Meet your radio lab
Before a single word of theory: hold the device, learn where things live, and watch real radio energy move on the screen. By the end of this module the Flipper will feel like a tool, not a mystery.
Unbox, update, and keep a lab record
- Charge the device, insert a suitable microSD card, and back up any existing card data before formatting. A new card can be set up through the device’s storage menu.
- Install qFlipper from the official download link or pair your own phone with the official mobile app. Use the documented firmware update process with the SD card inserted.
- Record the firmware version and region shown by the device. A regional frequency list is a hardware/software setting, not a substitute for ANCOM’s conditions.
- Use only a locally compliant training remote for RF exercises. If you have no suitable target yet, complete the simulators first.
Read the primary sources: Flipper: first start · Flipper: firmware update. Course review: 10 September 2026.
Goal
Start with official firmware, or record the Momentum version if you already use it. You do not need to switch firmware for the core labs. Read the Romanian ground rules before working with hardware.
This module has one job: make the device feel ordinary. No captures, no decoding, no transmitting — just navigating menus and confirming the radio is alive. Radio is intimidating in the abstract and completely approachable once you have watched a needle twitch when you press a doorbell. We are going to press the doorbell.
What the Flipper actually is
The Flipper Zero is a multi-tool for the wireless world. Think of a Swiss Army knife where each blade is a different way of talking to everyday electronics. Most of those "blades" are separate little radios and interfaces, each tuned to a different technology:
| Tool | What it talks to | Everyday examples |
|---|---|---|
| Sub-GHz radio our focus | Low-power radios below 1 GHz, via a TI CC1101 chip | Garage remotes, doorbells, TPMS, weather stations, key fobs |
| 125 kHz RFID | Low-frequency access cards (unpowered coils) | Older building fobs, gym tags, pet chips |
| 13.56 MHz NFC | High-frequency smartcards (ISO 14443) | Transit cards, hotel keys, contactless payments |
| Infrared | Line-of-sight IR light | TVs, air-conditioners, projectors |
| iButton / 1-Wire | Contact "touch" keys | Intercom keys, some door contacts |
| GPIO pins | Direct wires to other electronics | Sensors, dev boards, hardware hacking |
That is a lot of doors. Here is the good news: the first half of this course focuses on Sub-GHz, then expands to other interfaces. Signal Path is almost entirely about the Sub-GHz radio — the part that listens to and repeats the little radio remotes scattered around your home. RFID and NFC get one module each near the end so you know they exist and how they differ, but Sub-GHz is where a beginner learns the most, fastest, with the least risk.
One more reframe that helps enormously: listening is not the same as transmitting. Receiving radio is passive and, not a blanket permission to capture private communications. Transmitting is the part that is regulated, because you are now putting energy into the air that can reach other people's devices. For all of Week 0 and most of Week 1, you are only ever listening. We will make the transmit rules crystal clear before you send a single signal.
Choose a documented starting point
Use official firmware for your first labs. If Momentum is already installed, record its version and keep transmit restrictions enabled. The basic RF principles apply to either. Apps, custom presets, and external CC1101 support also exist in official firmware; compare current documentation instead of assuming they require a fork.
Read the primary sources: Flipper: first start · Flipper: firmware update · Flipper: Sub-GHz hardware and menus. Course review: 10 September 2026.
The SD card & your first file format
Slide a microSD card into the Flipper and it becomes the device's filing cabinet. Almost everything you save — captured signals, RFID cards, NFC tags, infrared remotes, downloaded apps — lands on that card as ordinary files. No card, no saving.
For Sub-GHz, the file you will create over and over is a .sub file: a small, human-readable text file describing one captured signal. You do not need to understand its guts today, but a peek now makes Module 3 far less mysterious. A saved fixed-code remote looks roughly like this:
Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Princeton
Bit: 24
Key: 00 00 00 00 00 8C 5A 3B
TE: 400
Read it like a label on a jar: Frequency is where the signal lives (433.92 MHz here), Preset is how to listen (a modulation setting), Protocol is which remote "language" it speaks, and Key is the actual code that was sent. Every one of those words gets its own module. Today, just notice that a captured radio signal is, in the end, a tiny text file you can open and read.
Getting around: buttons and menus
Five controls do everything. Learn these and you can drive the whole device blind.
- D-pad
- The four-way ring: Up / Down move through a list, Left / Right change values or move between screens.
- OK
- The center button. Select / confirm / go in. When in doubt, press OK.
- Back
- Steps out one level. Hold Back to jump straight to the desktop (the dolphin home screen) from anywhere.
From the desktop, pressing OK (or the appropriate direction) opens the main menu: a scrolling list of apps, one per tool — Sub-GHz, 125 kHz RFID, NFC, Infrared, GPIO, iButton, plus Apps and Settings. Momentum may reorder this list or add entries, so scroll the whole thing once to see what you have rather than trusting a fixed position.
Inside the Sub-GHz app
Open Sub-GHz and you land on its own little menu. These are the sub-items you will live in for the next few weeks:
| Item | What it does | You'll meet it in |
|---|---|---|
| Read | Listens on a set frequency and tries to name the protocol it hears | Module 3 |
| Read RAW | Records the raw pulse timing when it can't name the protocol | Module 5 |
| Frequency Analyzer | Finds the frequency of the strongest signal held close by | Module 1 |
| Test | Shows a live reading of the radio energy the antenna is picking up | Today |
| Add Manually | Builds a signal from a known protocol without capturing it | Module 4 |
| Saved | Your library of captured .sub files, ready to view or replay | Module 3 |
Exact wording and order can vary between firmware versions; if yours differs slightly, match by description, not by the label.
Practice the menus without the risk
Before you thumb through the real thing, poke at this simulator. It mirrors the Sub-GHz menus and the D-pad so you can build muscle memory — nothing here touches a real radio.
What you'll need
Gather these once and the rest of the course flows. None of it is expensive or exotic — most of it is already in your house.
- A charged Flipper Zero on official firmware or a documented Momentum build.
- A microSD card, seated and formatted, for saving captures later.
- A few small RF remotes you own — see the prop list in the lab below.
- A notebook or a notes app. You will jot down frequencies and settings; writing them down is half the learning.
- Patience with "nothing happened." Some devices will show you nothing, and that is data too. We'll explain why.
Lab 0: the tour
Two small missions: confirm the radio breathes, and gather your props for the weeks ahead.
Watch live radio energy
Gear: Flipper only — no capture, no transmit
- From the desktop, open the main menu and select Sub-GHz.
- Choose Sub-GHz → Frequency Analyzer. It checks configured frequencies and reports a sufficiently strong nearby signal. It is not a continuous calibrated spectrum display.
- Observe the display before your test press. It may show no detected frequency; that does not mean the environment contains no radio energy.
- Use your authorized, locally compliant training remote — a wireless chime button is suitable — hold it a few centimeters from the Flipper, and press it. Watch the reading jump.
- Release the button and compare what the analyzer reports. Record the displayed frequency and the limits of this observation.
Round up your props
Gear: a shoebox and a wander around the house
Good beginner devices are cheap, fixed-code, and yours. Collect a few of these into one "radio box":
Great first targets usually fixed-code
- Wireless doorbell button — the classic, near-perfect starter.
- RF LED-strip remote — the little handset for color-changing lights.
- Ceiling-fan remote — often plain on/off/speed codes.
- Old garage remote from a pre-2000s opener you own.
Interesting, but expect surprises often rolling
- Car key fob — modern ones use rolling codes and won't simply replay. Great to observe, not to copy.
- Newer gate/garage remotes — many are rolling too.
Rolling-code devices are the star of Module 5. Keep them in the box; you'll understand exactly why they behave "weirdly" soon.
Check yourself
Verify the details
Read the primary sources: Flipper: first start · Flipper: firmware update · Flipper: Sub-GHz hardware and menus. Course review: 10 September 2026.