Previous: Start here · Series index · Next: LF RFID and iButton
Sources checked 18 September 2026 · Exercises have not been run on THL hardware.
Use case: Preserve one useful command from an existing remote and explain why another transmitter can reproduce it. Legitimate use: Replace a failing remote, consolidate controls, or investigate a command during repair. Harmful use: Interrupt somebody else’s television, presentation, audio, or climate control. The same technical capability supports both outcomes; the target and permission change their meaning.
1. How the command travels
Infrared control sends information using light outside normal human vision. Flipper has an infrared receiver and transmitting LEDs behind its IR window. Its Infrared application offers learned remotes and a library of universal remote commands. This is a different interface from Bluetooth, Wi-Fi, or the Sub-GHz radio. A product called a “wireless remote” is not necessarily an infrared remote. Flipper infrared overview
The receiver captures the pattern produced by a button press. For a recognized protocol, Flipper stores decoded information; otherwise, it can save raw signal timings. Its documented receiver is intended for signals using a 38 kHz carrier. That frequency describes the light’s modulation, not an FM radio channel. This is a compatibility constraint, not a promise to learn every remote. Reading infrared signals
A decoded .ir entry includes a protocol, address, and command. A raw entry instead contains carrier information and pulse timings. Neither representation is a photograph of the remote, and neither reveals how the appliance implements the command internally. Reading the saved fields makes the distinction between understanding a protocol and repeating a waveform concrete. Official infrared file format
2. Why it can work without pairing
For an ordinary compatible IR appliance, a correctly formed command is enough to cause the expected action. The receiver recognizes the command rather than checking that the original plastic handset sent it. That is why a replacement remote can be useful. It is also why physical proximity and control of the room matter.
Flipper’s universal mode tries a sequence of known commands for different supported models. It does not identify every appliance, break a password, or guarantee a match. The vendor calls the dictionary search “brute force”; here that means trying known remote protocols, not defeating cryptographic authentication. Universal remotes
For repair or accessibility work, save the few commands someone needs and check them individually. Keep an independent control available. This is a proposed use case, not a measured THL outcome.
3. Owned-device exercise: learn one harmless button
Reuse a Flipper, its configured storage, an existing IR remote, and your own television or audio device. Choose a room you control. Put other IR appliances out of the test area and use a noncritical command such as displaying the information overlay. Avoid power cycling, service-menu commands, and climate-control equipment for this first exercise.
- Record the appliance model, Flipper firmware version, starting state, and chosen button. Check that the original remote produces the intended result. Dismiss the overlay before each trial so the starting state is comparable.
- Open Infrared → Learn New Remote. Point the original remote toward Flipper’s receiver and press the chosen button. Save the result under a descriptive button and remote name.
- Open Infrared → Saved Remotes, choose that remote, point Flipper’s transmitter toward your appliance, and send the saved button once. These are the vendor’s learning and playback paths. Reading and replaying IR
- Record whether the intended overlay appeared. Repeat three controlled trials, restoring the starting state each time. Stop if another appliance responds.
- Optionally inspect the saved
.irfile with your existing file-management setup. Note whether it is parsed or raw; preserve the original rather than experimenting with unknown command values.
The expected observation is the same visible response from the original remote and saved command. A failed trial could reflect alignment, lighting, capture quality, incompatible modulation, or an appliance that uses a different interface. Those are troubleshooting possibilities, not THL findings. Do not publish a range or reliability claim from a single successful press.
4. How misuse causes harm
An unwanted command reaches the same receiver and changes the same state. Interrupting a presentation can waste work; changing volume can startle people; interfering with climate control can have consequences beyond a joke. A dictionary search can affect multiple compatible devices in the room. The causal weakness is acceptance of an unauthenticated control message within optical reach, where that device uses such a design. Flipper’s documented command and dictionary behavior
This is a misuse mechanism, not a verified criminal incident. A video of a screen switching off does not establish ownership or authorization.
5. Defenses and completion exercise
For shared spaces, practical mitigations include positioning receivers away from public reach, restricting access to sensitive equipment, and disabling IR through a documented manufacturer setting when an approved alternative exists. These are design recommendations: consult the specific appliance manual before covering receivers or changing settings. A cover may also block legitimate operation.
Completion exercise: Keep a small trial log with starting state, command, observed response, and failure count. Explain why copying a known command worked, why that result says nothing about Wi-Fi compromise, and which physical control would reduce unauthorized operation in your room. Label all results “expected” until you actually run the exercise.