TL;DR — Photon-emission microscopy allowed us to locate a register responsible for the enabling of debug features on the Raspberry Pi microcontroller. — Laser pulses at two nearby positions then restored debugger access to the chip’s Secure world, even though debug had been permanently disabled. — Using that access after a rescue reset, we recovered a secret from one-time-programmable memory. The reset halted the chip before firmware could apply its runtime lock, so the page stayed Secure-readab...