Reference · keep this open

The numbers, on one page.

The tables you'll reach for again and again — frequencies, presets, protocol families, file fields and conversions. Bookmark it; you're not meant to memorise this.

Common frequencies

The Sub-GHz frequencies you'll meet most, and roughly where and on what. Regions overlap and exceptions exist, so treat "where" as "most common," not a rule.

Frequency Region Typical devices
315 MHz North America Car key fobs, TPMS sensors, some garage remotes
390 / 418 MHz North America (older) Older garage-door openers and gate remotes
433.92 MHz Worldwide ISM Gates, garages, weather sensors, doorbells, cheap remotes
868.35 MHz Europe Newer gates, alarm sensors, smart-home devices
915 MHz North America ISM US sensors, some newer garage systems
i
433.92 is the "try this first" frequency When you don't know a device's channel, 433.92 MHz is the single best first guess worldwide. If nothing shows up, sweep with the Frequency Analyzer rather than guessing again.

Modulation presets

A preset tells the radio how to listen: which modulation, and how wide a slice of spectrum. The four stock presets, and when to reach for each. For the AM presets the number is roughly the receiver bandwidth in kHz; for the FM presets it's the FSK frequency deviation from the centre frequency. FM238 is about 2.38 kHz deviation; FM476 about 47.6 kHz. Both use about 270 kHz receive bandwidth.

Preset Type Feel When to use
AM650 AM / OOK Wide The default. Fits most fixed-code remotes, gates and garages.
AM270 AM / OOK Narrow Cleaner on weak or narrow OOK signals when AM650 is noisy.
FM238 FM / FSK Narrow FSK devices with small frequency shift — some 868 MHz gear.
FM476 FM / FSK Wide FSK devices with a larger shift; try when FM238 under-reads.

In a saved .sub file, the preset appears as a FuriHalSubGhzPreset…Async token on the Preset: line — for example AM650 is written FuriHalSubGhzPresetOok650Async. Official firmware and compatible forks can load custom presets from an SD-card settings file. If a signal won't decode, changing the preset is the second thing to try after confirming the frequency.

The Flipper's Sub-GHz radio

Key facts about the hardware doing the listening:

CC1101
Texas Instruments transceiver chip
300–348
MHz · band 1
387–464
MHz · band 2
779–928
MHz · band 3

The CC1101 doesn't cover the gaps between those three bands, which is why a handful of frequencies simply can't be tuned by the internal radio. An external CC1101 module can extend performance, and Momentum exposes extended-frequency options — but "the firmware lets you tune it" is never the same as "it's legal to transmit there where you live."

Protocol families the Flipper decodes

Recognised out of the box (a partial list — Momentum adds more). When the Read screen names one of these, it understood the signal's grammar.

Fixed code replayable

Princeton CAME Nice FLO Holtek Linear Chamberlain (older) Hormann HSM Ansonic Hollarm

These send the same key each press. Nice FLO is a classic 12-bit fixed code.

Rolling code shows a counter

KeeLoq Nice FloR-S Security+ 2.0 Security+ (1.0) CAME Atomo FAAC SLH Somfy Telis

The Read screen shows a counter (Cnt) that increments each press. A capture is a spent, one-time code — replay generally does nothing.

i
FLO vs FloR-S Nice's naming trips people up: Nice FLO is fixed code; Nice FloR-S is the rolling-code family. One letter, entirely different behaviour. See the case studies for the classic gate mystery.

.sub file fields, and RAW

A saved capture is a small plain-text .sub file. When the Flipper recognised the protocol, it stores the decoded key and these fields:

Field Example Meaning
Filetype Flipper SubGhz Key File Marks a decoded-key capture.
Version 1 File-format version.
Frequency 433920000 Frequency in hertz (433.92 MHz).
Preset FuriHalSubGhzPresetOok650Async Modulation preset used (here, AM650).
Protocol Princeton The decoded protocol family.
Bit 24 How many bits the key contains.
Key 00 00 00 00 00 8C 5A 3B The decoded code itself, as bytes.
TE 400 The base timing element, in microseconds.

When the Flipper can't name the protocol, you capture with Read RAW instead. A RAW file uses Filetype: Flipper SubGhz RAW File and stores RAW_Data: lines — long runs of alternating positive and negative numbers, each a duration in microseconds (positive = signal on, negative = off). It's a faithful recording of the pulses rather than a decoded message, so it's bigger and less portable, but it captures signals the decoders don't understand. Full walkthrough in Module 5.

RFID & NFC quick facts

Two separate worlds, at two very different frequencies:

Family Frequency Common types Notes
LF RFID 125 kHz EM4100 (EM-Marin), HID Prox (H10301), Indala Simple ID tags — often just a number. Writable T5577 blanks can emulate many of them.
HF NFC 13.56 MHz Mifare Classic / Ultralight, NTAG, DESFire ISO 14443 smartcards. Can hold data and run crypto; many are far harder to clone than LF tags.
!
Bank cards are read-only curiosities here The Flipper can read only limited public data from EMV bank cards, and access systems often check far more than the number you can read. See the ground rules on access badges before you go near a credential you don't administer.

Wi-Fi Devboard: three software layers

The official accessory uses an ESP32-S2: 2.4 GHz Wi-Fi, no Bluetooth, 5 GHz or 6 GHz radio. Choose handheld firmware, the companion .fap and the board image separately.

Task Board software / connection
Breakpoints and stepping Official Black Magic via USB/Wi-Fi, or CMSIS-DAP via USB; SWD to the Flipper
Read Flipper logs Official board firmware, UART log port via USB, 230400 baud
Marauder control Matching board image and companion; UART bridge CLI documented at 115200 baud
Restore official board firmware Board USB → hold BOOT → tap RESET → release BOOT → python -m ufbt devboard_flash in an environment with uFBT

Read Module 18 for procedures, prerequisites, board limits and primary sources.

Unit cheats

Wavelength

λ = c / f

Speed of light c = 299,792,458 m/s. Divide by frequency in hertz to get wavelength in metres. A quarter-wave antenna is λ / 4.

433.92 MHz → ~69.1 cm (quarter-wave ~17.3 cm). Higher frequency → shorter wave → shorter antenna.

Power: dBm ↔ mW

0 dBm = 1 mW
+3 dB ≈ ×2 (so 3 dBm ≈ 2 mW)
+10 dB = ×10 (so 10 dBm = 10 mW, 20 dBm = 100 mW)
−3 dB ≈ ½, −10 dB = ÷10

Decibels are a ratio, so they add where milliwatts multiply. That's why signal budgets are done in dB.

Play with both conversions live in the RF Calculator.

Trusted resources

Primary sources worth going to directly. External links open in a new tab.

Flipper Zero docs

The official documentation — the authority on menus, file formats and features.

docs.flipper.net
docs.flipper.net/sub-ghz
docs.flipper.net/nfc

Momentum firmware

The custom firmware this course assumes, with its own docs and settings.

momentum-fw.dev

FCC rules (US)

Title 47 — the US regulations covering radio devices and transmission.

fcc.gov · Title 47

Know your local law

Outside the US, find your own regulator — Ofcom (UK), ISED (Canada), ACMA (Australia), or your national equivalent. See the ground rules for the list.

Verify presets and radio settings in the official reading guide. For use in Romania, start with ANCOM and the Romanian course guide.