We have some bytes from the tablet. It's all pretty standard stuff with one exception.

// unenc init
a4 w f0 55
a4 w fb 00

Read ID Bytes
a4 w fa
a5 r ff 00 a4 20 00 13

// Enter enc mode
a4 w f0 aa

// write 16 byte key
a4 w 40 e0 7d e0 7d e0 7d
a4 w 46 e0 7d e0 7d 38 54
a4 w 4c bb 79 01 43

// Read Cal Data
a4 w 20
a5 r a2 b2 89 40 0f 1f 39 f0
a5 r a2 b2 89 40 0f 1f 39 f0

a4 w 30 
a5 r a2 b2 89 40 0f 1f 39 f0
a5 r a2 b2 89 40 0f 1f 39 f0

// Read inputs
a4 w 00

a5 r a3 b1 8a 41 0e 5e 38 f3
a5 r a3 b1 8a 41 0e 1e 38 f3

many more  00 reads

????
a4 w fb 01

many more  00 reads

Whats with the write of 01 to fb? i'll have to try doing that.