Using arduino to reverse engineer nrf24 signals.

I have a device that uses an nrf24 chipset to wirelessly send data to another device, I also have arduino uno and a nrf24 module.

The device has unknown details regarding the channel address etc.

I want to take readings off the device by intercepting the data sent over the nrf24, the device uses the standard arduino nrf24 module you can find on ebay and it is simply plugged into the devices control board.

Could i plug the miso, mosi etc of the device directly into an arduino instead of the nrf24 module it uses and sniff the information coming off it, in order to make use of the data?

Many thanks in advance, if you need more details or specifics of the hardware let me know, but im thinking asking the question generically would be better.

..alternatively, could i use the arduino and the nrf24 module to capture what is being sent by the other nrf24 module in the device?

omnidir:
Could i plug the miso, mosi etc of the device directly into an arduino instead of the nrf24 module it uses and sniff the information coming off it, in order to make use of the data?

If you are asking could you make an Arduino pretend to be an nRF24 module then I guess the answer is yes.

But you would probably need to program your Arduino so it sends the expected responses which may not be simple. The Nordic datasheet is not a masterpiece of literature.

I wonder if you could set the Arduino as an SPI slave and connect to MOSI and CLK (but not MISO) between the device and its nrF24. In other words you want the Arduino to receive the data going from the device to the nRF24 without interfering in that conversation. (This may well be a nonsense idea).

You could only capture the wireless data on another nRF24 if you know the channel and the address. And make sure you turn off the auto-ack feature on your sniffer nRF24. There is a very large number of potential addresses.

...R

Robin2:
If you are asking could you make an Arduino pretend to be an nRF24 module then I guess the answer is yes.

But you would probably need to program your Arduino so it sends the expected responses which may not be simple. The Nordic datasheet is not a masterpiece of literature.

You could only capture the wireless data on another nRF24 if you know the channel and the address. And make sure you turn off the auto-ack feature on your sniffer nRF24. There is a very large number of potential addresses.

...R

fantastic information, thanks.

so how would i go about this? anyone interested in writing some code, ill test the result?

so far i've tried using a nfr24 channel scanner but i dont know what to do next.

either way whether it's acting like an nrf24 or using an nr24, it would be a great benefit to be have the data coming off this device as i wish to then use an arduino permanently to control other devices and log the information that is being sent.

You could attach a cheap logic analyzer to the SPI bus and look at the full data exchange.

Whandall:
You could attach a cheap logic analyzer to the SPI bus and look at the full data exchange.

perhaps something like this?

Arduino Playground - HomePage or SUMP compatible logic analyzer code for Arduino. - Interfacing w/ Software on the Computer - Arduino Forum

I was talking about something like
1set-New-Arrival-USB-Logic-Analyze-24M-8CH-MCU-ARM-FPGA-DSP-debug-tool
or Bus Pirate - DP

Whandall:
I was talking about something like
1set-New-Arrival-USB-Logic-Analyze-24M-8CH-MCU-ARM-FPGA-DSP-debug-tool
or Bus Pirate - DP

Thanks for the info, but i dont have access or are able to get one of those anytime soon.

So what i've done is setup two arduino uno's

one powered by a battery pack with a sketch to repeatedly send data with a nrf24 module, however the nrf module is not connected to the arduino. instead the ce, cs, sck, mosi, and miso that would be connected to it are connected to the other arduinos pins 8-12 respectively and a GND between the two, this other arduino is connected to the pc usb and has a sketch on it that is a SUMP compatible logic analyzer GitHub - gillham/logic_analyzer: Implementation of a SUMP compatible logic analyzer for the Arduino . and using https://www.lxtreme.nl/ols logic sniffer i captured some packets with the intent to figure out the channel and address the device I'm trying to reverse engineer is using by having something known to compare to.

What i have resulted in is this

Is that any use and if so what's next?

omnidir:
Is that any use and if so what's next?

That question suggests to me that what you want to do is far too complex for your present level of knowledge.

Put this project to one side and spend 2 or 3 months learning the basics of using an Arduino and the SPI system.

...R

Robin2:
That question suggests to me that what you want to do is far too complex for your present level of knowledge.

Put this project to one side and spend 2 or 3 months learning the basics of using an Arduino and the SPI system.

...R

ok, I'll be back soon and ill show you how it's done.

I have a simpler idea, if i understand you right you can unplug the nrf from the transmitter/receiver with unknown settings?
If that is so i would try and move the nrf powered to the arduino board and just read out the settings with rf24
If you can manage this without the nrf loosing power it should retain all settings.

I would connect the gnd from arduino and gnd from other board and power the nrf from arduino 3.3v (only from the arduino 3.3v leave the 3.3v from other board unconnected) and then just move it over... should work!

Best of luck!

swe-dude:
I have a simpler idea, if i understand you right you can unplug the nrf from the transmitter/receiver with unknown settings?
If that is so i would try and move the nrf powered to the arduino board and just read out the settings with rf24
If you can manage this without the nrf loosing power it should retain all settings.

I would connect the gnd from arduino and gnd from other board and power the nrf from arduino 3.3v (only from the arduino 3.3v leave the 3.3v from other board unconnected) and then just move it over... should work!

Best of luck!

you are a genius! thank you.

i was between here Embedded Innovation: nRF24L01+ sniffer - part 2 and here arduino uno - trying to discover other nrf24 modules - Arduino Stack Exchange

omnidir:
i was between here Embedded Innovation: nRF24L01+ sniffer - part 2 and here arduino uno - trying to discover other nrf24 modules - Arduino Stack Exchange

Then you know that there is also the address length and some CRC options that you need to know.

swe-dude:
I have a simpler idea, if i understand you right you can unplug the nrf from the transmitter/receiver with unknown settings?
If that is so i would try and move the nrf powered to the arduino board and just read out the settings with rf24
If you can manage this without the nrf loosing power it should retain all settings.

I would connect the gnd from arduino and gnd from other board and power the nrf from arduino 3.3v (only from the arduino 3.3v leave the 3.3v from other board unconnected) and then just move it over... should work!

Best of luck!

... It worked! got the details i needed.

STATUS = 0x0e RX_DR=0 TX_DS=0 MAX_RT=0 RX_P_NO=7 TX_FULL=0
RX_ADDR_P0-1 = 0xe7e7e7e7e7 0xc2c2c2c2c2
RX_ADDR_P2-5 = 0xc3 0xc4 0xc5 0xc6
TX_ADDR = 0xe7e7e7e7e7
RX_PW_P0-6 = 0x00 0x00 0x00 0x00 0x00 0x00
EN_AA = 0x3f
EN_RXADDR = 0x03
RF_CH = 0x02
RF_SETUP = 0x0f
CONFIG = 0x08
DYNPD/FEATURE = 0x00 0x00
Data Rate = 2MBPS
Model = nRF24L01
CRC Length = 8 bits
PA Power = PA_MAX

That was fast, I'm happy it worked for you.

swe-dude:
I have a simpler idea, if i understand you right you can unplug the nrf from the transmitter/receiver with unknown settings?
If that is so i would try and move the nrf powered to the arduino board and just read out the settings with rf24
If you can manage this without the nrf loosing power it should retain all settings.

Clever. I must remember this.

...R