I've thought about this before and even attempted it once but I'm not sure I had things setup correctly.

Here's my theory again. I spent a thrilling evening of reading every bit of the theory of operation of the Vocon (Lecacy and Patriot +) vocon board operation. It appears the only clean bi-directional TX / RX digital that exists is to and from the secure module. Secure operation forces the DSP to dumb things down a bit and move digital information to and from the secure module via the SSI port TXD (pin A7) & RXD (pin B7) in both transmit and receive operation.

So, what if two radios were setup, one for receive one for transmit. Both are secure enabled and in secure mode. No proper code detect is enabled. A7 TXD which is EMC_RXD of the transmit radio is severed. It is then routed to B7 RXD EMC_TXD of the transmit radio which has been isolated as well. Basically intercepting raw digital from the receive radio secure module input and transferring that to the transmit radio secure module output to its DSP.

The secure module talks to the MCU over a separate BUS regarding clear and secure mode and other operational configuration conditions and instructions to the uP. Am I missing something that would cause a radio to fail? How much actual processing is done inside a module? Transmit radio for example; Is it smart enough to know that the TX/RX_D information it is receiving its DSP (since it thinks it's transmitting from the local microphone) is somehow not making it back to it's own DSP in the form it is expecting? I suppose it could be tested by simply lifting the line and observing its actions. If it fails then we know. If it appears to be transmitting normally but no digital modulation is produced then it should work right?

The first hurdle I can envision is clocking or would that even be an issue since there is no strobe line or anything?

I guess it's a rough analogy to ARP Poisoning but at a hardware level.

Does any of this seem plausible or should I go grab a beer and shut up?