Systems and methods for non-intrusive program tracing of a device are disclosed. The methods involve generating a program trace signal from at least one of power consumption and electromagnetic emission of the device; digitizing and decomposing the program trace signal into at least two digital program trace component signals including a low frequency program trace component and one or more high frequency program trace component signals; classifying fragments of the at least two digital program trace component signals of the program trace signal as at least one of a known portion of program code and an observed behavior of the device. Each of the at least two digital program trace component signals have different frequency bands and the bandwidth of each program trace component signal is smaller than the bandwidth of the program trace signal. Each of the high frequency program trace component signals include an envelope.