Search results for: nrf24L01

Sniffing and Decoding NRF24L01+ and Bluetooth LE Packets with the RTL-SDR

Omri Iluz wrote in to us to let us know about his recent project which involves sniffing and decoding wireless packets at 2.4 GHz from NRF24L01+ and Bluetooth Low Energy (BTLE) transceivers. The NRF24L01+ is a popular wireless transceiver which is used in many common devices such as keyboards, mice, remote controls, toys and appliances.

Since 2.4 GHz is out of any of the RTL-SDR’s receivable range, Omri used a cheap downconverter which he was able to buy from China using Aliexpress. The downconverter converts the 2.4 GHz signal into a lower frequency at around 400 MHz which is in the receivable range of the RTL-SDR.

He was then able to use his NRF24-BTLE-Decoder software that he developed to convert the received data from the NRF24L01+ transceiver into a decoded packet by simply piping the output of RTL_FM into his program.

Since the NRF24L01+ uses hardware similar to the Bluetooth Low Energy (BTLE) protocol, Omri was able to modify his code to be able to also decode BTLE packets.

2.4GHz NRF24 packet received on the RTL-SDR from a Logitech mouse using a downconverter
2.4GHz packet received on the RTL-SDR + downconverter from a Logitech mouse
decodednrf
Decoded NRF24 Packets

Sniffing ANT-FS with an RTL-SDR and MMDS Downconverter in Pothos

ANT-FS is a wireless file transfer protocol that is designed specifically for transferring files wireless between two devices. It is designed for ultra low power devices and typically runs on devices operated by a coin sized battery. It is commonly used in applications like fitness tracker devices, which store data to later be downloaded to a PC.

Over on YouTube user sghctoma has uploaded a video showing a teaser of him receiving and decoding ANT-FS packets with blocks developed for the POTHOS graphical language. As ANT-FS is usually transmitted at 2.4 GHz, he had to use a MMDS downconverter which allowed his RTL-SDR to receive the packets. Sghctoma writes that the video is simply a teaser, and that a live demo with real deivce, and the full code + details will be released during his talk at DEFCON titled “Help, I’ve got ANTs!!!”.

ANT-FS sniffing with RTL-SDR, an MMDS downconverter and Pothosware

Stealing a Drone with Software Defined Radio

PHDays (Positive Hack Days) is a yearly forum with a focus on ethical hacking and security. During this years forum which took place in June, the organizers set up a competition where the goal was to “steal” or take control of a Syma X8C quadcopter drone. The drone runs on the nRF24L01 module, which from previous posts we have seen can easily be sniffed and decoded with an RTL-SDR or other SDR.

To reverse engineer the drones wireless communications system the teams used software defined radios like the HackRF and BladeRF, and also an alternative method involving just using an Arduino and nRF24L01+ receiver chip. Once the signal was received, they used GNU Radio to decode the signal into packets of data. After analyzing the data they found that the data bytes were easily reverse engineered and then were able to transmit their own data packets to control the drone. The post goes into further detail on the specifics of the reverse engineering.

The Syma X8C drone to be stolen in the competition.
The Syma X8C drone to be stolen in the competition.

Sniffing “Crazyradio” NRF24 Signals with a HackRF Blue

Thanks to DangerousPrototypes.com we’ve heard about this project in which experimenter Arnuad has been using his new HackRF Blue to sniff and debug the communications protocol from the Crazyradio which is used on the Crazyflie quadcopter. The Crazyradio is a 2.4 GHz radio transceiver dongle that uses the nRF24 chip. It is designed to be used with the Crazyflie quadcopter.

By using a Python script to make the Crazyradio constantly transmit, and then by using GNU Radio, Arnuad was able to sniff and demodulate the GFSK signal from the nRF24 based Crazyradio and pipe the demodulated signal into a nRF24 decoder

Decoded NRF24 Packets from the Crazyradio.
Decoded NRF24 Packets from the Crazyradio.

The BIG List of RTL-SDR Supported Software

There are now dozens of software defined radio packages that support the ultra cheap RTL-SDR. On this page we will attempt to list, categorize and provide a brief overview of each software program. We categorize the programs into general purpose software, single purpose software, research software and software compatible with audio piping.

If you know of a program that is missing please leave a comment in the comments section at the bottom of the page.

13/02/2014 - Added Sodira, gr-wmbus, rtlsdr-waterfall, QTRadio, multimon, sdrangelove, lte-scanner, rtl_tcp, rtl_sdr_FS20_decoder.
17/02/2014 - Updated the Linrad description.
28/04/2014 - Added Modesdeco and Trunk88.
30/05/2014 - Added RTL Panorama, RTL SDR Panoramic Spectrum Analyzer, Chrome Radio Receiver, SeeDeR, DAB Player, RTL SDR Installer, PD/Max Wrapper, SDRWeather, LTR Analyzer, softEOT/softDPU and ScanEyes.
26/07/2014 - Added PiAware, OOK-Decoder, rtl_fm_python, rtl_power heatmap viewer, RTL Bridge, threejs-spectrum, CANFI Software, PNAIS, FLARM Decoder, Xastir, RTLSDR-Airband, SDRTrunk.
13/11/2014 - Added Touchstone, RFAnalyzer, RTL1090 XHSI Interface, Parus Decoder, PlotRTL1090, LRPT Decoder.
05/02/2015 - Added rtl_tool_kit, CubicSDR, OregonWeather, FreqWatch.
15/04/2015 - Added ADSBox, YouSDR, FlightAware Flight Feeder, Frequensea, Track your flight EUROPE, QSpectrumAnalyzer, Doppler & Demod, Redsea, rtl_heatmap, gr-gsm, driveby, SDRecord.
23/12/2015 - Added Remote rtl_udp, AISRec, dump978, AISDeco2, SDRrecorder, OpenWebRX, dsame, RTL-Widespectrum, rtl_ais, rtl_gopow, ham2mon, rtl_ais_android, inmarsatdecoder, spektrum, qtcsdr, rtl_power_fftw, JAERO, GNSS-SDRLIB, SVxLink.
8/09/2017 - Added inspectrum, gr-isdbt, telive, tetra-listener, gr-iridium, SDRuno, luaradio, rx_tools, kukuruku, chronolapse, cloud-sdr, natpos, d3-waterfall, SDRDue, gqrx-ghostbox, ships, rtlmic, tsl-sdr, universal radio hacker, dumpvdl2, re-dected, aerial-tv, questasdr, welle.io, spyserver, dspectrumgui, atcsmonitor, NRSC5 HD Radio Decoder, leandvb, imsi-catcher, block stream receiver, salamandra, deinvert, RS.
6/11/2017 - qradiolink
15/06/18 - Zeus Radio
11/01/19 - SCEPTRE
13/01/20 - VDLM2DEC, Blockstream Satellite, TempestSDR, rtlsdr-wsprd, rtl_map, Radwave, radiosonde_auto_rx, XRIT Decoder, SATNOGS, SigintOS, RadioCapture, EMI_Mapper, xrit-rx (KOMSAT 2A), RTLion, WSJT-X, noaa-apt, rtlSpectrum, fingerprinting_radios_w_ML, mySdrPlayback, QO-100_SSB-WebSDR_DATV-WebSpectrum, goestools, SigDigger, Tekmanoid EGC, Scytale-C, PEPYSCOPE, iridium-toolkit, Electrosense, ORBCOMM-receiver, r2cloud, coole-radar, vor-python-decoder, IridiumLive, radio_analyser, DSDPlusUI, retrogram-rtlsdr, vortrack, rtl_power-fm-multipath, glrpt, Spektrum SV Mod, gammaRF, SegDSP, rtl-ultrasound, radiosondy.info, OP25, RS41 Tool, TETRA Trunk Tracker, meteor_demod, FreqShow, rtl_tcp SDR, PLSDR, SDR Receiver, Echoes, rtlmm, FM2TXT, cnn-rtlsdr, Meteor Logger.

General Purpose RTL-SDR Software

We define general purpose SDR software as programs that allow the RTL-SDR to work like a normal wideband radio receiver.

SDR# (Windows) (Free)

SDR#
SDR#

SDR# (pronounced "SDR Sharp") is the most popular free RTL-SDR compatible software in use at the moment.  It is relatively simple to use compared to other SDR software and has a simple set up procedure. We have a full overview of the installation procedure on our Quick Start Page. SDR# is designed to be use with the $199 Airspy SDR, but works just fine with the RTL-SDR.

SDR# is a simple to use program that also has some advanced features. It has a useful modular plugin type architecture, and many plugins have already been developed by third party developers. The basic SDR# download without any third party plugins includes a standard FFT display and waterfall, a frequency manager, recording plugin and a digital noise reduction plugin. SDR# also decodes RDS signals from broadcast FM.

HDSDR (Windows) (Free)

HDSDR
HDSDR

HDSDR is based on the old WinRAD SDR program. HDSDR supports the RTL-SDR through use of an ExtIO.dll module. To install HDSDR, download the program from the link on the main HDSDR page, then to use the RTL-SDR you will need to download the ExtIO_RTL2832.dll file an place it into the HDSDR folder. When opening HDSDR, select the newly copied ExtIO_RTL2832.dll. The other dlls that come with HDSDR will not work with the RTL-SDR, even though they have RTL-SDR in their filename. The official installation instructions can be found here.

Along with a FFT display and waterfall, HDSDR has some extra advanced features. Users will also find an Audio FFT and waterfall display on the bottom of the screen. The output audio can also be bandpass filtered by dragging the filter borders on the display. Bandpass filtering the audio can really help clean up a noisy signal. The audio processing also supports placing of notch filters either manually or automatically. There are also noise reduction and noise blanker features and an automatic frequency centering algorithm which will automatically center the signal, so you don't need to click exactly in the center of a signal. Traditional ham radio users will also enjoy the S-units signal strength meter and the built in frequency manager.

SDR-RADIO.COM V2/V3 (Windows) (Free)

SDR-RADIO.COM V2
SDR-RADIO.COM V2

SDR-RADIO.COM V2 and the newer V3 is a popular SDR program with many advanced features. As such is it a fair amount more difficult to learn and use compared to SDR# and HDSDR. Be sure you install version 2 and not V1.5 as only V2 has RTL-SDR support.

Once sdr-radio is installed, to get it working with the RTL-SDR you will need to compile or download three .dll files (SDRSourceRTL2832U.dll, rtlsdr.dll and libusb-1.0.dll) and place them into the sdr-radio folder. To compile your own dlls see the instructions here, otherwise download the dlls directly from the bottom of this link. If the dlls were placed in the correct folder you will be able to add your RTL-SDR as a receiver by clicking on the +Definitions button, and then finding and adding the RTL SDR (USB) option under the search drop down menu.

Like HDSDR, not only does sdr-radio have a RF FFT signal and waterfall display, but also an optional audio spectrum FFT and waterfall display. Built in are also several DSP features like a noise blanker, noise reduction filter, notch filter and squelch options. The EMNS noise reduction filter is particularly good at automatically cleaning up and clarifying voice signals.

To add to the feature list, sdr-radio also has built in PSK, RTTY and RDS decoders, and also comes with a satellite tracker. Furthermore, sdr-radio V2 (not V3 yet) has an excellent remote server which will allow you to easily set up and connect to a remote RTL-SDR server over a network or the internet. Finally, sdr-radio is capable of listening to up to 6 signals in the same chunk of visible spectrum at a time.

Continue reading

NRF905 RTL-SDR Decoder

The NRF905 is a multiband RF tranceiver IC that uses frequencies in the ISM bands. Fabien le mentec posted about a project where he wanted to remotely monitor his garage door status using a microcontroller and the PTR8000 wireless module which contains the NRF905 chip.

In order to validate that his hardware settings were set correctly and that the NRF905 was transmitting correctly, he used an RTL-SDR and his recently written NRF905 decoder program to check the output frames.

Recently, we posted a similar project involving the NRF24L01+ wireless tranceiver where a decoder for that had been written as well.

PTR8000 Wireless Transceiver with the NRF905 Chip
PTR8000 Wireless Transceiver with the NRF905 Chip