Actually, the electronics analogy is apt for more difficult cases than the OP's. If communications are encrypted or signed you may be out of luck unless you ca

Actually, the electronics analogy is apt for more difficult cases than the OP's. If communications are encrypted or signed you may be out of luck unless you can extract the software from one of the devices; sometimes that's almost impossible, sometimes it can be done but only by disassembling the device (frequently an irreversible process) and reading the data off an EEPROM chip or something. If the protocol directly involves hardware (e.g. hardware crypto), then the state of the art permits nothing better than experimentation, combined with some crude 'in vivo' attacks like differential power analysis. In theory, after decapping and delayering the chip (also irreversible), a scanning election microscope can show the transistor layout clearly enough to reconstruct its functionality, but no software exists to do this automatically, and with billions of transistors good luck doing it manually.