In short: educated guesswork. The lighter blocky regions in the die shot are recognizable as memory; a lot of the rest is based on recognizing duplicated or mirrored elements (like the two CPU1 cores) and making guesses based on their number, relative size, and what they're close to.

Identifying the GPU, for example, is based on recognizing that there are eight repeated elements within it, and matching that with the known fact that there are eight GPU cores.

This [1] is a Talk from John McMaster about "Low-Cost IC Emission Reverse Engineering" using, iirc, commodity cameras.

[1]https://www.youtube.com/watch?v=iAuLXg2fVz0

For very old chips reverse engineering is relatively easy; here's one example: http://www.righto.com/2020/04/inside-am2901-amds-1970s-bit-s... For modern chips you need an electron microscope and there are a lot of metal layers to deal with.

You don't need an electron microscope to discern large-scale repeated structures like CPU and GPU cores, or to tell the difference between random logic and highly regular memory arrays (usually cache, but sometimes you can see microcode or register files if you look at a small enough area). An electron microscope is only useful if you want to fully reverse-engineer the entire circuit schematic, but that's overkill for basically any purpose except manufacturing your own clone.

So none of the underlying layers matter much for the large and intermediate scale structures?

With the right camera modifications, you don't have to remove any layers from a chip to discern the core count: https://www.flickr.com/photos/130561288@N04/48258310027/ That's an IR photograph taken with a Sony APS-C camera that the IR-blocking filter has been removed from. That's enough to make out the cores and L3 cache slices. (The rest of Fritzchens Fritz's flickr uploads are worth checking out too, especially the video showing how he preps a die for visible light photography.)

That’s cool! How would the major companies reverse engineer these chips?

TechInsights employee here.

The chip design and fabrication firms have their own internal RE divisions mostly to QA their own chips. They do competitive RE, but its often less expensive for them to get a subscription to TechInsights. Economies of scale and all that.

In terms of how its done, its very proprietary. I can tell you it involves clean rooms, ion beams, electron microscopes, chemistry, and bleeding edge software.

If you want to come work for us (its enjoyable, you should :) ) check out our careers page. We are hiring like crazy in many positions.

https://www.techinsights.com/about-techinsights/overview/car...

Why not underestimate the engineering effort, could the problem is higher up in the chain (software api like Apple os) and lower (the equipment to produce the chip). Would the IP that important?

In general, the other comments give an idea of how to do it. But Apple shared their own die shots in their presentation ;)

And they were actually accurate which is unusual for this sort of thing.

I assume you could at least make an educated guess based on the layout and ratios of the area of the caches (assuming you know their topology and sizes) and therefore their proximity to non-cache stuff.

> How does one identify which regions of a die-shot is the CPU or GPU? Are the structures on silicon easily recognizable from such pictures?

Infrared camera