---

8.1 About this Volume

This volume covers the three radios Bruce uses below and beside the 2.4 GHz band: the CC1101 sub-GHz transceiver (nominally 300–928 MHz, the 433/315/868/915 MHz license-free pockets being the ones that matter in practice), the infrared transmitter and receiver, and the FM broadcast radio on boards that carry an FM chip. These three are grouped together because they share a common character — each is an external or semi-external radio capability that only a subset of boards carry, each is driven by Bruce through a configurable pin/module abstraction, and each sits at a very different point on the legal spectrum, from the essentially-harmless (consumer IR) to the categorically-illegal-to-transmit (broadband jamming).

As with the rest of this deep dive, the treatment is category-level. This is offensive-security firmware; the volume describes the class of operation each subsystem performs and the physics and law that bound it, and it does not reproduce the on-device menu tree or give step-by-step procedures for capturing and replaying a specific remote, cloning a specific fob, or jamming a specific band. An engineer should finish this volume understanding exactly what a CC1101-equipped Bruce board can do, why a replay attack works on some remotes and not others, and precisely where the legal line falls on transmit — which is the single most consequential fact in the volume.

The FM and jammer discussions each carry an honesty note. Bruce’s menus list FM-spectrum and traffic-announcement-hijack entries that are not yet functional, and the jammers, while real and working, are illegal to transmit outside a shielded environment. Both are flagged plainly rather than described as ordinary features.

8.2 Three radios, three legal worlds

Before any capability detail, an engineer should fix the three legal worlds these radios live in, because the firmware presents them side by side in one menu structure and that adjacency hides a gulf in what is lawful.

 RADIO BAND LEGAL CHARACTER OF TRANSMIT
 ───── ──── ──────────────────────────
 IR ~38 kHz optical essentially unregulated; line-of-sight,
 room-scale, consumer remotes
 CC1101 sub-GHz 300–928 MHz license-free ISM pockets exist (433/868
 (433/315/868/915) EU, 315/915 US) BUT device-replay /
 jamming against others' systems is
 unauthorized-access / illegal-interference
 FM broadcast ~88–108 MHz a LICENSED broadcast band; transmitting
 into it without a licence is illegal in
 essentially every jurisdiction

Infrared is the benign end: it is optical, line-of-sight, room-scale, and operating a universal remote is something consumer products do by design. The CC1101 band is the complicated middle: the ISM pockets (433 MHz and 868 MHz in Europe, 315 MHz and 915 MHz in the Americas) are license-free for compliant low-power devices, but capturing and replaying someone else’s garage-door or gate code, or jamming the band, is not a compliant use — it is unauthorized interaction with another person’s system or deliberate interference, and it is treated accordingly. FM broadcast is the strict end: 88–108 MHz is a licensed broadcast service, and transmitting into it without a broadcast licence is an offence almost everywhere regardless of power, which is why the FM section below is framed around that fact.

8.3 The CC1101 sub-GHz transceiver — what it is and how Bruce wires it

The Texas Instruments CC1101 is a low-cost sub-GHz transceiver covering roughly 300–348 MHz, 387–464 MHz, and 779–928 MHz, with configurable modulation (the relevant modes here being OOK/ASK — on-off keying and amplitude-shift keying, the schemes most cheap remotes use — plus FSK/GFSK). It is the de-facto standard sub-GHz front-end for this class of tool: the Flipper Zero uses a CC1101, the iCopy-X and countless RF projects use it, and Bruce drives it over SPI exactly as those do. Its relevance is that the 433/315/868/915 MHz bands are where the low-power remote-control world lives — garage doors, gates, car fobs, wireless doorbells, weather-station sensors, remote switches, and a long tail of OOK/ASK devices that transmit short, often-unencrypted, often-repeating codes.

On Bruce the CC1101 is an external module on most boards and on-board on a few. The LILYGO T-Embed CC1101 and T-Embed CC1101 Plus integrate it, which is why they are the reference platforms for this volume; Bruce’s own RF REAPER PCB carries a high-output E07-433M20S CC1101 module (see Vol 3); Bruce PCB V2 and the Pirata PCB carry it; and any board with free SPI pins can have a bare CC1101 wired to it. The capability matrix in Vol 2 has a dedicated CC1101 column precisely because, as with the nRF24, the feature exists only where the chip is present.

 ESP32 / S3 ──SPI──► CC1101 ──► antenna (band-matched!)
 ┌──────────┐ ┌──────┐
 │ Bruce │ CSN │ 300– │ 433 MHz antenna ≠ 915 MHz antenna;
 │ RF menu │ SCK │ 928 │ a mismatched whip cripples range.
 │ + bruce │ MOSI │ MHz │ RF REAPER ships a matched module;
 │.conf pin│ MISO │ OOK/ │ a bare CC1101 needs the right whip
 │ config │ GDO0/2 │ ASK │ for the band in use.
 └──────────┘ └──────┘

The pin assignment is not fixed: Bruce exposes an RF config that lets the operator set the TX/RX pins, select the module, and choose the operating frequency, so the same firmware drives a CC1101 wherever it happens to be wired. This is the HAL philosophy of Vol 4 applied to a radio — the capability is compiled in where the board declares it, and the runtime pin map is set in configuration rather than hard-coded. The practical gotcha an RF engineer will anticipate is the antenna: a 433 MHz operation needs a 433 MHz-matched antenna, a 915 MHz operation a 915 MHz one, and the integrated boards ship matched hardware while a bare-wired CC1101 is only as good as the whip bolted to it.

A second practical consideration is output power and module quality, because not all CC1101 wirings are equal. The RF REAPER’s E07-433M20S is a 20 dBm (100 mW) module — a deliberately high-output part that gives the RF REAPER meaningfully greater range than a bare CC1101 breakout driven at the chip’s default power, and that is part of why Vol 3 treats the RF REAPER as the project’s flagship RF board. Higher output cuts both ways for the engineer: it improves legitimate bench range and receiver sensitivity, and it also raises the stakes on every transmit feature, because a 100 mW jammer or replay reaches much further than a 10 dBm one and is correspondingly more likely to affect a third party. The power budget is therefore not just a performance number; it is part of the legal-exposure calculation of §5, and the higher-output boards demand more caution on transmit, not less. The frequency, modulation, and bandwidth the operator configures all interact with the module’s capabilities, and a mismatch — asking a 433-only module to work at 868, or driving a narrow-band configuration against a wideband signal — simply fails to capture or transmit correctly, which is the most common cause of a “why won’t it copy this remote” support question.

8.4 Sub-GHz capabilities — capture, replay, payloads, spectrum

Bruce’s sub-GHz feature set groups into four classes, and describing them at the class level (rather than as a procedure) tells an engineer everything needed to understand reach and limits.

Capture / scan / copy. The receive side listens on a configured frequency (or scans the common OOK frequencies to find where a transmitter is active) and records the demodulated bitstream of whatever it hears. For the large population of simple fixed-code OOK remotes — cheap wireless doorbells, basic remote switches, older garage and gate remotes — this captured bitstream is the code, in full. This is the foundation of the replay class below. The scan function’s job is to find the active frequency; the capture function’s job is to record the signal there.

Replay. Replay re-transmits a captured signal. Against a fixed-code device — one that sends the same code every time — replay is simply equivalent to pressing the original remote: the receiver cannot distinguish the replay from the original, and the gate opens. This is the canonical demonstration of why fixed-code sub-GHz security is no security at all. Against a rolling-code device — one that uses a synchronized counter and cryptographic hop (KeeLoq and its successors, as used by every modern reputable garage/car remote) — a naive replay fails, because the captured code is single-use and the receiver has already advanced past it. An engineer must hold this distinction: Bruce’s replay is potent against legacy fixed-code hardware and essentially useless against correctly-implemented rolling-code hardware, and the real-world security of a given target is entirely a function of which camp it falls in.

Custom payloads. Beyond replaying captured signals, Bruce can transmit constructed sub-GHz payloads — a specified frequency, modulation, and bit pattern — which is the general-purpose “send this exact OOK/ASK waveform” capability. This is what makes the firmware a sub-GHz transmitter rather than only a copier, and it is the tool for legitimate bench work (testing one’s own receiver, reproducing a documented protocol for analysis) as readily as for the replay class.

Spectrum view. A receive-only sweep that reads signal energy across a configured range and displays it, giving a live picture of sub-GHz activity — the direct analogue of the nRF24 2.4 GHz spectrum view in Vol 7. It is benign, diagnostic, and the one sub-GHz feature usable freely on a bench; it identifies which frequency a device transmits on and how busy a band is, which is exactly the reconnaissance step that precedes a capture.

Table 1 — 4. Sub-GHz capabilities — capture, replay, payloads, spectrum

Sub-GHz class	Direction	Works against…	Legal character
Spectrum view	RX only	— (diagnostic)	Benign; bench-free
Capture / scan / copy	RX only	Any OOK/ASK emitter	Benign reception; use of capture is the question
Replay	TX	Fixed-code devices (not rolling-code)	Unauthorized if against others’ systems
Custom payload	TX	Anything on a chosen freq/mod	Unauthorized / interference if misused

Callout — capture is passive, replay is not. Recording a signal out of the air is reception. Re-transmitting it to operate someone else’s gate, fob, or device is an active, unauthorized interaction with their property and, depending on jurisdiction, both unauthorized-access and an RF-interference offence. The line between the harmless and the unlawful in this subsystem is the line between RX and TX, and between your own hardware and someone else’s.

Two technical limits temper the “replay defeats everything” impression a newcomer might form. First, even against fixed-code devices, a clean capture is not guaranteed: a weak signal, a mismatched antenna (§3), an incorrectly guessed frequency, or an unusual modulation can yield a partial or noisy bitstream that replays unreliably, and the spectrum-view-then-capture discipline exists precisely to get the frequency right before recording. Second, and more fundamentally, the entire fixed-code attack surface is shrinking: rolling-code has been standard in reputable automotive and garage hardware for two decades, and while a long tail of legacy fixed-code devices persists (cheap doorbells, old gate remotes, budget remote switches, some industrial fobs), an engineer should not generalize from “my test doorbell replayed perfectly” to “sub-GHz replay works on things that matter.” The devices for which it works are, increasingly, the ones for which security was never a design goal — which is a finding worth demonstrating, not a universal skeleton key.

8.5 The jammers — and the hard legal line on transmit

Bruce exposes sub-GHz jammers on the CC1101, in two flavours that are worth distinguishing technically even though they share one legal status. A full jammer transmits a continuous carrier (or saturating noise) on a target frequency, denying it completely for as long as it runs. An intermittent jammer transmits in bursts — pulsing the carrier — which can be more effective against certain receivers (by corrupting packets rather than merely raising the noise floor) and draws less power and less obvious continuous spectrum. The technical distinction is real; the legal distinction is nil.

 FULL JAMMER ████████████████████████ continuous carrier
 INTERMITTENT JAMMER ██░░██░░██░░██░░██░░██░░██ pulsed bursts
 │ │
 └── both deny the target frequency to every
 legitimate user in range — including
 safety and third-party systems.

The hard fact, stated once and plainly: transmitting a jammer is illegal in essentially every jurisdiction, with no low-power or short-duration exemption of the kind that covers ISM devices. In the United States the FCC treats signal jammers as prohibited devices under the Communications Act, with marketing, sale, and operation all unlawful and substantial penalties attached; the EU, UK, Canada, and Australia maintain equivalent prohibitions. The reason is structural: a jammer by definition causes harmful interference, which is the exact thing spectrum regulation exists to prevent, and because it is indiscriminate it cannot be scoped — a sub-GHz jammer run to “test my own gate” also knocks out every neighbour’s gate, car fob, weather sensor, and potentially safety-relevant device in range.

Callout — the only lawful venue is a shielded enclosure. A Bruce jammer may be operated for legitimate research only inside an RF-shielded test environment (a shielded box or a licensed anechoic/test facility) where no signal escapes to affect third parties. There is no configuration, power level, or duration that makes open-air jamming lawful. This is identical to the nRF24-jammer rule in Vol 7, and it is binding. Treat the jammer menu entries as bench-and-shield-only features, and treat any open-air use as an offence. The authorization and regional-RF rules in ../_shared/legal_ethics.md govern this absolutely.

8.6 Infrared — TV-B-Gone, learn and replay

Infrared is the least fraught subsystem in this volume and, not coincidentally, the one an engineer can experiment with most freely. IR remote control is an optical, line-of-sight, room-scale technology: a carrier around 38 kHz, modulated by one of a handful of well-documented protocol families (NEC, Sony SIRC, RC5/RC6, Samsung32, and relatives), driving consumer devices that are designed to be controlled by any remote in the room. There is no spectrum licence, no meaningful interference radius beyond the room, and no victim beyond “a television that changed channel.”

Bruce’s IR features are three:

TV-B-Gone. The famous Mitch Altman device/technique in firmware form: a stored sweep of the power-off codes for a large catalogue of television makes and models, transmitted in sequence, which turns off most TVs within line of sight. It is a party trick and a mild nuisance tool, universally understood as low-risk, and it is the canonical “my IR transmitter works” demonstration.

Learn (IR receiver). The receive side reads an incoming IR signal from a physical remote and decodes/records it, identifying the protocol family and the command. This is the capture half of a universal-remote workflow and is purely passive — reading the light a remote emits when a button is pressed.

Custom / replay. Having learned or been given a code, Bruce can transmit it — replaying a captured remote command or sending a constructed one in a known protocol (NEC, SIRC, Samsung32, RC5/RC6, and others the firmware supports). This is the transmit half of the universal-remote workflow, and because IR control is room-scale and benign, this is the feature in the whole deep dive with the lightest legal footprint: operating a universal remote is a thing consumer products do.

The only caveats worth stating are courtesy and context rather than law: switching off a venue’s displays or interfering with a presentation is obnoxious even where it is lawful, and a handful of specialized IR applications (some access and industrial controls) are not the consumer gear this is aimed at. But as a class, IR is the subsystem an engineer can learn and replay on their own equipment without touching the legal questions that dominate the RF and FM sections.

A word on the protocol families, because they are what make IR learn-and-replay reliable where sub-GHz capture is sometimes fiddly. Consumer IR is far more standardized than cheap sub-GHz RF: a handful of well-documented encodings — NEC (the most common, with a 32-bit address/command structure), Sony SIRC (12/15/20-bit variants), RC5 and RC6 (Philips), Samsung32, and a modest tail of others — cover the overwhelming majority of consumer remotes, and each has a published bit structure and carrier timing. When Bruce learns a remote, it is usually recognizing one of these families and recording the decoded command rather than a raw waveform, which is why IR replay is robust in a way that raw-OOK sub-GHz replay against an unknown protocol is not. The firmware also supports sending a custom IR command in a chosen family — specifying the protocol, address, and command directly — which is the tool for reproducing a documented remote without physically learning it first. For an engineer, the IR subsystem is the cleanest demonstration in the whole firmware of “well-standardized protocol → reliable capture and replay,” and it is a useful mental contrast with the sub-GHz world, where the lack of standardization is exactly what makes rolling-code security meaningful and fixed-code insecurity common.

8.7 FM broadcast — and what is not yet done

On boards that carry an FM radio chip, Bruce can broadcast on the FM band — transmit an audio signal on a chosen FM frequency so that an ordinary FM receiver tuned there plays it. The firmware’s FM menu distinguishes broadcasting on a standard frequency from broadcasting on a reserved one, and provides a stop control. The capability is real on FM-equipped hardware.

The legal frame here is the strictest in the volume and must lead the description. The 88–108 MHz FM band is a licensed broadcast service. Transmitting into it without a broadcast licence is an offence in essentially every jurisdiction, and unlike the ISM bands there is no license-free low-power pocket of consequence in most regimes (the micro-power exemptions that exist in some countries are narrow, and the “reserved frequency” option in the menu does not confer any legal right to use it). A Bruce FM broadcast is therefore a bench-and-shield feature in the same legal tier as the jammers for practical purposes: lawful to experiment with only where the signal does not reach a receiver outside your control.

The legitimate use that an engineer might actually have for this capability is narrow and worth naming so the feature is not mistaken for pure mischief: a very-low-power FM transmitter into a dummy load, or into an enclosure, is a valid way to test one’s own FM receivers, to characterize a receiver’s sensitivity and selectivity, or to study RDS behaviour on the bench. The “personal FM transmitter” product category (the kind used to pipe a phone’s audio to a car radio) exists under tightly-constrained micro-power rules in some jurisdictions, and where those rules genuinely apply they are measured in a few tens of nanowatts and a few metres — nothing like a general-purpose transmitter aimed at the band. Bruce’s FM broadcast is a capability, not a certified personal-FM-transmitter product, and treating it as the latter is how an operator ends up transmitting unlawfully. The safe mental model is: FM broadcast is for the shielded bench, full stop, and any open-air use is the operator’s legal exposure to own.

Callout — FM broadcast is unlicensed-transmission into a licensed band. The physics are trivial and the legality is not. Operate FM broadcast only into a dummy load or a shielded environment where no third-party receiver can pick it up. “I only used the reserved frequency” is not a defence; the band is licensed end to end.

What is not yet done. Bruce’s FM menu also lists FM spectrum and traffic-announcement (TA) hijack entries, and the brief for this deep dive — verified against the official project on 2026-10-16 — records these as not yet functional: present as menu entries, incomplete in the firmware as it ships. This volume reports them that way rather than as working features.The TA-hijack concept, were it completed, would exploit the Radio Data System (RDS) traffic-announcement flag that causes car radios to switch to a station carrying a traffic bulletin — a genuinely interesting and genuinely disruptive capability — but a menu entry is not a working implementation, and reporting it as one would be an error of exactly the kind this deep dive is careful to avoid (the Mousejack discussion in Vol 7 §7 makes the same point about the gap between a feature-dense menu and feature-complete firmware).

8.8 Configuration, pins and modules across boards

A recurring theme of this deep dive is that Bruce’s breadth comes from a hardware-abstraction model (Vol 4) rather than from per-board forks, and the RF/IR/FM subsystems are a clear illustration. Each of these radios is wired differently on different boards — a different CC1101 module on a different SPI bus, an IR LED on a different GPIO, an FM chip present or absent — and Bruce handles that with configuration rather than code changes.

Table 2 — 8. Configuration, pins and modules across boards

Subsystem	Config surface	Carried by (examples)
CC1101 sub-GHz	TX/RX pins, module select, frequency	T-Embed CC1101/Plus, RF REAPER, Bruce PCB V2, Pirata, bare-wired
NRF24 (see Vol 7)	SPI pins, module	RF REAPER, Bruce PCB V2, Pirata
IR TX / RX	IR pin config	Cardputer, StickS3, RF REAPER (IR TX/RX), many M5/LILYGO
FM broadcast	FM config	FM-equipped boards only (FM Radio column in Vol 2)

The RF config lets the operator set TX/RX pins, choose the module, and set frequency; the IR config sets the IR pin; and all of it is persisted in the runtime configuration (bruce.conf on SD/LittleFS, per Vol 4) so the settings survive reboots and travel with the board. This is why the same binary flashed to two differently-wired boards can drive the CC1101 correctly on both — the operator tells the firmware where the module is, rather than recompiling. The capability matrix in Vol 2 is the authoritative map of which board carries which of these radios; this volume describes what each radio does once it is present and configured.

An engineer’s practical takeaway: a board’s radio capability is a function of its hardware (the module must be physically present and on a usable bus), and its configuration is a function of bruce.conf and the on-device RF/IR/FM config menus. A board with no CC1101 has no sub-GHz capability no matter what the menu offers; a board with a CC1101 on non-default pins works once those pins are configured. The firmware’s menus are uniform across boards; the hardware behind them is not.

This uniform-menu / varied-hardware split is also why the Bruce user community produces so much board-specific wiring guidance, and why the RF REAPER (Vol 3) is valued precisely for removing the configuration burden: with the CC1101, nRF24, ST25R3916 NFC, IR, and GPS all integrated and pre-wired on one board, the operator does not hand-configure pin maps for each radio — the board config that ships with the firmware already describes them. For an engineer who wants to spend time on the RF work rather than on breadboarding and pin-map debugging, that integration is the RF REAPER’s main argument over flashing Bruce onto a generic board and wiring modules by hand. The generic-board path is cheaper and more flexible; the integrated-board path is faster to a working radio and less error-prone, and the choice between them is the recurring theme of the whole hardware story (Vols 2 and 3).

8.9 Summary and cross-references

Bruce’s sub-GHz, IR, and FM radios span the full legal spectrum of the firmware. The CC1101 delivers a complete sub-GHz toolkit — a benign spectrum view and passive capture, a replay capability that is devastating against legacy fixed-code devices and useless against correct rolling-code ones, a custom-payload transmitter, and full/intermittent jammers that are illegal to transmit outside a shielded enclosure. Infrared is the benign subsystem: TV-B-Gone, learn, and replay, all room-scale and lawful on one’s own gear. FM broadcast is real on FM-equipped boards but is unlicensed transmission into a licensed band and must be treated as bench-and-shield only, while the FM spectrum and TA-hijack menu entries are not-yet-functional stubs rather than working features.

For the 2.4 GHz radios — native BLE and the external nRF24, including the nRF24 jammer whose legal status mirrors the CC1101 jammer here — see Vol 7. For the hardware that carries these radios, especially the RF REAPER’s integrated CC1101/nRF24/IR complement, see Vol 3; for the HAL and bruce.conf configuration model that makes one binary drive many wirings, see Vol 4. The capability matrix mapping radios to boards is Vol 2. The Flipper Zero deep dive elsewhere in this hub covers the same CC1101-based sub-GHz and IR capabilities on different hardware and is the natural comparison point for an operator choosing between a Flipper and a CC1101-equipped Bruce board. And the binding legal framing for every transmit feature named here — replay, custom payload, jammer, and FM broadcast — is ../_shared/legal_ethics.md, which an operator must treat as a precondition to touching any of them.