Hi, I just documented my journey to sniff and decode popular digital wireless protocols off the air for very cheap. So cheap practicality anyone can obtain the equipment quickly.
I was able to decode NRF24L01+ and Bluetooth Low Energy protocols using RTL-SDR. As far as I can see, this is the first time the NRF24L01+ is being decoded, especially considering the low entry price for the hardware. Given the extreme popularity of this transceiver, we are likely to see a wave of hackers attacking the security of many wireless gadgets, and they are likely to succeed as security is usually the last priority for hardware designers of such cheap gadgets.
Nice work. I created an implementation that extends the Teensy DMA method and does not use any software/interrupts beyond setting it up initially. 100% of the work is handled in the hardware by timers and DMA, outputting a buffer to the ports. This saves you from the timing critical aspects of the Teensy implementation and allows you to simply write to a framebuffer and have the framebuffer flush to DMA in the background.
I hope to find time and post on my blog a detailed description of how it works, you can look at the code, it's pretty self explanatory. I'm happy to answer any questions.
