Spok T5 reverse engineering

Taking a look at the Spok T5 AES-128 encrypted pager. Super-low power draw, runs on a AA.

Quick rundown of ICs on board:

As a bonus, there’s exposed programming pads under the battery! Presumably used to assign a pager number to it.

We’re gonna start with trying to work out an attack tree with our main mission to be able to decrypt messages in flight.