A Mask ROM Tool in Qt6 and C++

Mask ROM stores its contents as a fixed pattern set during chip manufacture. That makes it expensive to produce in small runs, but it is a valuable reverse engineering target, because the data sits in the physical layout of the die. A photograph can reveal the stored bits even when the chip is broken or has no usable interface. The talk introduces a new open-source tool, written in Qt6 and C++, that turns annotated microscope images into grids of ordered bits.

The speaker walks through the workflow. The package is opened with nitric acid, and the upper metal layers are removed with hydrofluoric acid baths so the transistors become visible. Many overlapping microscope images are stitched into a panorama, and row and column lines are placed over the bits. The software offers design rule checks for ambiguous readings, can merge annotations from several chips to correct errors, and exports to formats such as ASCII art, CSV, JSON and Python arrays. Examples include a 1988 greeting card chip, a Game Boy ROM whose hash matched existing extractions, and the Clipper and Capstone chips, which yielded Skipjack tables and an ARM6 program.

The main takeaway is that converting physical bit positions into logical byte order is a separate and harder problem, with existing tools such as Zorrom helping there. Good tooling, speed and patience with the chemistry and imaging can recover firmware from chips that otherwise resist analysis. The speaker also notes that the approach becomes harder as features shrink below the wavelength of light.