Recon 2023 Travis Goodspeed Recent Experiments with Mask ROMs

Truly read-only memory is sometimes found as a ROM encoded in a mask layer of a microcontroller. This is hard to extract electrically when the debugging protocol is undocumented, so many of these chips are dumped photographically after chemically decapsulating the chip with nitric acid, delayering it with hydrofluoric acid, and if they look identical, staining the ones to be a little darker than the zeroes.
In this lecture, I'll explain how I build a home lab for taking these photographs, how I wrote CAD software for converting the photos into bits. I'll also describe some prior work in the field, and how to reproduce those results quickly and cleanly.
Travis Goodspeed is a reverse engineer from East Tennessee. After years as a bum and years as a corporate sellout, he's happily reverse engineering microcontrollers in Knoxville, driving a fleet of Studebakers and knowing all the best dogs by name at his corner bar. Greetz to Ruger, Riley, Josie, Molly, and Maggie!

[@scottgoodson4838]

Amazing talk! The slide visuals seem to be delayed by 30-60 seconds though, which makes it harder to follow. Any chance of a reupload that fixes the sync?