-1

I have a remote control that has an STM32 MCU and sends data via NRF24L01. What I would like to do is clone the data sent when buttons are pressed by reading what is being sent to the RF24 and then replicating these messages with my own "remote".

I have tried sniffing the data wirelessly with my Pro Mini and NRF24L01. I have everything plugged in correctly, the BasicExample seems to be running fine, but when I run a promiscuous channel activity sniffer, I don't get any wireless data, not even running wifi and bluetooth near the NRF. Pro Mini is 5V and NRF sniffer is powered by an external 3.5V battery with cap on VCC-GND, ground is common to Pro Mini. I have also tried the WireShark approach, but with 0 packets found.

Therefore I want to try it directly wired to the remote. I don't have a logic analyzer handy. How would I read the data? By just connecting MISO and CS to an arduino and running an SPI reader? What would be the best way to do this? I have the Pro Mini and many Teensy boards ready.

1

That was an interesting challenge. There are some obstacles to consider when trying to use RF sniffing:

  1. What channel is used? (128)
  2. What bit-rate is used? (250K-1M-2M)
  3. How many address bytes? (3-5 byte)
  4. How many bits in CRC? (1-2 byte)
  5. Auto-Acknowledgement? (1 bit)
  6. etc.

Without any info on the remote NRF configuration this is tedious to break. Probing the hardware signals (MISO, MOSI, SCK, SS) on the remote NRF chip with a logic analyzer seems (much) easier.

Cheers!

  • I found this wonderful tutorial yveaux.blogspot.com/2014/07/nrf24l01-sniffer-part-1.html but I haven't had any luck receiving anything yet. – Fid Dec 28 '15 at 1:41
  • First thing you have to make sure you have wired the receiver correctly. (Also download the latest RF24 library from built-in library manager or from github.com/TMRh20/RF24) Then solder at least 100uF capacitor directly to the power pins of the Nrf24l01. If you wish to reverse engineer it, you must make sure it's not your hardware or software letting you down. (When you manage to reverse engineer it, please leave a comment here for others wishing to do the same) – Avamander Dec 28 '15 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.