M5 RF433

Capture, replay, and jam 433.92 MHz RF signals using the M5Stack RF433T/R Units — discrete transmitter and receiver modules wired to two GPIO pins. No SPI, no CC1101 needed. Accessed from Modules > M5 RF433. Compatible with Flipper Zero and Bruce .sub files at 433.92 MHz.

Hardware Setup

The M5 RF433T (transmitter) and M5 RF433R (receiver) are two separate single-pin modules. Each is connected to one GPIO. Both units run at a fixed 433.92 MHz (no frequency tuning).

Unit	Pin direction	Function
M5 RF433T	OUTPUT	ASK/OOK transmit data line
M5 RF433R	INPUT	squelched digital receive data line

Pinout (fixed per board)

The M5 RF433T/R uses a fixed pinout chosen at build time — there is no entry in Modules > Pin Setting for it. The intended wiring is the device's Grove port (M5 RF433T → SDA, M5 RF433R → SCL), which matches plugging in via a Hat-Y or Grove-W splitter.

Default	Pin
TX	M5RF433_TX_PIN if defined, else GROVE_SDA
RX	M5RF433_RX_PIN if defined, else GROVE_SCL

A board that needs to route the modules to different pins should define M5RF433_TX_PIN and/or M5RF433_RX_PIN in its firmware/boards/<board>/pins_arduino.h. Defining neither (and lacking GROVE_SDA/GROVE_SCL) makes the entry show M5 RF433 not supported and exit back to the Module menu.

Receive

Capture RF signals at 433.92 MHz from the M5 RF433R.

1. Select Receive from the menu
2. The device listens on the configured RX pin. The footer shows the current Receive Filter:
   • Filter: RAW (default) — capture both RCSwitch-decoded protocols and raw pulse streams that no protocol matched. Best for unknown remotes.
   • Filter: Code — only emit signals that decoded as one of the 23 known RCSwitch protocols; drops raw noise.
3. Toggle between RAW / Code live — footer label updates immediately. Setting is session-only.
   • 4-way devices (Cardputer, Cardputer ADV, DIY Smoochie, DIY Marauder, sticks in Encoder mode): press LEFT or RIGHT.
   • 2-way devices (M5StickS3, T-Display, T-Lora Pager, T-Embed CC1101, CYD touch, CoreS3, sticks in default mode): hold OK / PRESS for 500 ms.
4. Captured signals appear in the list with protocol details:
   • RcSwitch: 0xABCDEF P1 24b (hex value, protocol number, bit count)
   • RAW: RAW 120 pulses (raw pulse count)
5. Duplicate RcSwitch signals are automatically filtered
6. Select a captured signal to open the popup — Info / Replay / Save / Delete. Info opens a scrollable key:value detail view (frequency, preset, protocol, key, bit length, RAW pulse count); BACK from Info returns to the popup.
7. Saved files go to /unigeek/rf/ in .sub format (shared with Sub-GHz)
8. Up to 15 signals can be captured per session
9. Press BACK to stop receiving and return to the menu

Send

Browse and send .sub signal files from storage. The frequency stored in the file is ignored — the M5 RF433T can only transmit at 433.92 MHz, so 433-MHz files work as recorded and other-band files are still bit-banged at 433 MHz (useful for testing protocol/timing, not for cross-band replay).

1. Select Send from the menu
2. Browse from /unigeek/rf/ — navigate into subfolders
3. Tap a file to open the action menu:
   • Send — transmit the signal
   • Info — open the signal info view (BACK returns here)
   • Rename — rename the file
   • Delete — delete the file

Jammer

Transmit random pulses on the M5 RF433T to disrupt nearby 433 MHz receivers.

1. Select Jammer
2. The TX pin is bit-banged with random short pulses
3. Press BACK or PRESS to stop

Use only in environments you own or have explicit permission to test. Jamming RF signals is illegal in most jurisdictions.

File Format

M5 RF433 reuses the same .sub file format as Sub-GHz (Flipper Zero / Bruce compatible):

Filetype: SubGhz Signal File
Version 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok270Async
Protocol: RAW
RAW_Data: 1234 -567 890 -123 ...

For RcSwitch (decoded) signals:

Filetype: SubGhz Signal File
Version 1
Frequency: 433920000
Preset: 1
Protocol: RcSwitch
TE: 350
Bit: 24
Key: 0xABCDEF

Files captured with the Sub-GHz (CC1101) module at 433 MHz can be sent directly from M5 RF433 and vice-versa.

KeeLoq auto-decode

KeeLoq decode and Replay +1 are intended for testing remotes, gates, and barriers you own or have explicit written permission to test. Running rolling-code bypass against third-party vehicles, garages, or property is illegal in most jurisdictions and prosecuted separately from passive capture (often felony-tier). See Sub-GHz (CC1101) for the scope of what Replay +1 can and can't bypass.

Captures decoded as RCSwitch protocol 23 (KeeLoq) are automatically run through every manufacturer key in /unigeek/mfcodes. When a key matches, the Signal Info view shows Manufacturer / Serial / Button / Counter / Fix / Hop instead of an opaque Key. Tapping a captured KeeLoq with manufacturer identified opens an extra Replay +1 option that advances the counter and re-encrypts so the receiver's rolling-code window accepts the frame.

[!warning] Replay +1 will likely desync the original remote. Advancing the receiver's counter leaves the real fob behind its sync window — it will stop working until you walk it forward (typically 2–8 presses in a row) or, on stricter receivers, re-pair it. Don't run it against a gate you actually need to use unless you're ready to resync afterwards.

Same format and behavior as the Sub-GHz module — see Sub-GHz (CC1101) for the keystore file format, the Mfcodes menu row, and the limits of counter-step replay.

The Mfcodes row at the bottom of the M5 RF433 menu shows N keys when loaded or not loaded otherwise; tap to reload after editing the file.

M5 RF433 vs Sub-GHz (CC1101)

	M5 RF433	Sub-GHz (CC1101)
Hardware	2× single-pin GPIO modules	SPI transceiver chip
Frequency	fixed 433.92 MHz	tunable 280–928 MHz
Modulation	ASK/OOK only	ASK/OOK + FSK/GFSK/MSK
Detect Freq scan	not available (fixed freq)	RSSI sweep across 40 bands
Range	shorter (low-power discrete modules)	longer (configurable PA up to +12 dBm)
Use case	quick 433 MHz capture/replay where SPI isn't free	full Sub-GHz workbench

Supported Protocols

ASK/OOK signals common in consumer 433 MHz remotes:

• Garage door openers (Princeton / fixed code)
• Wireless doorbells and weather sensors
• Power outlet remote controls
• Gate and barrier remotes
• Generic RCSwitch-compatible protocols (1–23 in the built-in protocol table)

Rolling-code key fobs can be captured but replay will not work because of code rotation.

Achievements

Shares the RF Listener / RF Transmitter / RF Archive / RF Collector / RF Library / Frequency Disruptor achievements with the Sub-GHz module — any RF receive/send/save counts toward both.