It should be possible to see if a given "secure" binary makes use of a given microcode instruction. If that is the case, it could be possible to use udbgrd/udbgwr to modify the microcode instruction to do something else, e.g. to store some register data in the URAM or the SRAM. By doing this you should be able to "spy" the data the "secure" binary is processing.

anything! if you can get them to execute. the authors found one way to enable them, but others may exist (we do not know). maybe another secret instruction enables these also. we do not know.