GollumRF: Sub-1GHz RF hacking tool

Re-configurable Sub-1GHz RF remote control with BLE & USB. Can receive, transmit & analyze RF spectrum.

Similar projects worth following
GollumRF is the bridge between smartphone and other wireless objects transmitting in the sub-1GHz RF band, like garage door receivers, car keyfobs, roller shutters, fire detectors, etc…
All these devices often use custom RF transmissions, but with GollumRF built-in CC1111 Sub-1 GHz RF Transceiver, you can receive and transmit data in the ISM band at 315/433/868/915 MHz.
With GollumRF BLE chip, these data can now be directly sent to your smartphone, which will display binary data or spectrum analysis of a RF transmission.
GollumRF also has a dual JavaScript and Python scripting feature, giving you the ability to dynamically control the RF, for both TX and RX, without any SW rebuild.

GollumRF is now open for Pre-Orders.

Help us make GollumRF more useful: please take this GollumRF survey.

GollumRF Block Diagram


  • is a programmable Sub-1GHz RF remote control,
  • is programmed & controlled with your Smartphone but can work in standalone mode
  • can acquire & show you RF codes from your existing remote controls,
  • can generate new codes for any existing brands and models,
  • replaces various existing remote controls from different vendors,
  • allows RF data to be transmitted & received,
  • can communicate with many proprietary RF device.

GollumRF embeds 2 microcontrollers :

  • Nordic Semiconductor nRF51822 Bluetooth low energy System on Chip, with ARM Cortex-M0 32 bit processor, 256 kB embedded flash program memory & 16 kB RAM
  • Texas Instruments CC1111 Low-Power SoC (System-on-Chip) with 8051 MCU, 32 kB Memory, Sub-1 GHz RF Transceiver, and USB Controller

And some useful peripherals :

  • 8 MB SPI Flash memory
  • Battery fuel gauge
  • Charge IC
  • Buttons, Leds
  • Debug pins


GollumRF can be used at 315/433/868/915 MHz frequencies for :

  • Transmit and receive RF data

Here is a short video we made some time ago, showing how to duplicate a fixed code remote control with GollumRF V1.

French speaking, but English subtitles ;-)

  • Spectrum analyzer

Work In Progress: we still have to reduce latency, mainly due to BLE.

  • Sniff & Replay attack
  • Jamming - Achtung! Verboten :-)
  • Cloning garage door remote controls, but it works also for keyfobs, proprietary home automation protocols, and a lot of others RF protocols. GollumRF already supports fixed code, and we are currently implementing some of the major rolling codes algorithm used (Keeloq, …) for garage door remote controls like FAAC, Nice, Cardin, etc…
  • Share captured data & settings with another GollumRF

Again, a short video made with GollumRF V1, showing how to transfer RF codes between 2 GollumRF devices, using our backend.

  • Whatever you can think of using its JavaScript & Python scripting engine

BLE or USB Connection mode

GollumRF can be connected to :

  • Smartphone using :
    • Bluetooth Smart (BLE 4.0), using either our Android & iOS applications or embed provided Gollum libraries into your own Android or iOS application
    • Micro USB Male-Male, using either our Android application or embed provided Gollum library into your own Android application
  • Linux computer using :
    • USB cable & Python (enjoy the power of RfCat)
    • USB cable & our native-C library

Note there is a much better throughput when using USB, so it is recommended method for capturing or transmitting data with high data rates.

However BLE connection is more than enough when dealing with keyfobs or gate openers.

Standalone mode

GollumRF has a LiPo battery inside and can be recharged by USB.

You can program GollumRF with whatever transmit function you want and assign this function to any of the 4 available buttons. GollumRF now behaves as a standard remote control and you do not need to be connected using USB or BLE to use it.

Scripting with Python

GollumRF natively supports RfCat and its Python scripting mode (interactive shell or file parsing).

This mode can only be used when GollumRF is connected to a Linux PC using USB.

All other RfCat helpers are also supported, eg. PWM AM/OOK Scanner from RfCatHelpers from Andrew Mohawk

Scripting with JavaScript

GollumRF also supports JavaScript dynamic programming.

Similarly as for Python engine, the JavaScript engine is hosted and running on host side (inside our Gollum host library) so for now JavaScript usage is only possible when connected to a Smartphone.

You can use any example from our default scripts provided in Gollum application and modify it to fit your need.

For example, our Gollum library understand some custom JavaScript functions like :


Detailed API documentation will be available soon.

Multi GollumRF connection

We are currently working on a new feature allowing our app to connect to more than one GollumRF at the same time.

This allows some...

Read more »

Portable Network Graphics (PNG) - 70.10 kB - 02/26/2016 at 18:33


Portable Network Graphics (PNG) - 95.93 kB - 02/26/2016 at 18:32


Portable Network Graphics (PNG) - 147.26 kB - 02/26/2016 at 18:32


Portable Network Graphics (PNG) - 117.31 kB - 02/26/2016 at 18:32


Portable Network Graphics (PNG) - 144.37 kB - 02/26/2016 at 18:32


View all 17 files

  • 1 × ISP130301 BLE Module InsightSIP Bluetooth Low Energy Module with Nordic Semiconductor nRF51 & Integrated Antenna
  • 1 × CC1111F32 (32kB Flash, 4k RAM) Low-Power SoC (System-on-Chip) with MCU, Memory, Sub-1 GHz RF Transceiver, and USB Controller
  • 1 × S25FL204K Memory ICs / FLASH Memory
  • 1 × MCP73832 Power Management ICs / Power Supply Support
  • 1 × LTC2941 Power Management ICs / Battery Management ICs

View all 11 components

View all 2 project logs

Enjoy this project?



Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates