Like breaking a combination lock you need a "tell " to work on.
Assuming a piece of kit, impossible to get a remote control for and
"universal " remotes do not register any change to the otherwise dead kit.
If you broke into a ground or supply line to the microcontroller and
monitored the supply current , would there be staged changes of current when
exercised by various , but vast majority wrong, IR signals?
ie simple swept 30 to 50 KHz oscillator source would you pick up on say
38KHz as the basic required "carrier" frequency ?
Varying mark/space of gated pulses at that "carrier" f, would you pick up on
the correct mark/space
?
Then would there be a recognisable respone to various random "nibbles" that
are parts of the required coding ?