Close
0%
0%

Vtech KidiGo Walkie Talkie Analysis

Analysis of a communication device for children.

Similar projects worth following
Analysis of a kids communication device.

Mostly a project to practice techniques and have a bit of RE fun. Project should cover basic PCB analysis, firmware recovery, and RF analysis.

Background

Found these devices on sale a few months ago and bought them with the intent to check out their innards. Most notably, the device claims to have "Encrypted Digital Communication" which I wanted to see for myself. I also wanted to practice recovering the firmware.

Goals

This is just a fun project for me to work on during downtime at home. Things I would like to do:

  • Dump the firmware and try to identify the processor
  • Analyze the RF signal
  • Identify the encryption and test the device's ability to stay secure

  • Initial Analysis and Review

    Jake R.01/20/2021 at 21:21 0 comments

    Overview

    Operational overview of the device and its features. Will cover the box and documentation for the device. Also, will look for online information about the device to see if there is any prior work done on the device. 

    Advertised Features

    We are looking at a pair of communication devices that allow its user to send encrypted voice and data. It is marketed to users age 4+ and has the following features listed on the front of the box:

    • Safe, Digital Communication
    • Two-Way Messaging
    • Backlit LCD Screen
    • Two-Player Games

    On the back of the box, statements are made for each of the listed items above. They are: 

    • Secure connection keeps other walkie talkies from listening in on conversations
    • Send preset animated messages and text-based phrases
    • Read messages and plat games - even in the dark!
    • Real-time gaming between walkie talkies

    No other information related to the device's features is listed on the outside packaging. 

    Device Review

    With help from my kids, I tested the features of this device, but haven't done any real measurements. We tested the effective range, and the communication features, which include voice communication and data transfer. 

    When the handsets boot, they look for a device to sync with. Once synced, the connection strength is shown using bars similar to cell phone signal strength indicators. We tested the range to be about 100ish feet in an empty parking lot. Not a reliable measurement by any means and will probably revisit. 

    Users can send voice data by pressing a button on the side and speaking into the microphone. Communication is half-duplex and the user is notified on the device's screen if the other handset is transmitting data. You can also transmit predefined messages and play games in real time. 

    To send a message, the transmitting user presses the emoticon/letter button and selects the message they would like to send. The receiving user is notified that a message has been received and is ready for viewing. 

    To play a game, one user initiates the communication by pressing the controller button and selecting a game. The other user must accept the invitation to play. Once the invited user accepts, the game starts and is played in real-time. 


    Device FCC Information

    Device has the following information on the back of the battery cover. 

    2.4GHz Type: RC

    FCC ID: G2R-5185 FCC INFO

    IC: 1135D-5185

    FCC report has some nice internal photos and information about the device. No schematics or block diagram, bummer. 

    Initial Analysis

    Pictures and physical inspection shows 4 chips of interest. 2 "glop" tops and 2 ICs. The two identifiable ICs are: 

    • Amiccom,  A7137,  2.4 GHz FSK/GFSK 10 dBm 2Mbps Transceiver
    • Unknown, AT24C02A, Two-wire Serial EEPROM

    Taking a guess that the EEPROM holds our processor payload. Possible encryption on the payload, and identification of the binary will be difficult since we are working with two unidentifiable parts. However, due to the amount of signals from one of the glop tops to the LCD, certainly one of the glop tops is a LCD driver. I am also going to speculate that the other is a DSP or other signal processing unit since it is located close to the transceiver chip. There are some test points that should provide some insight into the overall operation and taking a look at the EEPROM should also provide clues. 

    Future Goals

    The following are planed for the future.

    • Identify test points that would allow communication to the processors
    • Recover the data on the EEPROM

View project log

Enjoy this project?

Share

Discussions

Gabriel Rodríguez wrote 02/08/2022 at 10:54 point

I'm interested in replacing the screen in one of these devices. Do you have any advice on how to open them without cracking the case? After removing 4 screws on the battery section, the back cover is not budging in the antenna section. I cannot find any additional screwn, and the antenna is not coming out either. Any suggestions welcome!

  Are you sure? yes | no

Dan Maloney wrote 01/21/2021 at 17:25 point

How far walkie-talkies for kids have come! This is an interesting device, never knew these existed. Looking forward to further analysis.

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates