A Moogle  🏳️‍🌈 💻 🎮 🎶 🇸🇪

The first step is identification. They're *usually* microcontrollers, but can someitmes (rarely, even) be pure state machines in the form of an ASIC. This does happen, though, and if they're not an MCU, it makes it a *lot* harder to emulate.

To identify the MCU, the circuit board (which is usually simple, with just a handful of passive components other than the chip itself) is traced out, and "Sean Riddle" of the Bannister forums tries to match the pinout against any known pinouts.

In the event that it matches an MCU model for which there's a known method for dumping the internal ROM, Sean breaks out one of several test jigs and pulls out the data, then wires up the LCD and photographs the segments to be vectorized.

Since the chips themselves usually have all identifying markings scrubbed, this is about the only way to do it in a safe manner. It also assumes the chip is in a normal plastic or ceramic package. If it's unidentifiable or is "globbed" with an epoxy dot, the real fun begins!

In that case, the chip is removed from the board in any way possible, and the whole shebang is dissolved in fuming nitric acid until the silicon die itself is exposed. The silicon die is then cleaned in Whink and put under a microscope.

Multiple photos are taken of the exposed die, then stitched together. At this point, it would be a good time for a small digression about "mask programmed" versus "electrically programmed" silicon chips.

Hand-waving away certain details, the vast majority of modern chips are electrically programmed. The chip starts out blank, and has its program uploaded at the time of manufacturing, usually via pogo pins against the wafer itself, or a custom jig after the chip is packaged.

But, for chips that are going to have a lot of them made, this step costs too much time and money. In these cases, the ROM bits are literally a part of the photolithographic mask used to manufacture the silicon chip itself. So yes, bits in this case are actual physical objects.