Texas Instruments CC2541 - How to receive data in Proprietary RF Mode?

Question

Could anyone share a complete project example how to setup registers and receive data in proprietary RF mode? Texas Instruments published only one example - PER Test which is very difficult to understand and modify. Ideally I'd like to disable as much stuff as possible and listen to raw data coming from demodulator.

Here is what I came up with so far:

#include "prop_regs.h"
#include "hal_board.h"

void halRfSetFreq(uint16 frequency);
void rxSetRegisterSettings(void);


void halRfSetFreq(uint16 frequency) {
    MDMTEST1 = 0x05; // 0 MHz IF
    FREQCTRL = frequency - 2379;
    return;
}

void rxSetRegisterSettings(void) {
        /***********************************************************************
        * CC2541 RX REGISTER SETTINGS
        */
        FRMCTRL0           = 0x40; //
        MDMCTRL0           = 0x06; // modem configuration
        MDMCTRL1           = 0x48; // modem configuration
        MDMCTRL2           = 0x7C; // modem configuration
        MDMCTRL3           = 0x23; // modem configuration
        SW0                = 0x34; // primary sync word byte 0
        SW1                = 0x12; // primary sync word byte 1
        SW2                = 0x00; // primary sync word byte 2
        SW3                = 0x00; // primary sync word byte 3
        RXCTRL             = 0x29; // receive section tuning
        FSCTRL             = 0x5A; // frequency synthesizer tuning
        LNAGAIN            = 0x00; // lna gain setting
        ADCTEST0           = 0x66; //
        MDMTEST1           = 0x25; // modem configuration
        LLECTRL            = 0x01; // lle control
        BSP_MODE           = 0x00; // bit stream processor configuration
        IVCTRL             = 0x1B; // analog control register
        RFC_OBS_CTRL0      = 0x08;
        RFC_OBS_CTRL1      = 0x09;
        OBSSEL0            = 0xFB;
        OBSSEL1            = 0xFC;
}




/***********************************************************************************
* @fn          main
*
* @brief       Main program
*
* @param       void
*
* @return      int (does not return)
*/
int main(void) {
    unsigned volatile char *p = 0;
    unsigned char i = 0;

    // Initialize Clock Source (32 Mhz Xtal), global interrupt (EA=1),  I/O ports and pheripherals(LCD).
    halBoardInit();

    // Clear radio data RAM (page 0)
    p = RFCORE_RAM_PAGE;
    for (i = 0; i < RFCORE_RAM_PAGE_SZ; i++) {
      *p++ = 0;
    }

    // Program sync word length to 32 bit and configure single sync word
    SW_CONF = 0;

    // Disable timer 2 events to LLE
    T2EVTCFG = 0x77;
    //Enable link layer engine prop mode
    LLECTRL = 0x01;
    RFST = 0x01; // CMD_Shutdown

    halRfInit();

    // Set correct register settings for continous rx.
    // Most settings copied from SmartRFStudio.
    rxSetRegisterSettings();

    // Set frequency.
    halRfSetFreq(2424); // 2440 MHz

    // Clear TASKDONE interrupt
    RFIRQF1 = ~0x40;
    //Send CMD_Rx_TEST to LLE.
    while (RFST != 0);
    RFST = CMD_DEMOD_TEST;
    while(1);
}

I hooked up my logic analyzer on P1_0 and P1_1 but it's silent.