Capturing Signals

Record and decode SubGHz signals from remotes and transmitters

On this page

Capture SubGHz activity from remote controls, garage door openers, and other SubGHz devices. There are two separate capture paths:

  • On-device UI - captures and decodes real signals and writes Flipper .sub files for later replay.
  • subghz CLI - captures RSSI spectrum snapshots (the 64 levels the scanner shows), not decodable signals, and cannot transmit.

Both paths write under /mnt/ghostesp/subghz/ on the SD card, but produce different files; see Files and Management for the formats.

Before You Start

  • Hardware: Board with CC1101 SubGHz support (see Hardware Support).
  • SD card: Inserted and mounted. CLI snapshots and on-device .sub files both live under /mnt/ghostesp/subghz/.
  • Frequency: Know or determine the target frequency using Scanning or Frequency Analyzer.

Capture Modes

The on-device signal capture supports two modes:

  • Normal capture - Attempts to decode the signal using supported protocols. Best for known remotes and standard devices.
  • Raw capture - Records raw timing data without decoding. Use for unknown protocols or when normal capture fails.

subghz capture_on / subghz capture_off select raw mode for that on-device/remote signal-capture path. They have no effect on the CLI spectrum snapshot.

Capturing a Signal (On-Device UI)

  1. Open Menu → SubGHz → Capture to start scanning on the current frequency.
  2. Press the button on your target remote while the scanner is running.
  3. When a signal is detected, GhostESP will attempt to decode it.
  4. Review the decoded information (protocol, bits, frequency) in the preview.
  5. Confirm to save the signal to the SD card.

Capturing a Spectrum Snapshot (CLI)

The CLI works on the scanner’s RSSI level buffer, not on decoded signals. A snapshot records the current name, cursor and 64 levels values - it is a picture of RF activity, not a signal you can replay or transmit.

# Start the scanner
subghz start

# Capture the current RSSI spectrum into the snapshot buffer
subghz capture [name_hint]

# Save the captured spectrum snapshot to the SD card
subghz save [name_hint]

subghz load and subghz replay restore a saved snapshot back into the scanner display; neither transmits. Snapshot names are auto-generated as snapshot_%08X (based on the tick counter) unless you pass a name hint.

Protocol Decoding

The on-device capture path automatically attempts to decode captured signals using 30+ protocols including:

  • Princeton
  • CAME
  • Nice Flo
  • PT2260/PT2262
  • Chamberlain
  • Linear
  • KeeLoq
  • Dooya
  • Dickert MAHS
  • Nord ICE
  • And many more (see Supported Protocols)

If the protocol is recognized, GhostESP displays:

  • Protocol name
  • Bit count
  • Decoded code in hexadecimal
  • Frequency

If decoding fails or the protocol is unknown, the signal is saved as raw timing data.

Tips for Successful Captures

  • Frequency matching: Ensure you’re scanning on the correct frequency band for your target device.
  • Distance: Start with the remote within 1-2 meters of the device for best signal quality.
  • Multiple presses: Some remotes use rolling codes; capture multiple presses to identify patterns.
  • Interference: Avoid areas with strong RF interference (near other transmitters, power lines, etc.).
  • Raw fallback: If normal capture consistently fails, try raw capture mode to record the signal timings.

Notes

  • On-device captured signals are stored in Flipper-compatible format, allowing interchange with Flipper Zero devices.
  • Some devices require multiple button presses to transmit the full command sequence.

Troubleshooting

  • No signal detected: Verify the frequency band, check antenna connection, and ensure the target device is transmitting.
  • Decode fails: Try raw capture mode, or move closer to the target device to improve signal quality.
  • Save fails: Check that the SD card is mounted and the /mnt/ghostesp/subghz/ directory exists.
  • Replay doesn’t work: Some protocols use rolling codes or require specific timing; raw capture may be necessary.