CASE 05b
Sub-GHz RF
Sub-GHz signal capture & blind protocol decoder
Complete sub-GHz capture and analysis pipeline around an RP2040 + CC1101 dongle — the RP2040's PIO state machine handles precise edge timestamping at microsecond resolution directly in hardware, offloading the CC1101's GDO0 output without CPU interrupt jitter. From raw edge timings through blind protocol detection and bit recovery, with no prior knowledge of the target device. The pipeline classifies encoding automatically: PWM (EV1527/PT2262), PPM (car fobs), or NRZ/Manchester (FSK). A fingerprinter assesses rolling-code probability across multiple presses and generates an annotated bit overlay aligned to the waveform.
A custom capture format (ztcap) preserves signed-microsecond edge timings. Because the CC1101 demodulates internally and the original RF waveform is gone before the host sees anything, a synthesis tool reconstructs IQ files URH can analyse. A standalone SDR probe tool (RTL-SDR) characterises unknown remotes before the CC1101 is configured — solving the blind-tuning problem that makes sub-GHz capture unreliable without prior signal characterisation.
Capture hardware
RP2040 (PIO edge timestamping) + CC1101 sub-GHz transceiver, RTL-SDR (SDR probe path)
Protocols decoded
EV1527/PT2262 PWM, PPM car fobs, NRZ/Manchester FSK, KeeLoq rolling code detection
Frequencies
300–928 MHz; presets for 315, 345, 390, 433, 434, 868, 915 MHz ISM bands
Stack
Python (no framework) · numpy · WebSocket (hand-rolled RFC 6455) · Canvas waveform renderer
Test coverage
Signal/noise discriminator, protocol classifier, fingerprinter, WebSocket framing, dongle protocol — all on synthetic data, no hardware required
RP2040PIOCC1101rolling-code detectionRTL-SDROOK/FSKKeeLoq
Capture shown is a real car fob transmission decoded as a 78-bit KeeLoq rolling code — replay-resistant by design; the receiver invalidates each code on use. No fixed-code remotes or replayable signals are shown.
