Die Photography and a CNN Crack the NEC V20's Microcode ROM

The author behind the MartyPC emulator set out to make its NEC V20 core genuinely cycle-accurate rather than an 8088 core with V20 instructions bolted on. Rather than reverse-engineer timings through trial and error, they went straight to the silicon, commissioning a 5.6-gigapixel die photograph (70478x80672 pixels—too large for the JPEG format) of a Sharp second-source V20. The main microcode ROM sits below the die’s center as a 258x116 array holding 29,928 bits, which divides evenly by the V20’s known 29-bit word length to yield 1,032 words—eight more than the expected 1,024.

Extracting the bits meant classifying each cell as a 1 or 0 based on whether a transistor was present. Instead of manually labeling all ~30,000 cells (a fallback method with tooling built for distributed, consensus-based voting), the author trained a small convolutional neural network that hit a validation F1 of 0.989 in a few minutes on a CUDA GPU. Inference produced per-cell confidence scores; cells below a 99% threshold were flagged, re-sorted into the training set, and the model retrained iteratively until only four ambiguous bits remained, which were faster to verify by hand. The author is careful to note this is classical CNN image classification, not a large language model.

With the raw bitmap in hand, the remaining work is structural: reshaping the 258x116 grid into 29x1,032 microcode words and decoding the associated group-decode ROM and activation PLA that sit above the array. That decoding also resolved the word-count mystery—a metal structure on the die could be cut on one arm or the other depending on whether the chip was fabricated as a V20 or V30, letting both CPUs share a single microcode mask and accounting for the extra words. The effort extends reenigne’s 2020 8088 microcode work toward the same level of emulation fidelity for the V20.