Truly read-only memory is sometimes found as a ROM encoded in a mask layer of a microcontroller. This is hard to extract electrically when the debugging protocol is undocumented, so many of these chips are dumped photographically after chemically decapsulating the chip with nitric acid, delayering it with hydrofluoric acid, and if they look identical, staining the ones to be a little darker than the zeroes.

In this lecture, I'll explain how I build a home lab for taking these photographs, how I wrote CAD software for converting the photos into bits. I'll also describe some prior work in the field, and how to reproduce those results quickly and cleanly.