One other option for non-destructive reverse engineering is to drive Vcc with high frequency AC and measure the resonant frequencies on the chip. (Same is true for the ground pins, but this is complicated because the substrate is often grounded and introduces a large capacitance) This produces a general `map' of the chip, although many of the frequencies will overlap and be indistinguishable. To remove the unwanted noise, it is necessary to damp out the parts of the chip that you're not interested in. There are a variety of ways to do this but the one of the easiest is with the magnetoresistance effect. Disk drive rw heads work well for this. (it's usually better to magnetize the whole chip and then unmagnetize the part you want to look at.) Input pins are most likely connected to an insulated gate, but this will act like a capacitor, allowing ac into the channel, so we can probe these to see where they go. Newer chips have filters on the inputs which makes this more difficult. once you have selected a target area, turn on the transistor(s) by any of the usual methods (uv light, electron beam, external e-field...if you're poor you could try pumping the substrate to induce latch-up, though this isn't very `selective' in what it turns on) Two main problems with this techinque: One is that the relevant resonances are on the order of 10-100 GHz. Obviously you are not just going to plug that into your average scope and expect it to work. The usual advice is to maintain a reference oscillator and measure the interference with respect to your `probe'. If you have access to some of the newer GaAs amps, you can modulate the signals and then measure the lower sideband. The other problem is the finite resolution (even if you have a really good magnetic head you just can't get close enough to the surface without destuctive techniques.) To a large degree, you have to `brute force' guess, and see what model best fits the data. I shouldn't have to explain the details of this technique to a group of cryptographers.