CC1101
A Texas Instruments sub-1 GHz transceiver chip, SPI-controlled and register-configured, that both receives and transmits OOK/ASK and FSK packets, which is why it sits inside remotes, sensors, the YARD Stick One and the Flipper Zero.
The CC1101 is a low-power sub-1 GHz RF transceiver from Texas Instruments. It is not a board you buy as such, it is a chip that turns up everywhere in the sub-GHz world: inside cheap breakout modules, inside key fobs and sensors, inside the YARD Stick One, and inside a Wiki: flipper-zero. Unlike a Wiki: rtl-sdr it transmits as well as receives, which is exactly why it matters for replay and injection work.
What it is
The chip is driven over SPI by a host microcontroller. You write a bank of configuration registers that fix the carrier frequency, the modulation, the data rate, the deviation and the receive bandwidth, then the chip's packet engine handles preamble, sync word, address filtering, CRC and data whitening for you. Data moves in and out through a small FIFO. The supported bands cover roughly 300-348, 387-464 and 779-928 MHz, which is where the ISM sub-GHz traffic lives: 315 MHz, 433.92 MHz, 868 MHz, 915 MHz. Supported modulations include OOK/ASK, 2-FSK, GFSK, 4-FSK and MSK, which covers the overwhelming majority of simple remotes and sensors.
Why it matters
Sub-GHz attack work needs transmit. A dongle that only listens proves a signal exists; capturing a garage remote and sending it back requires a transmitter. The CC1101 gives that in a chip that costs a few euros and needs no flowgraph, no IQ file and no host DSP. It works at packet level, so once the parameters are right you are handling bytes rather than samples, which makes capture, modification and replay far simpler to script than the equivalent SDR pipeline.
Where you meet it
- Bare modules (the common E07 and generic CC1101 breakouts) wired over SPI to an ESP32, an Arduino or a Raspberry Pi.
- YARD Stick One, built on the CC1111 (a CC1101 radio plus an 8051 core) and driven from Python through
rfcat. - Flipper Zero, whose entire sub-GHz side is a CC1101.
With rfcat the flow is: set the radio up, then transmit or receive raw bytes.
from rflib import *
d = RfCat()
d.setFreq(433920000)
d.setMdmModulation(MOD_ASK_OOK)
d.setMdmDRate(4800)
d.setMaxPower()
d.RFxmit(b'\xaa\xaa\xaa...') # bytes you captured earlier
Pitfalls
- It is not a spectrum analyzer. The CC1101 only demodulates what you configured it to expect. If you do not already know the frequency, modulation and bit rate, start with an Wiki: rtl-sdr and a waterfall, work the parameters out there, then move to the CC1101 to transmit.
- Rolling codes. KeeLoq-style remotes and most modern vehicles change the payload every press. A perfect byte-for-byte replay of yesterday's frame does nothing. Capture and replay only works against static-code devices.
- Antenna and band. An 868 MHz antenna on 315 MHz radiates badly. Match the antenna to the band or your range collapses and you blame the software.
- Data rate and deviation are as important as frequency. Being on the right frequency with the wrong data rate gives you silence or noise, not partial reception.
- Transmitting is regulated. Sub-GHz ISM bands carry power and duty-cycle limits, and transmitting on someone else's device is not a lab exercise. Keep it on your own gear.