reverse engineering "encrypted" vtech walkie talkie

An analysis of a VTech kids walkie talkie to extract data and evaluate its claimed AES encryption using a microcontroller and bus sniffing.

VTech claims this KidiGo kids walkie talkie has AES encrypted voice. i have an insatiable urge to discover the contents of electronic devices. you bet we are gonna see whats inside it :3 AND do some bus sniffing and data extraction with a microcontroller! *hyperlinks* for the chips: - the transceiver chip with the dreaded "32 bits key length" is an Amiccom A7137: web.archive.org/web/20231130143456/http://www.amiccom.com.tw… - the 2kb EEPROM is an Atmel 24C02A: ww1.microchip.com/downloads/en/devicedoc/doc0976.pdf for the software: - pico-i2c-sniffer by jjsch-dev: github.com/jjsch-dev/pico_i2c_sniffer articles and stuffz: - product page and manual: vtechkids.com/product/detail/19070/KidiGo_Walkie_Talkies - this is the article i got the "aes encrypted" quote from: which.co.uk/news/article/kids-karaoke-machines-and-smart-toy… (they say they sent it off to some security group to look at. but i dont really think the threat vector they are talking about , someone intercepting the pairing process slash key exchange , is really very feasible.. which is funny because its possible the entire thing is not meaningfully encrypted anyways if it rlly does use that AES32) - also, one Jake R started taking a look at this device a few years ago! hackaday.io/project/176980-vtech-kidigo-walkie-talkie-analys…