signal, and that needs the right modulation preset and a protocol grammar it knows. If your remote speaks FSK and you're listening on an AM preset (or vice versa), the energy is there but the message is gibberish — like tuning to the correct station in the wrong language. Work through it in order:
| Try | Why |
|---|---|
| Confirm the frequency, then set AM650 | The most common preset; fits most fixed-code remotes. |
| Try AM270, then FM238 / FM476 | You may be on the wrong modulation family entirely. |
| Switch to Read RAW | Captures the pulses even when no decoder recognises the protocol. |
A successful RAW capture that never decodes into a named protocol is a totally normal outcome — it just means the Flipper doesn't have that grammar built in, not that you failed. The presets reference lists what each one is for, and Module 9 turns this into a full diagnostic flow.
I read my office badge fine, but the clone won't open the door
- Symptom
- The Flipper reads your work or hotel badge and shows an ID. You write it to a blank, but the copy doesn't open the door.
- What's happening
- The door system checks more than the number you can read — and there's a policy layer on top of the technical one.
- What to do
- Treat access credentials as off-limits unless you administer the system.
Reading an ID off a badge isn't the same as reproducing everything the reader validates. Many access systems layer on protections a simple clone can't satisfy: cryptographic challenge-response, rolling counters, anti-cloning checks, or a back-end that flags the same credential appearing in two places. So a copy that reads perfectly can still fail at the door — by design.