This is the physical method. You dissolve the epoxy package of the MCPX with fuming nitric acid, exposing the silicon die. Using a high-resolution microscope, you photograph the metal layers. The Boot ROM is an array of transistors (mask ROM). You manually transcribe the bits. This is how the first MCPX ROM was dumped in 2009 by the infamous team "Tiros."
The breakthrough came via legendary hardware hacker Andrew "bunnie" Huang. Using a high-speed FPGA custom board, Huang intercepted the data bus lines between the CPU and the MCPX chip during the brief window before the ROM turned itself off. By capturing the instructions as they flew across the motherboard traces, he successfully dumped the complete 512-byte MCPX Boot ROM image. The Critical Flaw Mcpx Boot Rom Image