I worked with a professional who helped decap and extract firmware from various DSPs. It was enthralling. He succeeded, too. I've also read at lengths the attem

I worked with a professional who helped decap and extract firmware from various DSPs. It was enthralling. He succeeded, too. I've also read at lengths the attempts at the hobbyist level. While also very fun, these attempts were not successful even at '90s process scales. At the hobbyist level, you'll be dealing with fumes from nitric acid to decap chips, and getting blurry, dirty scans that only give you a basic idea on function. Go back to '80s tech and before, and you'll possibly be able to painstakingly read NAND ROM sections by hand. At the professional level, you'll be spending up to millions of dollars on the equipment necessary to do live probing of chips at this process scale. Here you'll be able to advance the clock on your own, probe and hijack address and data bus lines and log their data constantly. On the extreme end of security, these chips are countless layers deep and have complicated wire mesh overlays that are used to detect intrusions and self-destruct. They can be beaten, but not by anything you can do with affordable hobbyist equipment. Contact these guys for a quote; expect it to be at least five figures to work on a single chip.