I have the MAB 8440 NMOS from the 1980's. This microcontroller is used in the early 'highly regarded' Cd-players of that era. Now I know there are replacements out there but as far as I know there not based on the ROM inside the chip. The chips doesn't allow to access the ROM directly from the outside. What i have done so far is milled a pocket, dissolved the remaining epoxy, took die shots and stitched the image. My question is how to proceed with delayering. It seems i run in to difficulty to etch just enough of the SiO2 layer to expose the metal layer. I believe it is aluminium. I have microprobes when the need should arrive but there is a long way to go yet. Maybe someone has experience in this field of reversing NMOS chips and your help would be greatly appreciated.
Datasheet and die-shot can be found here:
MAB8440 datasheet and photo

 

You could go for starters to EEV forum. There is a small group with experience on reverse engineering. Be ready to read long threads.

Otherwise, there was a member in the Microchip forum, Mario something IIRC, who evidently participated in that kind of activity. Not even sure if he is active today.

 

The EEVblog member name is Noopy. He has a large amount of decapped and analyzed ICs.

 

MAB 8440

It is an 8048 computer. I probably have some of those.
Members of the 8048 family include the 8021, 8035, 8038, 8039, 8040, 8048, 8049, 8050, 8748, and 8749.
I see there are cross compilers. There probably an emulator.
I think years ago we ported 8048 code to 8051 and Z80.

 

On the MAB 8440 there is no direct access to the ROM from the outside. So don't know how one could read out the code. There is an emulation out there on a Atmega 328 but that is not what I'm after.

 

So don't know how one could read out the code.

Most companies do not want you reading their code. There are always rumors of secret ways of powering up in some strange test mode.
What type of ROM? Some can be read with a microscope. (fuse ROM)

 

Most companies do not want you reading their code. There are always rumors of secret ways of powering up in some strange test mode.
What type of ROM? Some can be read with a microscope. (fuse ROM)

It should be a factory-masked part.

https://adamsblog.rfidiot.org/2013/01/fun-with-masked-roms.html?m=1

 

Thanks for your guys input. I'll give this another go, got another microscope objective coming my way so i hopefully can see things more clearly.