Gear / Radio & RF / CC1101 module
RF

CC1101 module

A bare 433/868 MHz transceiver that transmits as well as receives. Wire it to a host and drive it with rfcat.
5–10€ Radio & RF

What it does

The CC1101 is an inexpensive sub-1 GHz transceiver. On a small breakout it both transmits and receives on the 433/868 MHz bands used by garage remotes, wireless sensors, and simple actuators. It is a bare radio: you drive it over SPI from a host microcontroller (or a USB dongle like a YARD Stick One) and control it with rfcat or similar, which makes it the cheapest way to get a transmit-capable radio onto the bench next to a receive-only SDR.

Use cases

01
Capture and replay a fixed-code remote

Record a legitimate transmission and resend the exact same bits to reproduce the action.

02
Fuzz a rolling-code implementation

Probe how a receiver reacts to out-of-sequence or malformed frames.

03
Prototype a custom protocol

Bit-bang your own framing on top of the raw radio for a device that doesn't use an off-the-shelf standard.

How you use it

Drive the module from a host that speaks to it (rfcat over a compatible dongle), then capture and replay:

rfcat -r                      # open an interactive rfcat session
# set frequency, modulation, and data rate to match the target
# capture, then transmit the same bytes back to replay

Wiring

Host (MCU / dongle) CC1101 module 3V3 GND MOSI SCK MISO CSN GDO0 GDO2 VCC GND MOSI SCK MISO CSN GDO0 GDO2
Straight SPI wiring: MOSI/SCK/MISO/CSN plus the two GDO interrupt lines. Power the module at 3.3V only.
Variants & pitfalls

It is only a radio. A bare CC1101 does nothing on its own; it needs a host microcontroller or a dongle plus firmware to clock the SPI bus and run the protocol.

Fixed-code vs rolling-code. A pure replay only works against fixed-code remotes; rolling-code systems invalidate a captured frame after one legitimate use.

Regional bands. 433 MHz and 868 MHz allocations and power limits vary by region - check what's legal to transmit on where you are.