Table of Contents
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Introduction
The NRF receiver app decodes packets from nRF24L01+ transceivers made by Nordic Semiconductor. These are low-cost, low-power 2.4 GHz devices widely used in wireless keyboards, mice, game controllers, mini-drone remotes, and general hobbyist projects. They communicate using Nordic's proprietary Enhanced ShockBurst (ESB) protocol.
The app currently supports 250 kbps mode only. 1 Mbps and 2 Mbps modes are not yet implemented.
Protocol background
The nRF24L01+ operates in the 2.4 GHz ISM band on 128 channels spaced 1 MHz apart (channel 0 = 2400 MHz, channel 127 = 2527 MHz). Each packet consists of a preamble, a 5-byte address, a 9-bit Packet Control Field (PCF, containing payload length and packet ID), the payload (0–32 bytes), and a 2-byte CRC. The decoder verifies the CRC before displaying a packet — only packets with a valid CRC are shown.
Controls
- Frequency: The default is 2480 MHz (channel 80). Use the rotary encoder to step in 100 Hz increments, or click to open the numeric keypad. To scan a specific device, set the frequency to the channel it is using:
2400 + channel_numberMHz. Many devices hop across multiple channels; scanning manually or sweeping with Looking Glass first can help identify active channels. - AMP: RF preamplifier — 0 = off, 1 = on (+14 dB).
- LNA: Low Noise Amplifier gain (0–40 dB).
- VGA: Variable Gain Amplifier / baseband gain (0–62 dB).
- Modem setup: Opens the modem configuration screen. The app auto-configures the modem on launch; this button is available for manual adjustments.
Display
Decoded packets are shown in the console area as hex bytes, formatted as:
addr: AA BB CC DD EE data: XX XX XX XX ...
Each line represents one received packet that passed the CRC check. The address field is always 5 bytes. The data bytes that follow are the payload content.
Limitations
- Only 250 kbps data rate is supported. Devices transmitting at 1 Mbps or 2 Mbps will not be decoded.
- No channel hopping — the receiver listens on a single fixed frequency. Devices that use frequency hopping must be caught on the right channel.
- The HackRF's 2.4 GHz sensitivity is limited. Passive reception is possible but range is short compared to dedicated 2.4 GHz receivers. Placing the antenna close to the transmitter improves results significantly.
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Start here
Contributors
How to collaborate
Contributing Guidelines
How to ask questions correctly
Hardware
- PortaPack Versions (which one to buy)
- Features
- HackRF Versions
- Description of the hardware
- Enclosure/cases
- Repairs
- Mods
User manual
Intended use and Legality
- Usage cautions
- First steps
- Firmware update procedure
- User interface
- Powering the PortaPack
- Troubleshooting
- Won't boot
- Config Menu
- Firmware upgrade
- Diagnose firmware update in Windows
- Receive Quality Issues
- No TX/RX
- TX Carrier Only
- H2+ speaker modifications
- Dead Coin Cell Battery
- Factory Defaults
- SD card not recognized by PC with the SD-card over USB selected
- DFU overlay
- Full reset
- SolveBoard
- How to Format SDCard
- What if I don't like some of the apps
Applications
- 📥 Receivers
- 📤 Transmitters
- ADS-B(S) TX
- Adult Toys
- APRS TX
- BHT Xy/EP
- BLE TX
- BLESpam
- Burger Pager
- CVS Spam
- EPIRB
- FlipperTX
- GPS Sim
- Hopper
- Jammer
- KeeLoq TX
- Key fob TX
- LGE Tool
- MDC-1200 TX
- Morse TX
- OOK
- OOK Brute
- OOK Editor
- P25 TX
- POCSAG TX
- RDS
- RTTY TX
- SAME TX
- Signal gen
- Soundboard
- Spectrum Painter
- SSTV
- TEDI/LCR
- TouchTunes
- TPMS TX
- 🔄 Transceivers
- 🟡 Recon
- 🔴 Capture
- ▶️ Replay
- 🖲️ Remote
- 🔍 Looking Glass
- 🛠️ Utilities
- 🎮 Games
- ⚙️ Settings
- 💻 HackRF Mode
Misc
Developer Manual
- Compilation of the firmware
- Compile on WSL with ninja
- How to compile on Windows faster with WSL 2
- Using Docker and Kitematic
- Docker command-line reference
- Using Buddyworks and other CI platforms
- Notes for Buddy.Works (and other CI platforms)
- Using ARM on Debian host
- All in one script for ARM on Debian host
- Compile on Arch based distro (exclude Asahi), or other weird distros
- Dev build versions
- Notes About ccache
- Create a custom map
- Code formatting
- PR process
- Description of the Structure
- Software Dev Guides
- Tools
- Research
- UI Screenshots
- Maintaining
- Creating a prod/stable release (Maintainers only)
- Maintaining rules
- Development States Notes
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Note
The wiki is incomplete. Please add content and collaborate.
Important
- This is a public wiki. Everything is visible to everyone. Don't use it for personal notes.
- Avoid linking to external tutorials/articles; they may become outdated or contain false information.