10
Week 6 · RF foundation milestone

Foundation project: your signal atlas

No new tricks this week. Instead, you turn the whole course loose on the real world: your authorized training remotes and tags, identified and catalogued in one place.

⏱ 60 min+ Gear: Flipper + your documented lab targets

Goal

A course teaches you nothing until you can use it without the course. So this module has no fresh material to memorise. The task is simple to say and satisfying to do: work through your controlled lab, and for each authorized training device, work out what it is and write it down. Frequency, modulation, protocol, fixed or rolling, and one honest sentence about whether a replay would work.

By the end you will have a personal signal atlas — a catalogue of the invisible RF around you that you built yourself, from scratch, with a tool that fits in your pocket. That atlas is the proof. If you can classify a remote you've never seen before using the same steps every time, you have actually learned this.

★
Why this is the real examAnyone can follow a lab with the answer written at the bottom. The skill is walking up to an unknown device and, in a couple of minutes, saying "868 MHz, FSK, rolling — a replay won't work, and here's why." That's what you're demonstrating today, one device at a time.

The workflow you now own

Everything from Modules 1 through 9 collapses into one repeatable routine. Point it at any unknown Sub-GHz remote and it always runs the same way:

  1. Identify the frequency. Sub-GHz → Frequency Analyzer, remote held close, button held down. Read the number: usually 315, 433.92, 868 or 915 MHz. No number? It may be too weak, or on a frequency outside the analyzer's default list.
  2. Identify the modulation. Open Sub-GHz → Read on that frequency and sweep the presets — AM650 AM270 FM238 FM476 — until it decodes. The winning preset tells you AM/OOK vs FM/FSK.
  3. Decode, or go raw. If Read names a protocol, record it. If it stays blank but the analyzer saw a peak, capture with Sub-GHz → Read RAW — the signal is real, the protocol just isn't one the Flipper knows.
  4. Fixed or rolling? Press it several times on the Read screen. Compare repeated messages with the documented protocol. A changing payload could be a sensor reading or other data; a visible counter alone does not prove a secure rolling-code design. Mark uncertain classifications as unknown.
  5. Save and label. Give it a clear name you'll recognise in a year — garage-main-433 beats Sub_042. Save a real capture for every fixed-code device.
  6. Note whether replay would work, and why. Fixed → may work when the receiver accepts the repeated message and radio conditions are met. Rolling → a consumed value is normally rejected. RAW → representation alone cannot predict acceptance. Write the reason, not just the yes/no.
frequency Analyzer modulation sweep preset decode Read / RAW fixed? watch Cnt save & label replay? why / why not
The same six steps, every time, for any unknown remote.

RFID and NFC follow the same spirit even though the tools differ: for a 125 kHz fob you'll use the Flipper's RFID reader (EM4100, HID Prox, Indala) and note whether it's a writable T5577 blank; for a 13.56 MHz card you'll use NFC (Mifare, NTAG), knowing a bank card only ever gives up limited public data. Same routine: identify, classify, label, and be honest about what can and can't be copied.

Build your signal atlas

This is the tool for the job. As you walk your home, add each device you find — the atlas keeps your catalogue in this browser so you can build it over days, not one sitting. Fill in what you learn from the workflow above, one row per device.

✓
Fill it in as you goDon't try to remember everything and type it up later. Carry the Flipper in one hand, add the device to the atlas the moment you've classified it, then move to the next room. Your entries are saved on this device only — this is your private notebook, not a public database.

Lab: catalog your training devices

  1. Choose three authorized lab targets: for example a fixed-code chime, an unenrolled LF tag and an NFC practice card. Document models and firmware.
  2. Use the appropriate app, compare observations with the device documentation, and record frequency, modulation, protocol and uncertainty. Do not classify a changing payload as rolling security without more evidence.
  3. Use aliases in the atlas above. Keep any actual key values or credential dumps outside the notebook and the public repository.
  4. Record whether a replay or emulation was tested, expected, or unknown. A failed test alone is not a diagnosis.
  5. Export the atlas. Explain the classification of each target without notes, then continue to Module 11.

Deliverable: three documented entries, a limitation for each, and a portable export. This finishes the RF foundation, not the whole course.

Where to go next

Continue with Module 11: infrared, then the full learning path through GPIO, USB/BLE, authentication, app development, authorized security research and the mastery project.

You've reached the edge of this course, not the edge of the subject. RF is deep, and the Flipper only touches part of it. A few honest directions, kept high-level — the live links live on the reference page so they stay current:

Read the real docs

  • Official Flipper documentation — the authoritative source for what each menu and file format actually does.
  • Momentum documentation — the custom presets, extended frequencies and settings this course used, explained by the people who built them.
  • The community — forums, subreddits and chats where people post captures, protocol notes and honest "here's what didn't work" stories.

Find all of these on the reference page.

Pick a next skill

  • Sub-GHz protocol internals — how a protocol like Princeton actually encodes bits in pulse timing, and how decoders are written.
  • NFC deep dive — the 13.56 MHz world is a course of its own: sectors, keys, and what's readable versus protected.
  • GPIO & hardware — wire sensors and modules to the Flipper's pins and read the physical world directly.
  • Building .fap apps — write your own Flipper application once you want a tool that doesn't exist yet.
!
The rule doesn't expireEverything past this course amplifies what you can do, which means it amplifies your responsibility too. The one rule stays: capture and replay only devices you own or have explicit permission to test, in a space you control. Deeper knowledge is not permission.
★
Your foundation is taking shapeYou now have a documented starting point for further experiments. Mark the module complete when you can explain your evidence, then continue through the other interfaces and the final portfolio. Leave unknowns visible; independent work includes knowing what you have not established.

Check yourself

Verify the details

Read the primary sources: Flipper: reading signals and presets · Flipper: LF RFID · Flipper: NFC. Course review: 10 September 2026.