Two pieces of information merged in my mind tonight which made me wonder
about getting code from erased flash chips.

1) IIRC, flash memory, when left in one state for long periods of time,
tends toward that state.  ie, a 14 bit word that was left all ones is
harder to program to all zeros then another block which was programmed
to all zeros, in a given period of time.  (I don't remember where I
heard this, and it may simply be a fig newton of my imagination - if so,
please beat me about the monitor and cpu with a flame)

2) Microchip programming notes indicate that flash parts must be written
to numerous times, then checked, and if not in the correct state written
to again numerous times to complete a programming cycle, and production
parts should be verified at multiple voltages.  This would indicate that
the gates may be at indeterminate or partial states at a given stage
during programming, at a given voltage, and at a given time after
programming..

So, my thought was thus:
Could you take a part which has been programmed a long time ago, erase
it, and essentially read out the program by doing the following:
1) Attempt to program one location with all zeros ONCE
2) Read out and save the result (at multiple voltages?)(which would
likely not be all zeros)
3) Lather, rinse, repeat until all bits are zero at all voltages, then
move to the next location

What is the statistical probability that you could gain useful
information about what was in that location previous to the block erase?
 If it is greater than, say, 60%, then you could work out the math and
determine how many chips you'd need to perform this process on to gain a
statistical probability of having 90% correct code.  Once you have
reached that far, it wouldn't be to much of a stretch of the imagination
to get the main, useful components of the code into useable form using
human, or perhaps even machine, interpretation and dissassembly.

Of course, this whole theory would be rubbish if the manufacture of the
chip affected the flash tendency toward a one or zero more than the
state the flash has been in, but it is still an intriging concept, and
one I'd like input on.

Using a flash programmer, one could automate a test to determine how
much water this theory holds...

-Adam

--
http://www.piclist.com hint: The PICList is archived three different
ways.  See http://www.piclist.com/#archives for details.