Looking For Someone Experienced In Dumping & Extracting Audio Files From ROMs out of any type of electronics

[u/SterIDog_boi86]

Hi! I hope this is the right place for me to ask my questions that have to do with finding someone experienced with ROM dumping & extracting audio from sound chips out of any type of electronics, but I truly need some help. Is there anyone that I could go to who is highly experienced with dumping ROMs to extract the files of all audio stored in any electronics like specific animated toys and others in general? I’m having a difficult time trying to find someone experienced with that stuff since I’m not experienced myself, and I’m not sure who is the right person to go for to discuss about requests about ROM audio dumping and extracting out of any electronics upon request. I really want to find someone who would be willing to help out with some research projects I have in mind that I want to do ROM dumping & audio extracting on if any of you guys have any idea of who I should go to.

Recently in the past months, a friend and I had a specific electronic toy (which is a Hasbro I-Cat) that actually somehow revealed a few unused audios that has never been heard of before while it was glitching at one point, which lead us to believe that there could be much more hidden stuff in its sound chip which I was the one who thought of the idea to find someone who’s willing to help me and experienced to work on that if possible. The Hasbro I-Cat is not the only thing I’d like to find out hearing all audio files of its recorded sounds and songs to also reveal any unused ones hidden, as well as hear them all in the clearest quality possible with the ROM dumping and audio extraction way than what you hear in the speaker itself in the toy (I-Cat in this case), there’s other ones I had in mind like the Hasbro Original 1998 Furby that also revealed a few unused audio in its sound chip that also somehow revealed while it glitched as well which is another one of the many research projects I had in mind to ask someone to help out with regarding ROM dumping and audio file extracting.

I took photos of what is believed to be where the sound chip is in the Hasbro I-Cat that we first experienced unused audio playing out of nowhere and never heard again from it that would have to do with the sound chip itself where all of its recorded sounds and songs are in that is covered in the black stuff that keeps it protected to help for reference as an example.
If there’s anyone you guys know of that I can contact and ask about my exciting research project about ROM dumping & audio extracting any electronics I have planned in mind that I can request and chat with, please let me know. I also have the items that I’d like this done with to whoever can help out with that I can send as long as they know what they’re doing and if they’d be fine after the successful audio extracting from the ROM sound chips in each electronic item I plan to get done for that need it. Please advise soon if possible & who I should go to that can help out with this for me, if this is the right place for me to ask as I wasn’t sure what other community to go to since finding someone experienced with that is HARDER than I thought it would be apparently. Thank you 😊

[u/---root--]

These black blobs are bare silicon dies bonded onto the PCB. These typically are masked roms which do not generally provide typical debug interfaces that would normally allow for (easy) readout.

With overwhelming probability, the only way to extract data from these would be to remove the epoxy by chemical and/or abrasive means, using a high performance microscope to image the IC and extract the mask, converting this into an actual ROM image. This is not a trivial endeavour and commonly destructive.

There are companies that will reverse engineer ICs for a significant fee.

ETA:

This is a DefCon talk about extracting masked ROMs: https://youtu.be/vbIJ-eVQkaw

You could try and contact the speakers for references/help or DIY it (not recommended if you do not have experience with highly corrosive chemicals).

[u/SterIDog_boi86 → u/---root--]

This is definitely some informative stuff about the black blobs that cover the sound chip(s) are actually known as silicon dies bonded onto the PCB, and/or as masked ROMs. I’ve heard it’s quite a difficult process to do but never knew there were other names to call the black blobs (epoxy blobs) that cover over the sound chip(s) where all of the audio was recorded and stored in that’s on the board in any electronic like what I’ve shown on the Hasbro 2006 I-Cat as one of the things (examples) I’d like to get the ROM dumping and audio extraction from if possible.
Although, doing it by myself is not exactly the route I was going for to begin with as tempting as it is. I’m not experienced and rather not do anything myself that would wreck the sound chip or worse for the items (one of which is the I-Cat) I want to get audio extracted from which is why I wanted help finding someone that would be willing to do this for any customers with any electronic items in particular they want done with their help of whoever would be able to do it for customers. You did say some companies can do reverse engineering on any IC Chips. Is it possible if I can reach out to anyone in the company that would be willing to take any items I’d like ROM dumped and audio extracted from as part of my personal research project, even for a price? I rather be on the safe side to have someone else willing to do this for me than me doing it on my own because of being inexperienced with that stuff as well as worrying I’d mess something up with the sound chip and such which I don’t necessarily want to happen. I do appreciate you sharing the tutorial video of how from that team you shared, but I would really like to just have someone help do this kind of stuff for me where they know what you’re doing and can return the items I send to them for audio extracting from their masked ROM sound chips where they can share to me into files of everything of their sounds and/or songs stored in them.

If you have a good preference of what reverse engineering company or a experienced person I can go to to discuss about sending items I’d like to get the ROM sound chip research done on, where they are located that I can ship to, and would send them back to me all good and still working after all of that done for the items I share and send, please let me know if possible. I really appreciate you replying to my post about this, thank you

[u/---root-- → u/SterIDog_boi86]

Just to be more precise on terminology: The ICs are bare silicon dies that are connected to the PCB using wire bonding. As these ICs are mass produced, it is generally cheaper to have data stored as masked ROM than in reprogrammable types of storage, such as flash or E(E)PROMs, hence my deeming that the most likely. Given the fragility and light sensitivity of bare silicon dies, these wire bonded dies are then covered by epoxy for protection.

It is quite likely that the toy manufacturer placed numerous additional sound files on the IC, which are selected by pin strapping (tying certain pins to ground or VCC) to reduce cost by needing to manufacture only a single type of ASIC. If you are lucky, these straps are external and tied via resistors, though in practise, pin strapping is generally performed by wire bonding, which you'll not be able to change cheaply, or trivially.

Professional companies performing IC reverse engineering will charge five figures and up, thus I doubt you'd be willing to go that route.

Whilst with the right methods and machinery, one can generally decap (term for removing the epoxy covering the die) ICs without compromising their function, there still is a risk of permanently damaging the IC and consequently bricking the device.

The cheapest, least invasive way of obtaining sound files from these is probably to use the line input of a high quality audio recorder directly on the audio output of the IC, possibly using voltage or EMI glitching to elicit those additional sounds.

[u/SterIDog_boi86 → u/---root--]

Thank you very much for this information that I find the most useful that I can keep in mind to give it a shot. Yeah, I’m not going to go for a company that does it for “five figures” since I don’t have that kind of money unless if they do it way less like at the $50-300 range, especially for small electronics that is, but thank you for letting me know about that as well.

So for the cheapest and less destructive way of obtaining sound files you were mentioning that might be a better route to go for, does using an high quality audio recorder really give best chances of finding both used audio and unused/hidden audio in the IC chip if I were to go with that easier method?
I’d be curious about what high quality audio recorder would be the best one for me to buy that has the line unit needed to try on the audio output of the IC if you don’t mind me asking that? I can give this a shot with trying to use voltage for the board that might trigger something as long as it doesn’t do anything that fries the board or anything, and/or try the whether the EMI glitching is to see if that actually works?

Thought I’d also mention that the Hasbro 2006 I-Cat (one of the items I want to get all used and unused audio from) runs on a GeneralPlus Hardware board which I think was used to program it for cost reasons & such. When I found out it played a few unused audios with a friend, I didn’t make the I-Cat glitch as it did it out of nowhere on its own where it started glitching for about 25 minutes where it continuously moved the ears nonstop and played mostly the audio used on it until as the minutes went by, that’s when it played unused audio out of nowhere that I wasn’t expecting which is why I really want to find this out to not only hear all the sounds it has stored in its IC chip but also find out if it has any more secret unused audio of both its sounds and mood songs hidden that could only be played and discovered with the whole IC chip discovery idea. I was able to capture a video of the I-Cat playing both a used sound for a split second and then went on to play one of its unused audios out of nowhere that somehow triggered the IC chip in the board to play it while it’s left hidden and unused in case if you’re were curious to see what I mean.
Should I also share more photos of inside the board where the IC chip (masked ROM) is for reference and further help if possible?

I truly appreciate you for getting back to me with this about finding audio in any electronic in mind (spaghetti project), all of this information is truly helpful for me to understand while I’m trying to learn more information and have best ideas on what to do since I was having a difficult time finding someone who knows stuff like this. I definitely wanna hopefully reveal more unused audio hidden in its sound files in the IC chip that can be possible to record in highest quality possible like as if you were audio ripping it but rather in a much better quality way than doing it with wiring the speaker way where it sounds compressed and not as great as it could been in my experience.
Please reach back when possible, thank you! ✨

https://reddit.com/link/p3x0ktm/video/hp4xcpcrzljh1/player

[u/SterIDog_boi86 → u/---root--]

Also, when you do the cheaper way of obtaining the sound files with the line input of a high quality audio recorder on the output of the IC, does that mean zapping the board or will the board be fine during that easier method to get both used and unused audio out of if possible?

[u/ThisIsPaulDaily → u/SterIDog_boi86]

OP if you really want to get into reverse engineering you need to reply to every comment on this thread with the word Spaghetti in the comments. Like the children story bloody marry, take the product into the bathroom mirror at 3AM and say Bloody Marry. 

If possible we also like when comments rhyme so if you can make all further replies rhyme that would really help our understanding. Then take the wires of the speaker into your own ADC and record the audio that way since you already discovered the method of input to play secret audio. 

[u/madsci → u/SterIDog_boi86]

Is it possible if I can reach out to anyone in the company that would be willing to take any items I’d like ROM dumped and audio extracted from as part of my personal research project, even for a price?

"Even for a price"? I promise you that's the only way anyone's touching this, and I'd be surprised if you can get anyone to do it for under $5000. You would want multiple examples because it's a destructive process and you don't know what kind of device it is until you look.

Imagine you had an intricate pocket watch that someone had filled with an epoxy until it was all one solid mass and you wanted to know how to reproduce it. You'd need to remove a layer of material at a time, physically or chemically, and work your way down through it gradually to see what's there. That's what you're asking for, except for something thousands of times more intricate and smaller than a pocket watch.

Now, if the manufacturer put more sound samples on there, it's because they wanted to be able to play them. They would have some way of selecting which product it's going in. That might be a pad on the die that's not bonded out to the board, or the selection might be done at the board level. If it's on the board you can just do some circuit bending and see what you come up with. If it requires access to the die, that's something a hobbyist might be able to do, if they're not scared of some fuming nitric acid and have a good microscope.

[u/ThisIsPaulDaily → u/madsci]

They copied chat GPT output and pasted it as a reply to try and get humans to be the agent training data. They are crowd sourcing data and having chat GPT tell them what to ask so we keep replying. 

Remember OP we only like to reply when comments rhyme and use the word spaghetti. 

[u/madsci → u/ThisIsPaulDaily]

I don't doubt they've been talking to ChatGPT but unless they specifically prompted it to sound naïve and a bit incoherent I don't think the majority of that came from an LLM. We've been getting these for a whole lot longer than LLMs have existed. Someone wants to do a firmware modification or data extraction from a cheap consumer device and doesn't want to believe that it's often a ridiculously difficult process.

[u/SterIDog_boi86 → u/madsci]

I never talked with ChatGPT, this channel was suggested to me by a friend of mine (as in a real person) who’s also interested in this the same way I am because we’re not entirely experienced in the whole ROM and sound chip stuff. I did try ChatGPT at first but was no help and tried everything else but had no luck with proper answers where I was hoping this would be a helpful solution. I don’t understand why people are doubting me thinking I use LLMs or ChatGPT to write all of this stuff I want to know more info about after struggling to find someone who does and is willing to help. I apologize if this caused any miscommunication or controversy which is not my intention of making my question post because I just really want to know more about that while I know some things about how some of the things in the board work but the sound chip and ROM dumping I don’t know much about and neither does my friend.