NewFirst Batch
ZeroTrace Echo
Keychain sub-GHz capture & decode
Incl. VAT · Ships from Germany
Checking stock
- CC1101 Sub-GHz Capture, Decode & Replay (Fixed-Code)
- Fixed-Code RE: EV1527, PT2262, CAME, NICE FLO, Holtek & more
- TPMS, Weather & Alarm-Sensor Decoders
- Jamming & RollJam Detection (Defensive Flagship)
Overview
The ZeroTrace Echo is a keychain sub-GHz analysis tool built around a TI CC1101 radio (E07-400M10S front end, 410-450 MHz) and an ESP32-S3, driven over Bluetooth LE by the ZeroTrace mobile and desktop apps.
It captures, decodes and reverse-engineers fixed-code remotes and sensors, EV1527, PT2262, CAME, NICE FLO, Holtek, Chamberlain fixed and more, and reads TPMS, weather and alarm-sensor traffic in real time.
Its headline identity is defensive: on-device jamming detection, jam-and-replay (RollJam) indicators, and a your-fob-was-captured alert pushed straight to your phone. Rolling-code crypto is captured and classified only, never defeated.
A programmable center button makes it usable standalone, and phone-GPS wardriving, Echo-to-Echo mesh and a shared signal library round out the connected layer. Battery not included.
- sub-GHz radio
- CC1101
- decode & RE
- Fixed-code
- detection
- RollJam
- Echo-to-Echo
- Mesh
- Rolling-Code Capture & Classify Only (Never Defeated)
- Phone-GPS Wardriving & Echo-to-Echo Mesh
- Programmable Button for Standalone Use
- Mobile + Desktop App over Bluetooth LE
Features
Fixed-Code Capture, Decode & Reverse-Engineering
Captures raw OOK/ASK on the CC1101 and decodes fixed-code families, EV1527/HS1527, PT2262/Princeton, CAME, NICE FLO, Holtek, Ansonic, Chamberlain fixed and more, down to protocol, bit count and key, with replay of captured fixed-code signals.
Analyst-Grade Sensor Decoders
Reads TPMS (315/433) sensor ID, pressure and temperature, plus weather stations, PIR/door-contact and alarm sensors, and other rtl_433-style protocols in real time.
Jamming & RollJam Detection
The defensive headline: noise-floor/RSSI jamming detection, jam-and-replay (RollJam) attack indicators, supervision-loss alerts and a duplicate-code capture alarm, pushed to your phone.
Rolling-Code: Capture & Classify Only
Rolling-code remotes (KeeLoq, Security+, CAME Atomo, NICE FloR-S, Somfy RTS) are captured and classified for analysis, never replayed or defeated. This is crypto, not radio, and the firmware keeps it strictly RX and defensive.
Connected Layer
Phone-GPS sub-GHz wardriving and heatmaps, Echo-to-Echo off-grid mesh, a frequency hunter, and a shared signal library, all via the ZeroTrace mobile and desktop apps over Bluetooth LE.
Programmable Standalone Button
The center button is fully programmable, arm a capture, fire a saved signal or run a rule without the app in reach.
Field Power, App-Driven
Runs from a single LiPo cell (JST XH 2-pin, user-supplied) with on-board USB-C charging. No cloud, no account, nothing phones home.
Specifications
Processing
- Main processor
- ESP32-S3-N16R8, 240 MHz dual-core
- Memory
- 16 MB flash, 8 MB PSRAM
- Storage
- 10 MB usable capture storage
Radio
- Transceiver
- TI CC1101 (E07-400M10S module)
- Frequency
- 410-450 MHz (module), CC1101 tunes 300-348 / 387-464 / 779-928 MHz
- Output power
- Up to +10 dBm
- Modulation
- OOK/ASK, 2-FSK, GFSK, MSK
- Antenna
- SMA external antenna
Interface & power
- Control
- ZeroTrace mobile + desktop app over Bluetooth LE
- Local UI
- RGB LED + programmable button
- Battery
- 1 x LiPo, JST XH 2-pin (S2B-XH-A), user-supplied
- Charging
- USB-C, on-board charging
In the box
ZeroTrace Echo Device
SMA External Antenna
Subject to change · may not be included
4×ZeroTrace Stickers
Not included: Battery
Ships from Germany · Incl. VAT
Questions
What is ZeroTrace Echo used for?
ZeroTrace Echo is built for authorized security testing, research, education and automation workflows.
Are updates included?
Yes. ZeroTrace products get lifetime firmware or software updates, with support straight from the developers.
Can teams buy in bulk?
Yes. Teams, labs and companies can order through the ZeroTrace business program: bulk hardware, lab bundles and software access.
No subscriptions, ever
One purchase, yours for life
Lifetime firmware updates
Same kit works in five years
From Germany
Cased and shipped in-house, EU jurisdiction
No-log policy
No telemetry on testing activity
Free EU shipping
3–5 business days
Fast delivery
Ships same or next day from Germany
