From ccd8304fbf7c179d4f53dbd7357d6480101c51c9 Mon Sep 17 00:00:00 2001
From: andy <andy@dixon.cx>
Date: Fri, 11 Sep 2026 13:24:31 +0100
Subject: [PATCH] Remove sub-GHz region/frequency TX limits (research build)

Patch furi_hal_region.c so furi_hal_region_is_frequency_allowed and
furi_hal_region_is_provisioned always return true, allowing transmit on any
frequency the CC1101 can tune regardless of provisioned region. The hardware
PLL bands (~300-348 / 387-464 / 779-928 MHz) remain since they are physical.
Guarded by SUBGHZ_UNLOCK (default 1); build SUBGHZ_UNLOCK=0 to keep limits.
README documents that transmitting outside your local allocation may be
illegal and this is for research/authorised testing only.
---
 README.md | 14 ++++++++++++++
 build.sh  | 29 +++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/README.md b/README.md
index e1cc420..80724ff 100644
--- a/README.md
+++ b/README.md
@@ -230,6 +230,20 @@ firmware's peripheral connections by the role field. Advertising reports are
 parsed from the raw HCI payload (the ST header's `Advertising_Report_t` is not a
 wire overlay).
 
+## Sub-GHz region unlock (research)
+
+`build.sh` also patches the firmware's sub-GHz region gate so transmit is
+allowed on any frequency the CC1101 can tune, regardless of the device's
+provisioned region: `furi_hal_region_is_frequency_allowed` and
+`furi_hal_region_is_provisioned` are forced true. This is what most "unlocked"
+Flipper firmwares do. The CC1101 PLL bands (about 300-348, 387-464 and
+779-928 MHz) remain, because they are a hardware limit, not a regulatory one.
+
+**Transmitting outside the frequencies and power levels allocated to you may be
+illegal in your country. This is provided for research and authorised testing
+only; you are responsible for operating within the law.** Build with
+`SUBGHZ_UNLOCK=0 ./build.sh` to leave the region limits in place.
+
 ## Limitations
 
 * **BLE only.** The STM32WB55 has no Bluetooth Classic (BR/EDR), so classic
diff --git a/build.sh b/build.sh
index c62d2e4..90e9ef5 100755
--- a/build.sh
+++ b/build.sh
@@ -84,6 +84,35 @@ for name in ["ble_hci_le", "ble_gap_aci", "ble_gatt_aci", "ble_hal_aci", "ble_l2
     print(">> patched " + p + ': extern "C" guards')
 PY
 
+# Remove the sub-GHz region / frequency transmit limits (RESEARCH USE ONLY).
+# furi_hal_region_is_frequency_allowed gates TX vs RX-only per the provisioned
+# region; furi_hal_region_is_provisioned makes apps refuse to start unprovisioned.
+# Forcing both true allows transmit on any frequency the CC1101 hardware can
+# tune (the ~300-348 / 387-464 / 779-928 MHz PLL bands remain: they are physical,
+# not regulatory). Transmitting outside your local allocation may be illegal;
+# you are responsible for legal operation. Build with SUBGHZ_UNLOCK=0 to skip.
+if [ "${SUBGHZ_UNLOCK:-1}" = "1" ]; then
+python3 - targets/f7/furi_hal/furi_hal_region.c <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read()
+patches = [
+    ("bool furi_hal_region_is_frequency_allowed(uint32_t frequency) {\n    return furi_hal_region_get_band(frequency) != NULL;\n}",
+     "bool furi_hal_region_is_frequency_allowed(uint32_t frequency) {\n    UNUSED(frequency);\n    return true; /* region limits removed (research build) */\n}"),
+    ("bool furi_hal_region_is_provisioned(void) {\n    return furi_hal_region_get() != NULL;\n}",
+     "bool furi_hal_region_is_provisioned(void) {\n    return true; /* region limits removed (research build) */\n}"),
+]
+changed = False
+for old, new in patches:
+    if old in s:
+        s = s.replace(old, new, 1)
+        changed = True
+if changed:
+    open(p, "w").write(s)
+    print(">> patched " + p + ": sub-GHz region/frequency TX limits removed")
+PY
+fi
+
 # Stage each app into applications_user, with the shared libble sources copied
 # alongside so the fap glob (*.c) picks them up.
 mkdir -p applications_user