A group of hobbyists led by Daniel Balsom and aided by Ken Shirriff extracted and decoded the 80386 microcode ROM, a 94,720‑bit blob far larger than the 8086’s. Using high‑resolution die images, AI‑driven image processing, and manual analysis, they turned raw pixel data into a readable binary and began mapping μ‑ops.

The team identified 215 entry points in the decoding ROM, a sharp rise from the 8086’s 60. By spotting patterns, aligning μ‑ops on one axis and their bits on another, they reconstructed instruction fields, including ALU operand selectors and accelerator interfaces like the multiplier and barrel shifter. Their work linked each microcode routine to specific 386 instructions, confirming full coverage.

During the audit they uncovered a subtle flaw in the I/O permission bitmap handling, where a four‑byte port access checks only the first three bytes. This potential security issue, hidden for four decades, demonstrates the value of low‑level reverse engineering. The full disassembly is available in the x86 microcode GitHub repository.