First of all: Very interesting video! And the fail was just hilarious
![Laughing :-DD](https://www.eevblog.com/forum/Smileys/default/smiley_laughing.gif.pagespeed.ce._hfWAz_QHO.gif)
But could've happend to me as well
![Banging Head |O](https://www.eevblog.com/forum/Smileys/default/bangheadonwall.gif.pagespeed.ce.8iLbFYV4Bc.gif)
Some comments: My assumption is that the first longer "dip" in the trace (for example at 27:01 in the video) is just the keypress and some currentflow through a pull up/down resistor. Did you check that maybe by holding the button a bit longer?
Then to the end you say: "Even if we could find the 6 right digits, we don't know the order"
I'd say that depends on how good/poorly they have programmed the software: Say it is kind of an if/else hierarchical thing:
If 1st digit correct
If 2nd digit correct
If 3rd digit correct
If 4th digit correct
If 5th digit correct
If 6th digit correct
activate_solenoid();
Else
Do_nothing();
Else
Wait_for_1_more_keypress();
Do_nothing();
Else
Wait_for_2_more_keypress();
Do_nothing();
Else
Wait_for_3_more_keypress();
Do_nothing();
Else
Wait_for_4_more_keypress();
Do_nothing();
Else
Wait_for_5_more_keypress();
Do_nothing();
Then one could find out from the power lines whether the uC takes the IF or the ELSE branch, and hence step by step find out the right combination: First try all digits for the first one, see which triggers the If branch. THat gets you the first digit, e.g. "5". Then knowing the first digit, try all combinations of "5" and any possible digit for the second digit, and see which causes to take the IF branch and so on..
However you're right that decoupling makes that sort of thing more difficult. But thats why the Chipwhisperer sort of automates this task : It does the same thing, with slight variations over and over and over tens and thousands of times. Because, although the information we were looking for is not visible in a single shot trace because of the decoupling, it is still there, buried in noise. If you repeat the same thing long enough, the information will become visible.
However this is of course limited by the "maximum 4 attempts before you have to wait" that you mentioned.
But an interesting thing to do would be to automate the whole thing and do something like this:
Take another uC, and write some simple code that sends the right combination, and after that sends a combination which differs on the last digit. And doing this over and over, so that you don't encounter the maximum 4 attempts limit, because its reset everytime.
And of that you record the powerline traces, a couple of thousand times (thats why you want to automate this whole thing
![Wink ;)](https://www.eevblog.com/forum/Smileys/default/xwink.gif.pagespeed.ic.cldandycH0.png)
)
And then see group the traces into "the ones with the correct combination" and "the ones with the last digit wrong", avereage each of these groups, and compare the averaged traces.