user11249: I have a remote control that has an STM32 MCU and sends data via NRF24L01. What I would like to do is clone the data sent when buttons are pressed by reading what is being sent to the RF24 and then replicating these messages with my own "remote".
I have tried sniffing the data wirelessly with my Pro Mini and NRF24L01. I have everything plugged in correctly, the BasicExample seems to be running fine, but when I run a promiscuous channel activity sniffer, I don't get any wireless data, not even running wifi and bluetooth near the NRF. Pro Mini is 5V and NRF sniffer is powered by an external 3.5V battery with cap on VCC-GND, ground is common to Pro Mini. I have also tried the WireShark approach, but with 0 packets found.
Therefore I want to try it directly wired to the remote. I don't have a logic analyzer handy. How would I read the data? By just connecting MISO and CS to an arduino and running an SPI reader? What would be the best way to do this? I have the Pro Mini and many Teensy boards ready.

user13432: That was an interesting challenge. There are some obstacles to consider when trying to use RF sniffing:

What channel is used? (128)
What bit-rate is used? (250K-1M-2M)
How many address bytes? (3-5 byte)
How many bits in CRC? (1-2 byte)
Auto-Acknowledgement? (1 bit)
etc.

Without any info on the remote NRF configuration this is tedious to break. Probing the hardware signals (MISO, MOSI, SCK, SS) on the remote NRF chip with a logic analyzer seems (much) easier. 
Cheers!

11249: <p>I have a remote control that has an STM32 MCU and sends data via NRF24L01. What I would like to do is clone the data sent when buttons are pressed by reading what is being sent to the RF24 and then replicating these messages with my own "remote".<br></p>

<p>I have tried sniffing the data wirelessly with my Pro Mini and NRF24L01. I have everything plugged in correctly, the BasicExample seems to be running fine, but when I run a promiscuous channel activity sniffer, I don't get any wireless data, not even running wifi and bluetooth near the NRF. Pro Mini is 5V and NRF sniffer is powered by an external 3.5V battery with cap on VCC-GND, ground is common to Pro Mini. I have also tried the WireShark approach, but with 0 packets found.</p>

<p>Therefore I want to try it directly wired to the remote. I don't have a logic analyzer handy. How would I read the data? By just connecting MISO and CS to an arduino and running an SPI reader? What would be the best way to do this? I have the Pro Mini and many Teensy boards ready.</p>
 13432: <p>That was an interesting challenge. There are some obstacles to consider when trying to use RF sniffing:</p>

<ol>
<li>What channel is used? (128)</li>
<li>What bit-rate is used? (250K-1M-2M)</li>
<li>How many address bytes? (3-5 byte)</li>
<li>How many bits in CRC? (1-2 byte)</li>
<li>Auto-Acknowledgement? (1 bit)</li>
<li>etc.</li>
</ol>

<p>Without any info on the remote NRF <a href="http://www.nordicsemi.com/eng/content/download/2730/34105/file/nRF24L01_Product_Specification_v2_0.pdf" rel="nofollow">configuration</a> this is tedious to break. Probing the hardware signals (MISO, MOSI, SCK, SS) on the remote NRF chip with a logic analyzer seems (much) easier. </p>

<p>Cheers!</p>
