Momentum-Apps

NRF24 scanner with logging and resend ability for Flipper Zero

An NRF24 driver for the Flipper Zero device. The NRF24 is a popular line of 2.4GHz radio transceivers from Nordic Semiconductors.
NRF24L01+ Enhanced ShockBurst packet decoder example using Python: nrf24_packet_decoder.py

Flipper Zero FAP file: Nrf24_Scanner.fap

Settings file (default addr.txt) format:

Rate: 0/1/2 - rate in Mbps (=0.25/1/2)
Ch: 0..125 - default channel
ESB: 0/1 (1 - Enhanced ShockBurst)
DPL: 0/1 (1 - Dynamic Payload Length)
CRC: 0/1/2 (CRC length)
Payload: 1..32 (bytes)
P0: address pipe #0 in hex (max 5 bytes, LSB last)
P1: address pipe #1 in hex (max 5 bytes, LSB last)
P2: address pipe #2, LSB in hex (1 byte)
P3: address pipe #3, LSB in hex (1 byte)
P4: address pipe #4, LSB in hex (1 byte)
P5: address pipe #5, LSB in hex (1 byte)
captured data in raw format, first byte = address # 0..5, Payload len if DPL
... up to MAX_LOG_RECORDS-1

In the list of the received:
Press OK - send the packet,
Long press OK - view addresses.







Decode the Packet Control Field and check CRC (long press OK in the list and then press '<' / '>').
ESB (Enhanced Shockburst) option must be turned off. Press '>' to decode CRC.



1 - pipe #
2 - Payload length (for valide packet must be 1..20 or 33 hex)
3 - PID (2 bit) + NO_ACK (1 bit)

PinOut from from NoComp/Frog

NRF24 pinout by UberGuidoZ

2/A7 on FZ goes to MOSI/6 on nrf24l01
3/A6 on FZ goes to MISO/7 on nrf24l01
4/A4 on FZ goes to CSN/4 on nrf24l01
5/B3 on FZ goes to SCK/5 on nrf24l01
6/B2 on FZ goes to CE/3 on nrf24l01
8/GND on FZ goes to GND/1 on nrf24l01
9/3V3 on FZ goes to VCC/2 on nrf24l01
IRQ/8 is left disconnected on nrf24l01 If the nRF module is acting a bit flakey, try adding a capacitor to the vcc/gnd lines! I've not tried the Plus model so it may have a bigger need for a cap. Otherwise, I haven't had any major issues. Anything from a 3.3 uF to 10 uF should do. (Watch your positive/negative placement! Negative to ground.) I learned if you wanna get fancy, include a 0.1 uF cap in parallel. The 3.3 uF to 10 uF will respond to slow freq changes while the 0.1 uF will respond to the high freq switching spikes that the larger one cannot. That said, a single 10 uF will likely suffice for the Mousejack attack. ¯\_(ツ)_/¯