Taking a look at the Spok T5 AES-128 encrypted pager. Super-low power draw, runs on a AA.
Quick rundown of ICs on board:
- STM32L151RBT6
- Si4463
- AT24C512C
As a bonus, there’s exposed programming pads under the battery! Presumably used to assign a pager number to it.
We’re gonna start with trying to work out an attack tree with our main mission to be able to decrypt messages in flight.