sub-1 ghz toolkit
An ESP32 + CC1101 sub-1 GHz toolkit: sniff and analyze traffic, capture/replay your own remotes, across 2-FSK / GFSK / ASK-OOK / 4-FSK / MSK.
Packet sniffer & frequency analyzer
Point it at a channel and watch RF packets come in with live RSSI and link-quality readout, or sweep a band to find which channels actually have traffic on them before you commit to listening on one. Both run straight from the serial console — no companion app needed.
- sniffer
- live packet log with RSSI and link quality
- analyzer
- channel-activity sweep across the sub-1 GHz range
- console
- plain serial commands — USB, or the CLI/web tools below
Record & replay
Two capture paths, depending on what you're working with. recraw /
playraw grab the raw RF samples bit for bit — useful while you're still
figuring out what a signal is. Once you know a transmitter sends a simple fixed code (most
remotes, many sensors), recsig / playsig capture and reproduce
just that code.
- raw
recraw/playraw— full-fidelity sample capture- fixed-code
recsig/playsig— captured code, replayed on demand- use on
- your own remotes, sensors and test gear
Radio configuration
The CC1101's radio parameters are exposed directly: pick the modulation that matches what you're working with and tune frequency, data rate and deviation to match.
- modulation
- 2-FSK · GFSK · ASK/OOK · 4-FSK · MSK
- range
- sub-1 GHz ISM — whatever the antenna and local allocation allow
- tuned by
- frequency, data rate, deviation — set per session
Jamming & brute-force
jam transmits continuously on a channel; brute steps through
timing/code space against a receiver. Both are active, transmitting modes — unlike
everything above, they put RF energy on air deliberately and can affect other people's
equipment. Read the box below before you use either one.
- jam
- continuous transmission on a chosen channel
- brute
- timing-based code brute-force against a receiver
- status
- transmit modes — see the notice below before use
Flash the firmware
Three ways to get SubRabbit onto the board, from quickest to most hands-on.
Web flasher — no install
Open wrait8.github.io/WFlasher in Chrome or Edge, plug the board in over USB, pick the firmware and flash straight from the page via Web Serial.
CLI tool
Run Serial.py from the repo's /Serial folder for an
interactive or scripted flash from the command line.
Source + Arduino IDE
Clone the repo, open SubRabbit.ino in the Arduino IDE, and upload it
yourself — the route to take if you're modifying the firmware.
PCB & breadboard
Build it on the project's own PCB, or wire an ESP32 dev board to a CC1101 module on a breadboard — both are documented in the repo.
- PCB
- ESP32 + CC1101, USB, SMA antenna — schematics/Gerber/BOM in
/PCB - breadboard
- ESP32 dev board + CC1101 breakout — wiring diagram in the wiki
Most of this firmware receives only — sniffing and capture don't put anything on
air. jam and brute are different: they transmit, and radio
transmission is regulated by law almost everywhere, not just by etiquette.
Jamming — deliberately interfering with radio spectrum — is illegal in most countries, full stop, including on license-free ISM bands, regardless of your intent. There isn't a "responsible use" version of continuous jamming against anything other than a shielded test setup you own.
Brute-forcing a code against a receiver you don't own — a gate, a garage door, a
car, an alarm — is unauthorized access in most jurisdictions, separate from any radio-law
violation. Use jam and brute only inside a shielded enclosure or
against your own equipment that you're explicitly allowed to test.
Everything else — sniffing, capture, replay — still only ever acts on your own devices and remotes, or equipment you're otherwise authorized to test. Check your country's radio regulations (FCC Part 15 in the US, ETSI in the EU, or your local equivalent) before you transmit anything.