Whilst some impressive hacks (and especially convincing university staff to lend you their Expensive Toys), my understanding is that the really tricky bit is go

Whilst some impressive hacks (and especially convincing university staff to lend you their Expensive Toys), my understanding is that the really tricky bit is going from die scans to netlist/circuit diagram, and thence simulation/code extraction. The Visual6502[1] folks are probably the best example of how well it can be done (assuming you can't afford to pay ChipWorks or FlyLogic to do it for you), but if you're working with a standardish MCU core and some masked ROM, a lower tech solution like the Dangerous Prototypes "rompar"[2] might work. Probably requires quite a few dies, or plenty of experience in extracting them before you succeed though. For actually reverse engineering the flash contents, I think it'd be easier to sniff the bus traffic as you probe it, or make a read/write capable emulator that logs what's going on. With the hacked phone-side control library, you could probably build a mostly automated harness to exercise the various settings and see what gets stored in flash. [1] http://visual6502.org/ http://visual6502.org/ [2] http://adamsblog.aperturelabs.com/2013/01/fun-with-masked-roms.html http://adamsblog.aperturelabs.com/2013/01/fun-with-masked-ro...