Week 2 · Transmitting

Your first legal replay

Everything so far has been listening — passive, invisible, harmless. This module is the moment you push a button and put energy on the air. That changes what's at stake, so we start with the rules, then make your own doorbell ring.

⏱ 40 min Gear: your saved .sub + its device Firmware: Official or Momentum

Goal

Take the fixed-code capture you saved in Module 3 and replay it — transmit it back — to trigger the device it came from. A doorbell that chimes, an LED strip that lights, a fan that spins. Then compare a consumed counter in the browser simulator. Predicting that rejection is the bridge to Module 5.

Read this before you press Send Sub-GHz reception can still collect protected data. Transmitting is regulated, and it can interfere with other people's property and safety. From here on the one rule is absolute: you only ever transmit to devices you own, in a space you control. Never to cars, gates, garages, barriers, or anything else that isn't yours — not "just to see," not "it's only a copy." Never jam or flood a band. If you're unsure whether something is yours to test, it isn't. Read the full ground rules →

The transmit line

There is a real, bright line running through this course, and it falls exactly here. Modules 0 through 3 only received. A radio receiver is like an ear: it can't touch the world, only notice it. You could sit in a field and log every remote for a mile and break no law and disturb no one.

Transmitting is a mouth, not an ear. The instant you Send, your Flipper radiates a signal that other receivers — not just your intended one — can hear and act on. That's why the same act is a fun experiment on your own doorbell and a serious offence on a stranger's gate. Authorization, the applicable radio conditions, and effects on others must all be considered.

Fine, on your own gear

Replaying your saved doorbell to your own doorbell.
Lighting your own LED strip or fan.
Testing an old garage remote for a garage that's yours.

Never

Transmitting to any car, gate, or garage that isn't yours.
Replaying a signal you captured from someone else's device.
Jamming, flooding, or "just testing" on a shared band.

Momentum unlocks are not permission Custom firmware can widen the frequencies your Flipper will transmit on and remove some region limits. That's a capability, not a licence. What's legal to transmit — and on which bands, at what power — is set by the law where you live, not by a menu. Know your local rules before you use extended frequencies (Module 8 covers them properly).

What replay really does

Open Sub-GHz → Saved, choose your file, and pick Send. The Flipper reads the .sub you inspected in Module 3, rebuilds the pulse train from its Protocol, Key, and TE, sets the radio to the file's Frequency and Preset, and switches the transmitter on and off in exactly that pattern.

Here's the part worth sitting with: for a fixed code, the signal your Flipper sends is indistinguishable from the original remote. Same frequency, same modulation, same bits, same timing. The receiver has no way to tell the two apart, because from its point of view nothing is different. That's not a clever trick — it's just what "fixed" means. The message never changes, so a faithful copy of the message works forever.

✓

Decoded replay vs. raw replay A decoded capture (a Key File, like your Princeton save) is replayed by regenerating the pulses from the protocol. A raw capture (Module 5) is replayed by playing back the recorded timings directly. Both put the same signal on air; they just get there differently. For a fixed code you own, either works.

When it works, the result is immediate and a little uncanny: your doorbell chimes with the remote sitting untouched on the table. That's the payoff of the last three modules landing at once — frequency, modulation, protocol, and now transmission, all lined up correctly.

Range and antenna reality

Your first replay might work from across the room. It might also need you standing suspiciously close to the doorbell. Both are normal, and the reason is the antenna.

The Flipper's built-in Sub-GHz antenna is small — it has to fit inside a pocket-sized case. A purpose-built remote often has an antenna better matched to its frequency, and sometimes more transmit power besides. So don't be surprised when your replay reaches less far than the real remote did. You're transmitting a perfect copy of the message through a weaker mouth.

Three things quietly shape how far a Sub-GHz signal carries:

Distance

Signal strength falls off fast with range — a few metres can be the difference between working and silent.

Obstacles

Walls, metal doors, and appliances absorb and reflect 433 MHz. Line-of-sight beats through-a-wall every time.

Orientation

Antennas are directional. Rotating the Flipper, or moving it a few centimetres, can swing a dead replay to a solid one.

If a replay is weak, the fix is boring and effective: get closer, clear the line of sight, and try a couple of orientations before you conclude anything is wrong. Only once you've ruled out plain distance should you suspect the signal itself.

External modules change the radio path Serious Sub-GHz range usually comes from an external CC1101 module with a proper antenna, which plugs into the Flipper's GPIO pins. Performance depends on the board, antenna, frequency, configuration and environment. Do not assume an external module always improves range or remains compliant. We set those up in Module 8; you don't need one for anything in this module.

When a replay does nothing

A silent replay feels like failure, but it's usually the Flipper telling you something true. There are only a handful of reasons, and you can walk them in order. Most of the time it's not the exotic one.

What you see	Likely cause	What to do
Nothing, and it's a car fob or modern gate	Rolling code. The captured code is already spent — the receiver won't accept it again. rolling	Expected. This is not fixable by replay. See Module 5.
Nothing, from a device that worked when you captured it	Too far, or blocked. Weak internal antenna plus distance or a wall.	Step closer, clear line of sight, rotate the Flipper, try again.
Nothing, and Read had struggled too	Wrong frequency or modulation saved.	Re-capture with Module 1's frequency and Module 2's modulation confirmed first.
Nothing, and the file is a RAW recording	RAW replays the recorded timings; a noisy or partial capture plays back garbage.	Re-record a clean RAW capture (Module 5), close and interference-free.
Sends, but the device ignores it	Device may be rolling, or the capture caught only part of the message.	Confirm it's fixed (key doesn't change on repeat presses), then re-capture cleanly.

Notice how often the honest answer is "it's rolling, and that's the point." You're about to prove it to yourself in the lab, and then spend all of Module 5 understanding exactly why.

Lab

First complete the Romanian radio checks. Use a locally compliant fixed-code training chime or light with no security or safety role. If its transmit conditions remain unresolved, do the simulation lab instead.

Lab 4.1

Replay your fixed code to your own device

Gear: your Flipper, the saved fixed-code .sub from Module 3, and the device it came from (doorbell, LED remote, fan…).

Put the device where you can see or hear it react — the doorbell chime in earshot, the LED strip in view.
Open Sub-GHz → Saved and select your named capture.
Choose Send. Watch and listen for the device to respond.
If nothing happens, don't touch settings yet: step closer, clear any wall between you, and rotate the Flipper before sending again. Range first, theories later.
Once it triggers, send it two or three more times to confirm it's reliable, not a fluke.

Lab 4.2 · simulation

Predict a replay result

Open the rolling-code simulator. Accept a fresh simulated message, then replay that same message. Record the receiver counter before and after, and explain the rejection. This replaces a physical car/gate exercise; the learning objective is the same.

✓You've got it when: your own fixed-code device reliably responds to a replay from Saved → Send, and you can explain — in one sentence using the word "rolling" — why the simulated receiver rejects a used counter. If the fixed replay is weak, you fixed it by moving closer and reorienting, not by changing settings.

Check yourself

Verify the details

Read the primary sources: Flipper: regional frequencies · ANCOM: current Romanian radio interfaces. Course review: 10 September 2026.