https://github.com/roboremo/nrf24-demodulator

Sniff NRF24L01 (and clones) packets and veiw bit-level structure using GNU Radio
https://github.com/roboremo/nrf24-demodulator

gfsk gnu-radio mmds nrf24l01 packet-capture sdr sniffer

Last synced: 22 days ago
JSON representation

Sniff NRF24L01 (and clones) packets and veiw bit-level structure using GNU Radio

• Host: GitHub
• URL: https://github.com/roboremo/nrf24-demodulator
• Owner: roboremo
• License: mit
• Created: 2017-02-09T08:28:41.000Z (almost 8 years ago)
• Default Branch: master
• Last Pushed: 2017-05-06T10:28:05.000Z (over 7 years ago)
• Last Synced: 2024-08-04T09:05:48.173Z (4 months ago)
• Topics: gfsk, gnu-radio, mmds, nrf24l01, packet-capture, sdr, sniffer
• Size: 413 KB
• Stars: 21
• Watchers: 4
• Forks: 9
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-network-stuff - **5**星 - level structure using GNU Radio (<a id="7bf0f5839fb2827fdc1b93ae6ac7f53d"></a>工具 / <a id="32739127f0c38d61b14448c66a797098"></a>嗅探&&Sniff)

README

        
# NRF24-demodulator

Sniff NRF24L01 (and clones) packets and view bit-level structure using GNU Radio.  

GRC flow inspired from here: https://wiki.bitcraze.io/misc:hacks:hackrf  

  

## Hardware setup  

Inspired from http://blog.cyberexplorer.me/2014/01/sniffing-and-decoding-nrf24l01-and.html  

Have a NRF24L01+ sending something on channel 80 (2480MHz), at 1Mbps  

The RF signal is picked-up using a MMDS down converter  

(I use one with LO = 1838MHz and input frequency 2500 to 2700MHz)  

The resulting frequency is 642MHz  

The 642MHz signal goes to a SDR dongle (820T2), and the GRC reads it.  

The MMDS down converter is powered using 12V DC  

![MMDS powering diagram](https://raw.githubusercontent.com/roboremo/NRF24-demodulator/master/powering-MMDS-down-converter.JPG "MMDS powering diagram")

  

## Software setup

After the hardware is ready, open the GRC file  

Change the downconverter_lo and nrf_channel if needed  

Click execute  

The scope should appear on screen.  

Go to Channel Options -> Trig and increase the trigger level by clicking on +  

Then move T Offset to the right  

Now you should see something like this:  

![NRF24L01 packet waveform](https://raw.githubusercontent.com/roboremo/NRF24-demodulator/master/NRF24L01p-1Mbps-addr-0x0000000000-payload-0x414243-DPL-noCRC.JPG "NRF24L01 packet waveform")  

  

Related project:  

https://github.com/roboremo/NRF24-total-control