It should be possible to see if a given "secure" binary makes use of a given microcode instruction. If that is the case, it could be possible to use udbgrd/udb

It should be possible to see if a given "secure" binary makes use of a given microcode instruction. If that is the case, it could be possible to use udbgrd/udbgwr to modify the microcode instruction to do something else, e.g. to store some register data in the URAM or the SRAM. By doing this you should be able to "spy" the data the "secure" binary is processing.