Your learning path · Romania

From first signal to independent work.

Nineteen modules. A suggested twelve-week core route, plus a Wi-Fi hardware extension. Learn the mechanisms, test your understanding, and build evidence you can explain.

Continue where you left off

0 · Meet your radio lab →

0 / 19 modules marked complete. Your completion marks are self-reported, not certification.

Your first session

Read the Romanian lab guide, then the plain-language primer. Start with official firmware; Momentum is optional.
Complete Module 0. Record your version, region, and a scope note in the notebook.
Use the browser simulators while gathering a suitable lab target. They generate synthetic data and do not connect to a radio.

Build the lab in stages

Start with what you have

A browser; then your Flipper, microSD card, USB cable, and your own IR remote/TV. For RF practice, use a locally compliant fixed-code training chime whose radio conditions you can verify.

Add when the lesson needs it

Unenrolled EM4100/T5577 and NFC practice tags; a standalone training reader; a breadboard, LED, 1 kΩ resistor and jumpers. iButton is optional. For Module 18, add the official Wi-Fi Devboard and your own 2.4 GHz test AP. The core course needs no external radio.

The route

Budget roughly 2–4 hours per week, including practice and review. The weeks are a suggested order, not a deadline. Infrared (Module 11) also works as an early first hardware exercise after setup.

Weeks 0–2 · Foundation

Read a signal

Setup, frequency, modulation, protocols and a controlled fixed-code replay.

Weeks 3–6 · Reason

Understand the limits

RAW, rolling codes, RFID/NFC, firmware literacy, troubleshooting and your first atlas.

Weeks 7–10 · Build

Use every interface deliberately

IR, GPIO, USB/BLE, iButton/U2F, and a small app you compile and inspect.

Weeks 11–12 · Demonstrate

Test a security claim

Threat models, controlled experiments, negative controls, mitigations and a reproducible portfolio.

Extension · After 8, 12 & 15

Take the Wi-Fi path

Official board hardware, firmware choices, debugging, recovery and repeatable AP measurements. Allow 3–4 extra sessions.

A session that makes knowledge stick

Retrieve (5 minutes): explain yesterday’s mechanism without notes. Notice the gaps.
Predict: write down what the lab should do and why. Keep scope and equipment explicit.
Practise (20–40 minutes): perform a short controlled experiment. Change one factor at a time.
Explain: answer the quiz, read its reasoning, and log one observation and one uncertainty.
Revisit: review after a day, then again several days later. Repeat the practical skill on another authorized training target.

What proficiency looks like

Foundation: distinguish frequency, modulation, encoding and protocol; describe a capture’s limits.
Practitioner: read a pinout, make a controlled experiment, classify a training tag, and recover a known setup.
Independent work: compile a small app, test a bounded security claim, and explain a failure with evidence.
Mastery practice: reproduce results, challenge your own conclusions, teach someone else, and keep learning.

The course teaches dual-use mechanisms and defenses. Legal boundaries are stated separately from technical capabilities. Your final portfolio matters more than a row of badges.