Dtech wrote me in 2012:
With sa chips I was about to send one to france for decapsulation and photos, togheter with some other guys that are
into retro video game consoles and had other chips to decapsulate. However this entire project somehow stalled and
died out. I know it's oki 4bit microcontroller with melody circuit and have a plenty of approximate information about
it's innards, as well as have researched a little bit about some test fetures that I plan (for so more than 10 years
already hehehe) to exploit to read out it's rom without decapsulation. All oki chips have features for such tests, but
in none of their documentation did I find any information on it.
I have made some test jig for such hardware tests, but it is not yet complete. It will be useful to explore the chip
test functions and try to read out it's contents, but no idea if it will be successful.
I have used the voltage glitching to record it's output in very high quality and then made a tool to try to extract
approximate rom contents with exact byte precision, and now know exactly how many bytes are each of the blocks and
things like that. However exact data (value of each program word) is not yet known, and that's a thing I would realy
like to see someday.
I can cool the chip down to -55degrees anytime, but i don't think it will help reading it out. Shitshot capture is
easy with it as it is. Using 192ksps or faster analog capture is more than enough to get every sample of it's 21.xxx
kHz (don't remember) samplerate and use adapted highspeed telecommunications algorithms to synchronise to transitions
and lock to every byte. Getting exact value is a problem, as the playback from chip is scaled... with loss. Loss is
similar to like playing back 8bit wave multiplied by 0.99 on 8bit dac. There are missing codes.
And regarding rom contents playback as samples, I discovered that "My Music Center" toy keyboard hardware (Holtek - Ad-lib Micro®, may be HT3670 based) by shitshot (voltage glitching) often vomited apparently its entire rom contents through the DAC, producing a sequence of all samples with "noise" in between. Because its MCU is SRAM based, its resistor controlled clock rate can be turned down to complete halt with crash, which may permit to sample the output (which DAC multiplexes polyphony voices like Yamaha) precise enough with any PC to decipher it.
