Ok, I tried clocking my Teensy back to 600MHz and it didn't help. I also tried manually brute forcing the top 6 pin candidates by latency from the last round (byte 3), also no luck. It seems the only option for me is a 20h brute force of the last 4 bytes. Will try as soon as I find a place with a w...

Yup, `one_pass` cracked it from the first shot under 800s on the bench. @vtl, thanks a million for the help and creating this project. Do you have a donation jar or something? Well, maybe Christian's change needs to be incorporated. I forgot why it didn't go in the first place, perhaps other platfo...