The Problem Gate remotes that use the PT2260, SMC5326, or UNILARM protocols require a large set of raw Sub‑GHz payload files to brute‑force the DIP‑switch configuration. Manually creating or cataloguing those payloads is tedious and error‑prone, especially when the number of combinations reaches 6 561.

What This Does The repository supplies pre‑generated .sub files for every possible DIP‑switch setting, organized by protocol and carrier frequency (e.g., PT2260_315/, SMC5326_330/). The single Python utility generate.py can recreate the entire hierarchy from the raw binary samples in raw_sample/. The README walks a user through copying the appropriate folder to a Flipper Zero SD card (/subghz) and playing the desired .sub file to trigger the gate.

How It Is Wired

Entry point – generate.py is the only executable Python module. File I/O – The script opens the raw sample files (e.g., raw_sample/SMC5326_330.sub) with a plain open(...) call, writes transformed payloads into the protocol‑specific directories, and creates the nested folder structure (6561/, 2187/, 729/, …). No other modules are imported, so the internal call graph consists of a single node with zero inbound or outbound edges.

Effect scope – The script touches the filesystem only: it reads binary samples and writes thousands of .sub files. No network, hardware, or external services are involved. Because the module graph has no hubs or cycles, the codebase is straightforward to modify, but the lack of abstraction means any change to the payload format must be made directly in generate.py.

How To Use It

# 1. Clone the repository
git clone https://github.com/moses-y/flipperzero-gate-bruteforce
cd flipperzero-gate-bruteforce

# 2. (Optional) Regenerate the .sub payloads
python generate.py   # creates/overwrites the protocol folders

# 3. Transfer the needed folder to the Flipper Zero
#    Example for a SMC5326 remote at 330 MHz:
#    Copy the whole SMC5326_330 directory onto the Flipper’s SD card under /subghz

# 4. On the Flipper Zero, navigate to /subghz/SMC5326_330/6561/
#    Play 0_0.sub to send all 6 561 combinations at once, or use the
#    smaller sub‑folders (2187, 729, …) to perform a binary‑search style narrowing.

No additional build steps, package managers, or Docker images are present. The repository contains only the Python script and the binary payloads.

Real‑World Use A security‑testing team can mount a Flipper Zero on a vehicle’s gate controller, copy the appropriate SMC5326_330 folder, and run the 0_0.sub file to attempt an immediate unlock. If the gate opens, they can then switch to the 2187 or 729 sub‑folders to isolate the exact DIP‑switch setting, reducing the time needed for a full exhaustive search.

Code Health & Issues

  • Medium – File opened without context manager – generate.py uses open(...) without a with block, risking a descriptor leak on error. Fix: wrap file operations in with open(...) as f:.
  • Medium – Large binary blobs – Several .sub files exceed 5 MiB (e.g., SMC5326_330/6561/0_0.sub ≈ 7 MiB). Storing them directly inflates clone size and slows CI. Fix: move these files to Git LFS or an external storage bucket and fetch them as part of a setup step.
  • No test suite, CI pipeline, or LICENSE file. This limits confidence in future changes and leaves redistribution rights ambiguous. Adding a minimal pytest harness and a permissive license (e.g., MIT) would improve maintainability.

The Bottom Line The repo delivers a ready‑to‑use payload library and a simple generator for brute‑forcing PT2260‑family gate remotes with a Flipper Zero. It is functionally complete but lacks testing, CI, and proper binary handling. Engineers can adopt it quickly for penetration‑testing or research, but should address the noted resource‑safety and licensing gaps before integrating it into production‑grade tooling.