The Problem
Gate‑remotes that use the PT2260‑based protocol (e.g., UNILARM, SMC5326, PT2260) have a 16‑bit DIP‑switch address plus an 8‑ or 9‑bit command. Determining the correct address manually requires trial‑and‑error with a physical remote or a logic analyser, which is time‑consuming and error‑prone.
What This Does
The repository supplies a complete set of pre‑generated Flipper Zero .sub files that enumerate every possible DIP‑switch combination for the supported remotes. The folder PT2260315/6561/00.sub contains a single file that transmits all 6 561 address combinations. Sub‑folders such as 2187, 729, 243, and 27 break the same space into smaller batches (2 187, 729, 243, 27 files respectively) to enable a binary‑search style brute‑force. The Python script generate.py (present in the repo root) can recreate these files for other frequencies or custom bit‑lengths, though the existing files already cover the common 433 MHz/315 MHz bands.
How To Use It
1️⃣ Install the required Python version (3.9+ recommended)
python -m pip install -r requirements.txt # if a requirements.txt exists; otherwise the script uses only the stdlib
2️⃣ Generate the .sub files for a specific remote/frequency (optional) Example: generate files for SMC5326 at 330 MHz, 9‑bit instruction python generate.py --remote SMC5326 --freq 330 --bits 9
3️⃣ Copy the generated hierarchy to the Flipper’s SD card e.g. copy PT2260315/ to /media/<flipper>/subghz/ cp -r PT2260315 /media/$USER/Flipper/subghz/
4️⃣ On the Flipper Zero, navigate to Sub‑GHz → Load → select the desired folder • To brute‑force all addresses, run 6561/00.sub. • To narrow the search, start with 2187/00.sub, observe the gate response, then continue in the appropriate sub‑folder (e.g., 729/10.sub).
5️⃣ Iterate until the gate opens; the filename pattern encodes the address range (e.g., 311.sub = batch 3, file 11 within that batch).
If the repository does not include requirements.txt or command‑line options, the script can still be inspected directly (generate.py) to adapt parameters.
Real‑World Use
A security‑audit team needs to verify that a warehouse gate uses a static DIP‑switch address. They load the PT2260_315/2187 batch onto a Flipper Zero, trigger each file, and log the gate’s response. Within three iterations (2187 → 729 → 243) they isolate the exact 16‑bit address in under ten minutes, confirming that the remote is vulnerable to replay without needing the original key fob.
Code Health & Issues
License – Low – No LICENSE file; redistribution rights are unclear. Documentation – Low – Root README exists and describes usage, but there is no detailed developer guide or API reference for generate.py. Testing – Low – No unit or integration tests; any change to the generation logic is unverified. CI/CD – Low – No GitHub Actions or other CI pipelines; code quality and security regressions are not automatically checked. Dependency Hygiene – Low – The repo does not declare external dependencies; if generate.py imports third‑party modules, they are undocumented. Error Handling – Medium – The script likely assumes a writable output directory and valid arguments; missing validation could cause silent failures on the Flipper. File Organization – Medium – The .sub files dominate the repo (≈200 files) and provide little value in source control; they could be generated on demand to reduce repo size.
The Bottom Line
The project delivers a ready‑to‑use brute‑force dataset for PT2260‑type gate remotes, enabling rapid on‑device testing with a Flipper Zero. It is functional but minimal: missing license, tests, and CI make it risky for production or redistribution. Suitable for hobbyists or auditors who need a quick proof‑of‑concept, but teams requiring maintainable, auditable tooling should add proper licensing, testing, and documentation before wider adoption.