Make Teensy a 2.4 GHz Receiver

(2+2+2+3+80) = 89 different combinations
5 settings that have to be selected

89C5 = 41,507,642 possibilities

You could make a circuit to spoof press a button and check for feedback but eduardo is right. This will take years.

You need a logic analyser to decode the setup information the presenter is sending to it's radio chip. From this you could theoretically divulge the setup parameters you'd need in your radio

Exactly.
As with many other threads there is one easy way to start: use a proven example/setup as a start and then go on reading the data sheets and deepen your knowledge.
As questions rise people will answer them for you one by one.
Buy a SALEAE is you whish and get used to it. It is a professional product and has good software and manuals.

I definetely see your point, but how does such a logic analyser work? I never worked with it before? Do I have physically connect it to my Teensy? Or to the presenter? Or does is receive the wireless signals?

Physical connection. Take a look at wikipedia and SALEAE. You connect it to the lines between teensy and nRF. You may have to solder a cable to the one connecting.

Okay, so I might or I even have to unsolder my wires again? (because as I said, both are already connected and the wires are soldered directly to the pins...)

You need to connect to the presenter. Not your circuit

Google isn't getting any hits for the chips with visible part numbers. IF they had it might have been possible to snoop traffic between a controller and the RF component to try and pull out the settings the RF leg is using by reading up what the control format was. The RX end seems to be using a single chip solution so that's not very helpful since that would involve pulling software out of an unmarked IC and that's pro territory.

The transmit end is labelled as NRF (nordic semiconductor) but number isn't making sense, so either it's a custom run or somebody has just labelled their own 2.4ghz IC with 'NRF' to improve sales (or my google skills are weak).

Which means unless you can find some other marking on the chips or the board itself that gets a google hit listing the interface in use the only opening would be use a software defined radio as listed in the first post. The module you have on the Teensy has been carefully designed to remove all the complexities of an RF link and invisibly move data from transmitter to receiver without letting other units interfere. Units like the presenter, so you would need to blindly try settings in the hope of lucking in to the right address and settings. The address alone will have run times of over a century at one try a second.

The logic tools would only work if there was separate controller and RF units, but these appear to be combined so the relevant signals are inside the IC and inaccessible unless you feel like playing with fuming nitric acid.

The software defined radio would allow you to see everything happening in the 2.4ghz band which is I think what you thought your module would do. Before heading down that path remember you still need to:
get your SDR working
identify your presenter amongst all the other users of 2.4Ghz (or use a Faraday cage)
identify what structure it uses
Identify what settings/addresses within that structure it uses (and hoping it's not a rolling code)
Find a module that supports that structure, and program it correctly
Then pull apart the message structure so you can interpret it

http://v3gard.com/2014/12/hacking-garage-door-remote-controllers/

None of this is impossible but will involve some book work. Hence the suggestion early in this thread that the quick solution to making things work would be to build your own presenter, or buy a remote with a documented interface.

Okay, that sounds interesting... Could I for example also use SDR to figure out the exact parameters and then use my nRF24 to actually receive them later? I also found that but I'm really not sure if that is what I'm looking for....

If using SDR, how does this work? Is that a "little circuit" ilike nRF24 as well, which I can just connect to a Teensy and then look for the signal of the presenter?

nRF24 like most such data radios has limited flexibility in how packets are constructed. Not flexible enough for a true software defined radio (SDR). Real SDRs generate baseband waveforms using complex math and fast Digital to analog converters (DACs). Then RF mixers and filters up-shift the baseband to the transmitted frequency band. And vice-versa on the receive side. Very complex.

Complicating this is that the nRF24 is a super low cost, super low power (2mW) radio and thus it is, what it is.

Yes, idea would be to use the SDR to pick apart the waveform, and crossing your fingers that it's one you can then set the NRF to. High probability you won't since other than that single NRF label on the IC there is nothing to say that the presenter designer happened to use the formatting of an nRF24. The page you linked to does step through how to make a sniffer that may pull the addresses out but you'd have to change the code to adapt for use with Teeny, and you'd be running an executable from a random part of the internet if you follow it exactly.

I'd be tempted to make it a purely Teensy application but that would involve more work to get you going. Depends I guess on if you are already all over using wireshark. Key part here if you read through the text is that they are abusing the nRF by loading invalid data to it which means about 10% of the messages not intended for it will in fact show up, along with a whole bunch of random noise. The wireshark part is to try and filter the noise and unwanted device transmissions out for you, where as the linked goodfet page does it by hand

And remember there are still some settings you'd be needed to step through randomly so potentially need to try several times.

So yes, that page and the linked goodfet do discuss how to make an nRF24 provide data not intended for it, some of the time. If the presenter happens to be using a compatible waveform. On the other hand it only requires hardware you already have so the dollar cost is low to give it a go. Neither page provides an example that you can just load and go, so you'll be needing to read up and work out which example code you want to start with and modify for your needs so time cost will not be zero.

Thanks for your detailed answer. Getting very interesting, hope I can do that... Also ordered a logic analyzer and a second Teensy to test the function of the nRF24 with a second nRF (just to make sure it's at least working).

Getting to wireshark: You mean, first follow the example of the sniffer to capture every traffic and then filtering the packets with wireshark?

And how can I use the SDR (can I use my nRF as SDR in that case?) to pick apart the waveform sent by the presenter?

Please apologize that I'm really not familiar with transmission technology as I'm really new to it, so I need some food for thought to get some progress....

nameless said:

... (can I use my nRF as SDR in that case?) to pick apart the waveform sent by the presenter?

Please apologize that I'm really not familiar with transmission technology as I'm really new to it, so I need some food for thought to get some progress....

Click to expand...

nRF as SDR. No.

You could study a bit of electronics and Radio principles. Then get a ham license from a local club's testing process. And join in ...
http://www.arrl.org/software-defined-radio

http://sdr-radio.com/

Some interesting news: According to this post, the RF inside is not the one I said, but a CYRF69103, does this change something?

http://blog.teusink.net/2010/07/hacking-wireless-presenters-with.html

Check out the section. "Sniffing the bus"

Xenoamor said:

http://blog.teusink.net/2010/07/hacking-wireless-presenters-with.html

Check out the section. "Sniffing the bus"

Click to expand...

I saw that, but it's the wrong presenter he's using in that section, the R400 is the bottom section of the article...

The CYRF69103 is the same. Thus the sniffing will be the same.

This should give you an idea of how to read the SPI configuration data being sent to the CYRF69103 which is essential in decoding what it's sending

Xenoamor said:

The CYRF69103 is the same.

Click to expand...

Acording to his information, it's a CYRF6936 on the other one, which has the radio and the processor seperated, whereas the CYRF69103 has this together, but you're right, sniffing should propably anyway go in the same direction... Ordered a Saleae Clone and hope for it to work as I want than... If I at one point figured out what Signals are exactly sent by the presenter, it's not too hard any more to implement them for the Teensy to receive them, right?

Did you look at the photo's in the teusink blog? From my quick look neither of the two circuit boards shown looked like yours, and theirs had a sensible marking on the IC.

Now this isn't to say it isn't but the next step for you was to hit google for 'CYRF89103 data sheet' and see if the first couple of pages show a chip pinout. Then look to see if it bears any resemblance to what you have on the board (number of pins, markings, antenna, battery connections, the test points they used). If you have then would be the time to post saying what your detective work had found, or at least a link to the data sheet. The fact it's got a NRF marking on it would be odd on a Cypress part, unless you can find something in the Cypress data sheet showing that it's a date code or something.

This is your project, not ours so checking if your board and a blog post's are identical, similar or completely different is your job.

End Rant

Looking at the board and the layout I'm suspecting they are from the same design team. The blog post is from 2010, they don't show the underside of the board but I think yours has a 2013 date on it (when did you buy it?) tech components have a life of 6-12 months in many cases so the parts used in 2010 will no longer be available for a designer to use unless they pay a premium. Instead they progress through similar parts that are better and cheaper. And just may have the same interface if you are lucky.

So you do in fact have test pads on your board. The question is, do they line up in anyway with the ones in the blog? Their technique may work but unless you can confirm the IC really is related to a CYRF then there will be some random poking to do before you start. SPI has two pins (clock and data) so if you are ordering a logic analyzer then it would be possible to find if they exist by trial and error. See:
https://en.wikipedia.org/wiki/Serial_Peripheral_Interface_Bus

All of this will be much easier if you do in fact have the same PCB as the one they used, or at least a set of pads that appear to be connected in the same pattern, since while the boards change a lot they don't change the test jigs if they can help it, so those test points may in fact do the same thing just for new hardware.

Re wireshark. It's a complex tool that among other fun things allows filtering of MAC addresses. If you have used it before and know what you are doing then it would be a fast way to sort the semirandom spew the nRF hack will produce. If you haven't used it before then it'd be perfectly possible to dump the data into excel or something instead and sift it by hand. Takes longer, but skips learning a whole new tool for a single job.

Depends on what skills you already have, and which ones you want to learn.

Edit re SPI - has four or more wires, but if it's a debug interface you'd be probing just for clock and data out to monitor what it's up to.

You should probably buy a matching radio chip for your Teensy side if you can.
It's unlikely your nRF chip will be able to communication with it, but I doubt anyone can say for sure until you try it

@GremlinWrangler: Already searched for the datasheet you can find here and also already found the pinout on page 6, but had no idea, how to "use " it now.. The board looks a bit different, but has a lot of similarities as well, but I actually can't read what's on the first IC on his picture (where I read NRF 31512c)....
I bought this presenter maybe about 3 months ago, so it's quite new, but I still don't know when it was prdocued (still could be possible, that it was in their stock for a long time)...
I worked with wireshark 1 or 2 times, so I think, that's not what you can call that I'm used to it, so maybe sth. like Excel would be quite more easy for me then..

@Xenoamor: A matching radio chip would be just the similiar as on the presenter's circuit? Or on the original receiver (where I can read NRF B 31562A 1512BX)?

If running on the assumption it's a Cypress you'd go to page 6. So to see what it's up to you'd look for a test pointd on pin 26 and 28 (clock and data). This is assuming that it is in fact 40 pin IC on yours, that the antenna is connected to pins 11 and 13, the battery +ve is connected to 6 and 9 (47 ohm R on 9) and bat -ve to pin 12. Use a multimeter for this unless they are really easy to trace by eye, and suggest removing the batteries to make shorting those tiny pins less exciting.

If all of those do line up then it doesn't guarantee that it's the IC, but it's looking better. If it doesn't line up then you have some other IC and that gets tedious real fast since there is no easy way to reverse search a couple of known pins. Though it might be worth checking some of the nRF family to see if there are any likely matches there.

Re Xenoamors question either IC would help if they were marked in some way that allowed you to find them, and even if you had the wrong end would potentially allow you to prove/disprove how the other end worked. All of this is moot while you can't ID them in some way (signal analysis, markings, pin mapping, board markings, similar boards).

What I'm wondering about is: Is it possible at all, that it's a Cypress, when I read NRF 31512c on it? (or doesn't that belong together)?

It'd say unlikely, but then again the NRF number isn't lining up with anything either. And I've been wrong before, hence the suggestion to check pins and look at the data sheet for what markings it should have to allow a more concrete assessment.

My personal hunch is that this is a clone supporting some mixture of Nordic encoding schemes. That's just my guess though, and even if correct doesn't narrow the field much in terms of what to look for.

Okay...

Just got my Logic Analyzer today, how can I use it now to figure something out? Connect it with the Teensy (and the nRF)? Or on the presenter circuit somewhere?

I'd suggest starting with the clock and data lines to the nRF

This won't find anything about your remote but will give you a test case that you know is doing stuff and which pins are where to learn how your new toy works (and also confirm it does in fact work). Idea would be to try and decode what is going on using info from around page 18 of
https://www.sparkfun.com/datasheets/RF/nRF2401rev1_1.pdf
or possible other places that google points you at, given that one is fairly basic and assumes a lot of stuff.

If you can get things working well enough that you can decode a known interface, then it's time to try an unknown one and find some data pins on the remote, noting that you don't know what that is, what interface it uses or if there is anything at all to look at so you'll need to have had at least one practice run first. Also suggest a trawl through the tutorials for the thing before getting to stuck into the remote.

It's quite possible that all the activity of interest is inside the chip and inaccessible to a logic analyzer, but as was noted in the Cypress docs it's not impossible that they have brought out some pins out to pads for diagnostic purposes.