
A rough little tool for waking up unknown POCSAG pagers: pocsag-probe
Ever ended up with a POCSAG pager that has only a partial RIC on the sticker and, if you are lucky, a vague rumour about where it might be tuned? I had one of those charming little problems and did not particularly fancy building yet another programming interface just to ask the thing what it already knows. So I wrote pocsag-probe.
It throws messages through a HackRF or rpitx, sweeps frequencies, walks RIC ranges, reads candidate RICs from a file, and expands partial patterns like 0118 or 3xx21x into valid POCSAG addresses. The point is not elegance. The point is to automate the dull detective work until the pager finally admits what it is listening for. It's not really a prober, it's a bruteforcer. It works. Eventually.