Oh, that thread is just talking about the normal last round state diff leakage model by the end. I believe the original poster was talking about the attack in general and trying it with the normal sbox output model, which doesn’t work well for hardware AES. Colin’s post referring to HD on the first round is that because of the presence of MixColumns, you need to guess 4 bytes at a time, which ChipWhisperer’s software doesn’t support.