Electronic – Difference between 2.4Ghz ISM and IEEE 802.11 frequency bands

You could split data rate into two halves and use two separate Nordic modules for transmission and two separate modules for reception. Each pair can be set to transmit and receive on different channels.

It's not elegant but it halves the problem. I bet it would work with several pairs. Just a thought.

Well, I have found two main ways to sniff and decode NRF24 communication:

• Using RTF-SDR with a MMDS down converter to slow down the fast 2.4Ghz communication to around 400Mhz (by Omri Iluz)
• Using dedicated hardware (Custom made NHBadge12 in this case) and an open source project called GoodFet.NRF which extends the GoodFet open hardware/software project (by Travis Goodspeed).

Both methods comes with detailed instructions on how to perform promiscuity scan of NRF24 addresses (the hard part), allowing to find the specific address of the keyboard to reverse. This task is not trivial since the base address length can be up to 4 bytes, which leaves us with too much combinations to brute force.

After the base address is found, and a solid sniffing channel is established with the keyboard, it is relatively easy to extract the XOR encryption key used to encrypt communication between the keyboard and the lost dongle. With the key it is almost trivial to reconstruct the original communication between the wireless keyboard and the missing dongle, and there are more than enough ways of achieving that, one even includes using Arduino with DFU upgrade.

An interesting fact to note is that the XOR encryption key can be easily extracted once the NRF24 base address is established, since HID packets usually contain many zeros - 0 - and XOR between the encryption key and zeros reveals the key, sometime more than once in a single packet! :) )

There is also a porting of the Goodfet to arduino, but I couldn't find good examples on how to use it properly on an Arduino based MCU.