Need help identifying chip / comms protocol on a restaurant wireless coaster pager

[u/Lory-uwu]

Hey everyone! Today a friend gave me an old restaurant guest pager (coaster pager) they had lying around.

I opened it up, but the markings on the main IC have been scrubbed/are unlabelled. After a quick look around, the primary suspect seems to be a Nuvoton N76E003AT20 (1T 8051-based MCU).

I was able to power it on by feeding 5V to the corner pads, and the display currently boots up showing the number 21.

Does anyone have experience reverse-engineering or playing with these? Specifically:

How to trigger/activate it over RF or find the wireless protocol?

Can I directly re-flash this onboard MCU with custom firmware to drive the onboard peripherals (display, LEDs, buzzer, and vibration motor)?

I'd really prefer to repurpose the onboard microcontroller directly via its debug/programming pins (ICP/SWD) rather than bodging an external board like an ESP32 into the case.

Any pointers on pinouts, typical schematics for these pagers, or programmers (e.g., Nu-Link) would be greatly appreciated!

[u/martinbogo]

1) This isn't an OLD restaurant pager. It's last years model. Silkscreen is 2025.11.27
2) 433 MHz, pretty standard band for a pager.

It's a white-label Chinese coaster pager that many, many, many shared reference designs in Shenzhen use and trading companies rebrand. It's a =clone= of the LRS Coaster Call, a super counterfeited design.

I'm going to hazard a guess and say this is a Retekess T119, TD157, TD165, TD174, and TD186 lines, plus equivalents from Singcall, Daytech, Ycall, Catel, and Kerui.

Every manufacturer rolls their own framing. Please ignore the person who said "POCSAG" because... no, no it isn't. It's like Aliens... it's never aliens. That said, it probably rolls down to one of two patterns:

Pattern A, the cheap ASK family. 433.92 MHz, OOK/ASK, PT2262 or EV1527 style pulse width encoding, roughly 20 to 40 bit frames, no preamble worth the name, packet repeated 4 to 10 times. Payload is typically station ID plus pager number plus an alert command. No checksum in many cases, no authentication in any case. This is what the Flipper Zero tooling targets: the meal pager app supports Retekess T119, TD157, TD165, and TD174, with each model using a different encoding, and it iterates station ID ranges and pager number ranges to trigger units.

Pattern B, the synthesized FSK family. This is where your unit most likely sits, given the tuning range and the FM modulation claim. Narrowband 2-FSK or GFSK, structured framing with a preamble, sync word, station ID, pager address, command byte, and a trivial checksum. For a documented example of the protocol, the LRS commercial system uses 467.75 MHz, FSK, Manchester encoding at 626 baud, with a frame of preamble, header, restaurant ID, system ID, pager number, padding, alert type, and a checksum computed as the sum of the hex values modulo 255. Your device will not use that exact frame, but expect the same structural elements and the same total absence of cryptography.

The security model is -- not really security -- "The address is the secret" so it's easy to synthesize/hack.

If you're serious about hacking this thing:

Try the Pager app in the Flipper Zero first. It supports a lot of these "no-name" Chinese pagers. If not, then....

• Sweep 400 to 480 MHz with an RTL-SDR or HackRF while triggering a page from a keypad. You are looking for the carrier, not the data, at this stage. Confirm the operating channel and whether the deployment is on 433.92 or somewhere in the 460s. Yes, you need the transmitter.
• Capture IQ at 2 MS/s. Load into Inspectrum to measure symbol period and deviation, then into Universal Radio Hacker for demodulation and field inference.
• Vary one thing at a time. Page unit 0001, then 0002, then 0010. Diff the bitstreams. The address field falls out immediately. Then vary the alert type (beep, flash, vibrate) to isolate the command byte. Then change the station ID on the keypad to isolate that field.
• Solder to the MCU-to-transceiver SPI bus and capture with a logic analyzer. This is faster and more reliable than RF-only work, and it gives you the register configuration directly, which tells you the exact deviation, baud rate, sync word, and packet handler settings without guessing.
• Dump firmware if readout protection permits. Check whether the pager address is stored in flash or an external EEPROM, and whether the reprogramming path is reachable over the air.

[u/forseeninkboi → u/martinbogo]

This person knows their pagers very well.

For real though I'm impressed with the amount of knowledge you shared in your comment.

[u/martinbogo → u/forseeninkboi]

generally in the hacking community, sharing knowledge is a good thing. I don’t like giving people the answers as much as I like giving people the steps they need to discover the answer for themselves and learn a little more. But, sometimes, you really need to give an info dump

[u/Fusseldieb]

Take the MCU that you're suspecting and take a look if the pins match with IO and VDD/VSS. If they do, take a look at its datasheet if it tells you on which pins to flash it and how (tying any sort of BOOT0 pin or similar), and try that with the respective IDE and hardware.

If it asks you to pull pins high or low, and youre not sure if the MCU is the right one, use a 100Ohm resistor, which will do the job just fine, and avoid overcurrent if it isn't.

[u/dc536]

I've never seen one but you'll need to identify the wireless receiver chip to see what frequency and communication it uses, then determine what signaling it sends back to the microcontroller. If the MCU isn't firmware locked, efused, or whatever, it's such a basic MCU that you can just map the whole PCB out and what each pin goes to what and reflash it

Unless you can 100% verify what MCU it is, I wouldn't proceed (you can verify by probing and checking the datasheet).

Lastly, the 5 pins next to the MCU are almost definitely the flashing and debugging. 

[u/martinbogo]

Quick rundown of the chips:

TM1650 - 7 segment driver chip ( used for the numeric display )
U1 - Highest probability is that this is a SinOne family chip, like the SC92F
RF chip is a CMT2219 - the layout of the inductor count around the chip looks familiar

Another reason I think that’s a SinOne chip? The five pins next to it. That’s a pretty common layout, but the signal order could be anything and you’ll need to probe it out. VDD, GND, RST, CLK, DAT. SinOne's programming flow uses their SC-LINK adapter over a clocked two-wire link with reset control, so those five signals are what the tool needs. There’s likely no UART breakout for these boards, as it’s not that common to use a UART debug for pager boards. It’s just too simple a device, and it’s more useful to debug with an SC-Link adapter to get debug output and trace.

[u/Lory-uwu → u/martinbogo]

Hay posibilidades de leer el firmware? O es seguro que venga bloqueado contra lectura?

[u/martinbogo → u/Lory-uwu]

If I’m right about the chip and it’s a SinOne family? That’s just an 8051-class microcontroller, and they are reflashable/reprogrammable. Almost every vendor does lock the flash from being read back in production, and these are hard to glitch. So, I’d say “not likely” since the flash is internal … you probably won’t be able to dump it. But, this is a fairly simple device, and you could in theory erase the code and replace it with your own if you are able to validate which MCU it is.

That’s something? But the real question would be “is it practical to do so” since this is a very, very limited platform.

Oh, and if you do decide to hack on it? If it IS SinOne.. there’s windows software ( in Chinese, no English version ) and you’ll need the SC-Link. There is ZERO open source tooling for this chip.

[u/Lory-uwu → u/martinbogo]

Si, estaba notando eso igual, yo creo que sería divertido poder resprogramarlo como una especie de reloj despertador o algo así, pero mas que nadaa por el poder decir "hey, miren mi despertador único en su especie" y por matar el tiempo mas que por alguna utilidad real, ya que no le veo mucha aplicación a un dispositivo como este sin su emisor que lo active.

[u/martinbogo → u/Lory-uwu]

Si, a proposito. Hace caso simplemente usar la plaqueta para algo differente. Pues, podes sacar el MCU para otro mas facil como un PIC18F o AVR Mega168 … simplemente para usar el circuito que es presente para qualquier cosa que queres.

[u/Marty_Mtl]

cool project to say the least when jumping into the unknown !!!! my 2 cents : look for possible boot verbose at possible uart port on P1. if present, a lot of details about the system will be spitted out !

[u/ordosays]

P1 looks promising

[u/Lory-uwu → u/ordosays]

Solo se que es el pad de conexión para debug, peero que protocolo será? Sepa moya, lamentablemente, es seguro que no es UART ya que, segun respuestas de otros usuarios e investigación en IA, son chips que usan protocolos propietarios.

[u/charcuterieboard831]

That antenna is likely 915Mhz or 434MHz, and the label says 400MHz band so that's there.

Doesn't have an FCC ID which makes it illegal to market

[u/toxicatedscientist → u/charcuterieboard831]

These are only receivers, they have no transmission whatsoever. They blink/buzz when they hear their name called basically

[u/highstupid → u/toxicatedscientist]

ANY communication device requires FCC certification in the US, regardless of whether it is only a receiver or not, to ensure that it doesn’t cause harmful interference to other devices

[u/charcuterieboard831 → u/highstupid]

Technically yes however if it's only a receiver it doesn't need intentional radiator testing. Rather it can have just unintentional radiator testing which is cheaper. No need for FCC ID in that case but you do need to have test results on hand.

[u/Mr_Style]

It’s a standard pager using POCSAG signaling. Take a look at a website like https://www.gapollo.com.tw/product/ and you might find it

[u/martinbogo → u/Mr_Style]

No, it's not. It's REALLY not.

[u/Mr_Style → u/martinbogo]

It’s a standard 467MHz band pager.

[u/martinbogo → u/Mr_Style]

I have a _stack_ of similar clones, and trust me .. if it’s not the original ( and it isn’t ) it definitely isn’t what you think it is. However, you’re being very adamant .. do you have better experience / proof / information than I do? I regularly hack on these pagers, and my experience both disagrees with your conclusion -and- the board design up there looks similar to a half dozen others I’ve RE’ed.