With the right camera modifications, you don't have to remove any layers from a chip to discern the core count: https://www.flickr.com/photos/130561288@N04/48258310027/ That's an IR photograph taken with a Sony APS-C camera that the IR-blocking filter has been removed from. That's enough to make out the cores and L3 cache slices. (The rest of Fritzchens Fritz's flickr uploads are worth checking out too, especially the video showing how he preps a die for visible light photography.)
The chip design and fabrication firms have their own internal RE divisions mostly to QA their own chips. They do competitive RE, but its often less expensive for them to get a subscription to TechInsights. Economies of scale and all that.
In terms of how its done, its very proprietary. I can tell you it involves clean rooms, ion beams, electron microscopes, chemistry, and bleeding edge software.
If you want to come work for us (its enjoyable, you should :) ) check out our careers page. We are hiring like crazy in many positions.
Why not underestimate the engineering effort, could the problem is higher up in the chain (software api like Apple os) and lower (the equipment to produce the chip). Would the IP that important?
