Flipper Add-on SubGhz.
Intercept and replay Sub-GHz signals, and sniff LoRa traffic — a shield add-on for your Flipper Zero, for authorized security testing.
$35.00
In stock
- Flipper Zero
- Connects via: stacks on the Flipper Zero's GPIO header as a shield — check there are no gaps between the two
- Firmware: the latest official Flipper Zero firmware, with Sub-GHz Mode set to 'external' for the CC1101 — no custom firmware needed
- Electronic Cats LoRa Relay App (Flipper Zero app)
In the box
Not included
You also need
- Designed and built in Aguascalientes, Mexico
- Hardware CERN-OHL v1.2 · firmware GPL-3.0
What is the Flipper SubGhz Add-On?
The Flipper SubGhz Add-On is a shield for the Flipper Zero that intercepts, reads, emulates and relays radio signals below 1 GHz. It stacks directly onto the Flipper’s GPIO header and adds two radios to the Flipper’s own: a CC1101 sub-1 GHz transceiver covering the 300–348, 387–464 and 779–928 MHz bands with up to +12 dBm of output, and a Semtech SX1262 LoRa transceiver with continuous 150–960 MHz coverage and up to +22 dBm, compliant with the LoRaWAN physical layer. The basic Sub-GHz functions work on the latest official Flipper firmware with Sub-GHz Mode set to external; LoRa sniffing, saving and relaying run through the Electronic Cats LoRa Relay App. The hardware is published under the CERN Open Hardware License, and the tool is meant for signals and systems you are authorized to test.
Sniff and log LoRa traffic on your Flipper Zero
Test a keyless-entry system for relay-attack exposure — with authorization
Start in 10 minutes
- Update your Flipper Zero to the latest official firmware with qFlipper — custom firmware such as Unleashed is no longer required.
- Install the Electronic Cats LoRa Relay App (.fap file) onto the Flipper’s SD card — for example in a dedicated “Electronic Cats” folder inside the Apps folder.
- Create a folder named “lora” at SD Card/apps_data/ on the Flipper, so sniffing sessions get recorded to a data.log file.
- Attach the SubGhz Add-On shield to the Flipper Zero, checking there are no gaps between the shield and the Flipper.
- Open the LoRa Relay App, use its Sniffer feature to capture LoRa messages, and press the center D-pad button to start saving the session.
| Weight | 0.015 g |
|---|---|
| Dimensions | 18 × 12.5 × 2 cm |
| Radio chip | CC1101 (sub-1 GHz transceiver) |
| Frequency bands | 300–348 MHz, 387–464 MHz, 779–928 MHz |
| Data rate | Up to 600 kbps (programmable) |
| RF sensitivity | -116 dBm at 433 MHz / 0.6 kBaud, -112 dBm at 868 MHz / 1.2 kBaud |
| Current consumption | 14.7 mA at 868 MHz / 1.2 kBaud |
| Output power | Up to +12 dBm (programmable, all supported bands) |
| Mounting | Flipper Zero shield / add-on board (stacks directly on top) |
| LoRa chip | Semtech SX1262 (Long Range, Low Power, half-duplex Sub-GHz/LoRa transceiver), 150–960 MHz continuous coverage, up to +22 dBm output — compliant with the LoRaWAN physical layer |
| Firmware compatibility | Official Flipper Zero firmware (latest version) — custom firmware such as Unleashed is no longer required |
| Hardware license | CERN-OHL (CERN Open Hardware License) |
| Hardware version | V1.1 |
| Requires | Flipper Zero device (sold separately) |
