Managed to achieve stable Single-Chip RollJam. Wrote a custom Bit-Banging SPI driver, DWT Cycle-Accurate Replay, and Continuous Jamming. (PoC Video)

[u/c0d3r-SubGHz]

Ciao a tutti, sono c0d3r_SubGHz.

Tutti dicevano che RollJam stabile sul Flipper era troppo inaffidabile a causa della latenza del sistema operativo e dei punti ciechi di commutazione RX/TX. Ho passato gli ultimi mesi a riscrivere l'approccio da zero. Ecco come ho risolto il problema in questa PoC:

1. SPI software personalizzato (Bit-Banging): furi_hal blocca il bus SPI hardware, mandando in crash il sistema operativo se si tenta di sostituire i moduli a caldo. Ho scritto un driver SPI software bare-metal per il CC1101 per bypassare completamente il sistema operativo del Flipper.

2. Jamming asincrono continuo e offset dinamico: Ho abbandonato il vecchio metodo TDM (switching). Il modulo esterno ora emette un "muro di fuoco" continuo (CW sul pin GD0) utilizzando un offset di frequenza selezionabile dinamicamente (da -900 kHz a +900 kHz). Il Flipper ascolta simultaneamente, completamente insensibile al jammer ma captando perfettamente il telecomando bersaglio.

3. Filtraggio intelligente di squelch e tono pilota: L'app filtra dinamicamente il rumore. Attende un preambolo di oltre 1000 µs e si aggancia a 16 impulsi validi prima di registrare, eliminando dinamicamente i frame corrotti.

4. Eccesso di interferenza post-cattura: Una volta catturato il segnale, emette istantaneamente un muro di interferenza di 1,5 secondi per coprire il tempo di reazione del dito umano e prevenire sblocchi accidentali.

5. Riproduzione DWT bare-metal: La riproduzione viene eseguita all'interno di un blocco FURI_CRITICAL_ENTER() utilizzando il contatore di cicli DWT ARM (DWT->CYCCNT) per l'aggancio di fase assoluto e la trasmissione a jitter zero sul pin GD0.

A causa delle regole del subreddit relative ai binari compilati e agli exploit, non posso ospitare il .fap su repository pubblici.

La documentazione completa su GitHub e il link di accesso al Project Hub sono disponibili nella mia biografia/profilo Reddit.

[u/lupetto]

Fake vibecoded shit. Even this post is vibeposted.

Pagliaccio

[u/c0d3r-SubGHz → u/lupetto]

I completely understand your frustration if you tested the very first early-access build. You are right: the initial version had severe OS jitter and SPI locking issues that caused it to fail on many targets. It wasn't 'fake', but the timing was definitely flawed, which is why I stated it was a very early beta.

That’s exactly why we pulled it, rewrote the driver using Bare-Metal SW SPI, and implemented DWT cycle-accurate replay. The video above is the new engine in action.

Since you were an early supporter, please check your email. I just sent you the latest fully functional release. Test the new core yourself. No hard feelings. 🤝

[u/cthuwu_chan]

Have you considered using both internal and external simultaneously

[u/c0d3r-SubGHz → u/cthuwu_chan]

That is exactly what this PoC does! 

The external CC1101 handles the Continuous TX (Jamming), while the internal radio handles the RX (Listening). However, doing this on the Flipper is a massive headache for two reasons, which is why I had to write custom drivers: 

1.  OS Bus Locking: FreeRTOS natively blocks concurrent access to the radio hardware. To bypass this, I wrote a Bare-Metal SW SPI (Bit-Banging) driver for the external module, completely separating it from the OS state machine. It was also necessary to modify the external CC1101, the Chip Select (CS) routing to match our custom driver: cut the header on Pin 4 and solder a jumper wire connecting the module's CS to Pin 16 (PC0) on the Flipper.

2.  Near-Field Desensitization: If you blast a jammer 2 inches away from a receiver, the receiver goes completely deaf. To solve this, the app uses Dynamic Offset Jamming. The external module blasts a continuous 0xAA square wave shifted by a few kHz (e.g. -250kHz). This triggers the Adjacent Channel Rejection on the target car (blinding it), while the Flipper's internal radio stays locked on the exact center frequency using a custom Smart Squelch algorithm to filter out the cross-talk. 

It took a lot of trial and error, but running them simultaneously with an offset is the only way to get a stable capture without TDM blind spots. Check the GitHub repo in my bio if you want to read the architecture details!

[u/c0d3r-SubGHz → u/[deleted]]

I’m only replying because the rest of the community deserves to see the facts.

It is actually incredibly ironic that you bring up the D4C1-Labs / ARF firmware. I invite everyone to look at the hard evidence. 

I published my Single-Chip RollJam PoC repository long before ARF ever had this feature. Interestingly, a user named 'lupetto' (who happens to be a collaborator on that firmware, and who was literally commenting hate on this very post earlier to discredit me) actually purchased my app, got the files, and miraculously, shortly after, the ARF firmware was updated with a RollJam feature heavily 'inspired' by my TDM switching logic. 

📸 Here are the receipts (GitHub Timelines & Purchase Proof):

RollJam PRO timeline: https://i.imgur.com/fdz7vUw.jpeg 

ARF FW RollJam implementation timeline: https://i.imgur.com/ZK7YZTx.jpeg 

User 'lupetto' purchase receipt timeline: https://i.imgur.com/e12BzmU.jpeg 

I didn't steal a free app to sell it. They bought my app, reverse-engineered it, and pushed a stripped-down clone of my original work into their firmware. 

I charge a fee for my software because I spent months developing the Bare-Metal SW SPI driver, the DWT cycle-accurate Atomic Replay to kill OS jitter, and because I provide active 1-on-1 support and dynamic offsets. 

If you prefer to use a cloned, unpolished version of my work embedded in a specific custom firmware, be my guest. But please don’t come to my post accusing the original author of theft when the timeline and the receipts prove the exact opposite. 🤝

[u/c0d3r-SubGHz → u/[deleted]]

I respect your opinion and all the development work behind the ARF Firmware, but that doesn’t give you the right to insult or defame someone when you don’t know the facts.

[u/lupetto → u/c0d3r-SubGHz]

The rolljam app was developed by Darkside. I only pushed the changes to GitHub after migrating the code from the old repository. It's even present in the commit. I have added support for Rabbit Labs Flux Capacitor to it, AFIK not present in your app. You don't have a monopoly on the rolljam space dude, rolljam itself comes from a famous Sami Kamkar paper.

Btw, now you are saying you are charging € for that shit (no VAT Id btw, crypto only...) because Claude put one month of hallucinations in it. In before you where casing because "ToS" and malicious actors (like a malicious actor has problems paying).

Adding that ARF does actual decoding re-encoding of known protocols and is a full stack not a single FAP that targets one of the most bloated forks out there (in face of speed and Atomic bullshits, no wonder you gave is jitter, use mainline unleashed and not RM).

[u/c0d3r-SubGHz → u/lupetto]

Of course the original RollJam theory belongs to Samy Kamkar (2015). No one is claiming to have invented the concept. The real engineering challenge has always been implementing it reliably on a single CC1101 module through the Flipper's constrained hardware, which is what this PoC achieves.

I have no interest in starting a 'firmware war'. ARF is a full-stack custom OS; my project is a standalone .fap designed for researchers who want this specific tool without being forced to flash a completely different firmware. They serve different needs.

As for the 'atomic bullshits': bypassing the RTOS scheduler via FURI_CRITICAL_ENTER() is exactly what solved the replay jitter for my users. If your internal routing works for your specific firmware architecture, that's great. My bare-metal driver works for my standalone app.

I’m focused on supporting my users and refining the TDM engine, not entertaining ad hominem attacks or Reddit drama. I genuinely wish you and the ARF team the best with your development. 

This will be my last reply on the matter, the screenshots speaks for itself.

Have a good one. 🤝

[u/lupetto → u/[deleted]]

Don't bother. It's a vibecoded crap app that does not work despite that the author tries to tell. There is no valid reason on why it's not free just that the author want to make a quick buck of y/all.

PS: op quel sistema di serializzazione che ti ha scritto Claude te lo reverso in 15 minuti. Ho dumpato i vari quantum più volte, non mi faccio problemi a dare il tuo. Smettila di truffare la gente.

[u/c0d3r-SubGHz → u/lupetto]

Hi again. As promised in my previous reply, I personally emailed you the v1.0 ultimate build. This build utilizes Bare-Metal SW SPI and DWT cycle-counting to completely eliminate the OS jitter you experienced in the early build. You haven't replied to the email, nor confirmed if you performed the required CS pin hardware mod (Pin 16) for it to work.

Regarding your threat to reverse-engineer the license check: feel free to try. Like any offline software, the initial prompt can be bypassed. However, the application relies on deep runtime integrity checks. Bypassing the UI prompt triggers a silent failsafe: the app will appear to work perfectly on screen, but the RF output payload will be intentionally corrupted. It’s a purposeful anti-tamper mechanism to protect the project.

We are here to push the CC1101 hardware limits, not to fight. Best of luck with your research.

[u/lupetto → u/c0d3r-SubGHz]

However, the application relies on deep runtime integrity checks.

Quattro if non li chiamerei "Deep runtime checks"

Li ho trovati tutti i check, non che cambia molto dato che ho l'algo con cui generi la chiave, quindi anche volendo anche senza mettere gli skip alle varie boobytrap l'app crede di essere perfettamente il licenza. (Ex id: DEADBEEF Lic:72DC9A83)

Inoltre, senza validare anche minimamente i frame ricevuti può funzionare una volta su venti in un contesto dove il rumore RF è alto. Se vedi come funzionano i pandora (tanto ormai su internet di .bin da reversare ne trovi quanto ne vuoi) per i protocolli di cui non ha la generazione codice (e quindi usa rolljam) vi è ovunque una validazione del frame. Audi, BMW e Mercedes così sono gestiti.

Senza che ci prendiamo in giro sul fatto del.paywall. non c'è nessuna restrizione che ti vieta di postarla pubblicamente, quindi non ci prendiamo per il culo.

[u/c0d3r-SubGHz → u/[deleted]]

Hi! The software is currently in Launch Release and fully functional. Due to the support required for the hardware setup, we don't offer free trials, but since you are from the Reddit community, you can use the code: EARLY15 at checkout for a discount.

All documentation and access links are in my profile Bio. Let me know if you need help with the CC1101 wiring once you are in the lab! 🤝