The next possible way of reverse engineering IC firmware from a device is playing around with its interface signals and access protocols. Also, if a security protocol is wrongly implemented, that leaves a hole for the ic reverse engineering firmware people to exploit.
Some microcontrollers and smartcards have a factory-test interface that provides access to on-chip memory and allows the manufacturer to test the device. If IC code extraction process can find a way of exploiting this interface, he can easily extract the information stored inside the chip.
Normally information on test circuits is kept secret by the manufacturer, but an MCU cracker can try applying different voltages and logic levels to the pins in the hope that it will put it into test mode. This sometimes works for microcontrollers but in smartcards such test circuitry is usually destroyed after use.
Also, embedded software developers sometimes implement functions that allow downloading from internal memory for test and update purposes. That must be done in a way that prevents any access to the code without proper authentication, or so that the code can be sent out in encrypted form only.
