> Seems simple enough.  I think all you really need to do is...


Hm, say I use a small Ctest, and charge that to 5.00V.  The device
under test is run from a normal 5.00V supply. At the point of interest,
it is switched over to Ctest using mosfets. A few 10ns later, it is
switched back. The voltage of Ctest now tells me how much energy
has been used.

When I use low-leakage components, and a very small capacity for Ctest
(to achieve a significant voltage drop in such a short time), may that
be a good solution to the problem?

What about clock jitter, does an XTAL suffer from that? The test duration
would be very critical in such a setup.


               low-leakage p-ch
               logic mosfet

         +5V -----+  ^  +----------+--------------- VCC of device-under-test
                  |  |  |          |
                 ---------   +-----+
                  +------    |     |
                  |          |    --- Ctest
                  |          |    --- low-leakage
0V = Supply  -----+          |     |
5V = Ctest                   |     +--------------- GND
                             |
                    measurement point



Is there any good reason why this will not work, or give only rough
figures?  Probably there is..


How many gates switch in a microcontroller for example, when it is
executing a NOP?   I roughly know how I would build one from scratch
using logic gates, but that doesn't necessarily match any real-world
part :-)


> Note that this sort of thing is sometimes useful when trying to read out
> code-protected chips or hack things like the Keyloq designs

I have read that pay-tv protection systems have been attacked by power
consumption measurements.  A hacker once told me that some version of
Skys chips was two-fold, one side was the CPU, and the other part of the
die was wasting the exact complement of energy - to always consume
exactly 11mA! I don't know how that was defeated, but I'm convinced it
was - probably cut off in a chip lab.