Capturing and Replaying Signals

A replay attack is the simplest and most common RF weakness: capture a legitimate transmission, then retransmit it later to reproduce its effect. No decryption is required if the receiver accepts the same signal twice.

This works against any device whose command is a fixed, static transmission:

• Cheap garage door openers.
• Basic car key fobs without rolling codes.
• Wireless doorbells, alarm sensors, and remote outlets.
• Some industrial remote controls for cranes and gates.

If a captured signal still works minutes or days later, the system is vulnerable by design.

Before capturing, identify where the device transmits. Most consumer remotes live in ISM bands: 315 MHz (North America), 433.92 MHz (Europe and much of the world), 868 MHz, and 915 MHz.

Tune an RTL-SDR across these bands, press the remote, and watch the waterfall for a burst of energy. The FCC ID printed on a device often reveals its exact operating frequency through public regulatory filings.

Once you know the frequency, record raw I/Q samples while the device transmits. Capture a clean, isolated burst so the signal is easy to analyze and replay.

A receive-only RTL-SDR is enough for capture; transmitting later requires a HackRF or similar. Always note the exact center frequency and sample rate used, because you must replay with matching parameters.

To replay, send the captured I/Q file back out on the same frequency and sample rate using transmit-capable hardware like a HackRF.

Because the receiver matches against the raw waveform, an exact retransmission reproduces the original command. Always replay inside a shielded enclosure unless you have explicit authorization and legal clearance to transmit.

Blind replay works, but decoding the signal teaches you more and enables smarter attacks. Tools like Universal Radio Hacker (URH) let you demodulate the burst, recover the bitstream, and identify structure.

• Find the preamble and sync word.
• Determine the symbol rate and encoding (often Manchester or PWM).
• Locate the static command payload.

Once decoded, you can craft new transmissions, fuzz fields, or confirm whether any part of the message changes between presses.

Modern key fobs defeat naive replay with rolling codes (hopping codes). Each press uses a new code derived from a shared secret and an incrementing counter.

• The transmitter and receiver stay synchronized via the counter.
• A captured code is invalidated once the receiver advances past it.
• Replaying an old code is simply rejected.

Systems like KeeLoq popularized this approach. Rolling codes raise the bar significantly, but as the next scene shows, implementation flaws still create openings.

Rolling codes can still fall to a capture-and-jam technique, famously demonstrated as RollJam:

• The attacker jams the receiver while simultaneously capturing the victim's first fob press on a narrow band the jammer does not cover.
• The fob did not work, so the user presses again. The attacker captures the second code and replays the first.
• The attacker now holds one unused, still-valid future code.

Because the receiver never saw the first code, it remains valid. This exploits the protocol's tolerance window rather than breaking the cryptography.

Some rolling-code receivers accept codes within a resync window to tolerate accidental button presses out of range. If this window is large or poorly bounded, an attacker who captures several consecutive codes may predict or force resynchronization.

Older KeeLoq implementations also suffered from manufacturer key recovery: extracting the master key from a single fob allowed cloning entire product lines. These are implementation flaws, not failures of the rolling-code idea itself.

Jamming floods a frequency with noise so legitimate receivers cannot hear valid transmissions. It is a building block of RollJam and a denial-of-service threat in its own right.

• Wireless alarm sensors can be jammed so a door-open event never reaches the panel.
• Keyless entry and remote controls can be silenced.

Jamming is illegal in nearly every jurisdiction, even for testing. Demonstrate it only in a shielded lab with explicit authorization. Its relevance here is understanding how attackers combine jamming with capture, and why systems must detect signal loss.

A practical capture-and-replay workflow uses a compact toolset:

• RTL-SDR — survey and capture (receive only).
• HackRF One — capture and transmit for replay testing.
• URH — demodulate, decode, and craft signals.
• rtl_433 — quickly identify known devices.
• Flipper Zero — convenient field capture and replay of simple sub-GHz signals.

The Flipper is popular for demonstrating replay against static-code remotes, but it is blocked by properly implemented rolling codes, which is exactly the point you want clients to understand.

Recommendations from a replay assessment include:

• Replace static codes with authenticated rolling codes or challenge-response.
• Use tight, bounded resync windows and unique per-device cryptographic keys, never a shared master key.
• Add timestamps or nonces so each command is valid only once and only briefly.
• Implement jamming detection: alarm panels should treat sudden loss of sensor signal as a tamper event.
• Prefer bidirectional protocols where the receiver confirms each command.

The core principle: a command that can be recorded and replayed identically is broken. Every authorized action must be cryptographically unique.

Test your understanding of replay attacks against rolling codes.

You can now capture, analyze, and replay RF signals and reason about their defenses:

• A replay attack retransmits a captured static command and works against fixed-code remotes.
• Workflow: find the frequency in the ISM bands, capture I/Q with RTL-SDR, replay with HackRF, and decode with URH.
• Rolling codes defeat naive replay, but RollJam (capture-and-jam) and weak resync windows or shared master keys reopen the door.
• Jamming is illegal outside shielded, authorized labs and underpins denial-of-service and RollJam attacks.
• Defense requires authenticated, single-use commands, bounded resync, per-device keys, and jamming detection.

This completes the RF and Wireless Hacking course: from SDR fundamentals through Bluetooth, contactless, and signal replay.