There's a couple of options. For hardwired ROM, you can sometimes just decap/delid your target device and check it out under a microscope. Take very high quality pictures, difference 1s from 0s simply by looking at it, and reconstruct the binary data in your computer. That's been done to extract private keys from smartcards (such process was described in the book Murdoch's Pirates, where hackers would pull private keys off satellite TV cards, and use them to create and sell pirated cards).
Another option, more relevant to systems where the data is in regular EPROM/EEPROM/Flash/... is to attack the "read only" eFuse. The attack basically consists of decapping your target IC, finding the read-only efuse, covering the memory area with black tape, and shinning UV light on the eFuse. The photons will excite the electrons stuck in the cell, draining it, and enabling memory reads. At the end of the post I provided a link to Bunnie's blog where he does exactly that on a PIC target device, and manages to extract protected data.
There's a couple of options. For hardwired ROM, you can sometimes just decap/delid your target device and check it out under a microscope. Take very high quality pictures, difference 1s from 0s simply by looking at it, and reconstruct the binary data in your computer. That's been done to extract private keys from smartcards (such process was described in the book Murdoch's Pirates, where hackers would pull private keys off satellite TV cards, and use them to create and sell pirated cards).
Another option, more relevant to systems where the data is in regular EPROM/EEPROM/Flash/... is to attack the "read only" eFuse. The attack basically consists of decapping your target IC, finding the read-only efuse, covering the memory area with black tape, and shinning UV light on the eFuse. The photons will excite the electrons stuck in the cell, draining it, and enabling memory reads. At the end of the post I provided a link to Bunnie's blog where he does exactly that on a PIC target device, and manages to extract protected data.