SAD triggering hard to tune on STM32F4 (CW308_STM32F4HWC) in sca205 uecc_part2_notrace

Embedded Security Side Channel Power Analysis
1

Hi,

I’m working through the sca205 course, specifically the SAD part of uecc_part2_notrace.ipynb, but on an STM32F4 target instead of the F3 the course seems built around. I’m having trouble getting the SAD trigger to fire cleanly once per bit, and I’d appreciate any guidance.

Setup

  • Scope: CW-Husky
  • Target: CW308 + STM32F4 (STM32F4HWC)
  • Firmware: simpleserial-ecc-notrace built for F4 with CRYPTO_TARGET=MICROECC FW_TRIGGER=1
  • scope.clock clkgen 10 MHz, scope.adc.adc_mul = 1, gain 30 dB, bits_per_sample = 8
  • I ported the SAD steps from the official uecc_part2_notrace notebook to F4.

What works
The firmware-triggered reference capture is fine. With scope.adc.segments = 255, samples = 170, one segment per bit, I get 255 well-aligned segments — overlaying all segments of a trace shows a clean, consistent waveform. From this I build avg_trace, pick POI, and choose starting_sample via the lowest max/variance/average SAD search. The SAD reference registers correctly (scope.SAD.reference matches my ref_trace, 96 non-zero samples), and scope.trigger.module = 'SAD'.

The problem
I can’t find a threshold / interval_threshold combination that gives a clean 255/256 triggers with scope.adc.errors == False and produces aligned segments:

  • Too strict (low threshold) → fewer than 255 triggers → capture times out (“no trigger seen”, data invalid).
  • Too loose (higher threshold) → more than 256 triggers → trigger too soon error.
  • Near the boundary, the trigger count reaches ~254–257, but when a capture does land on 255/256, overlaying the SAD-triggered segments still shows only a noise band, not the aligned waveform I get from the firmware-triggered reference. It looks like missed triggers and spurious triggers roughly cancel out in the count, so the count alone is misleading.

I traced the inter-trigger times: on F4 the normal bit interval is around 24,000–28,000 cycles, which is higher than the course’s F3 values (~20,000–23,000). Some intervals come out around double (two bits merged = a missed trigger) and some around 15k+11k pairs (a spurious trigger partway into a bit).

Questions

  1. Is this lab expected to work on STM32F4, or is F3 effectively required for the SAD part?
  2. Any advice on making the SAD reference more discriminative on F4 — e.g. choosing starting_sample, reference length, or interval_threshold — so it fires once per bit instead of matching mid-bit?
  3. Is there a recommended way to validate alignment beyond the trigger count, given that missed/spurious triggers can cancel?

Thanks in advance!

2

All good questions! I haven’t tried this on the STM32F4. In theory it should be possible to get it to work, however it’s likely that a lot of the guides and landmarks don’t translate very well.

Did you get part 1 to work?

Then I would recommend skipping over to part 3, where you’ll learn that sequenced triggers are a really handy solution to the types of issues you’re running into (hopefully!).