What Does It Mean to Break IC Protection?
To break IC protection is to extract the firmware or data stored inside a microcontroller whose read-protection fuses or encryption have been enabled. This is typically needed when the original source code has been lost, a chip vendor has discontinued a part, or an engineer must recover their own design for a product revision. Our engineers use a combination of non-invasive, semi-invasive, and fully invasive techniques — selected based on the specific IC family, protection level, and process node — to read out the contents of a locked chip for its rightful owner.
Authorization is required for every project. We verify proof of ownership or a signed NDA before any work begins. This ensures the break IC process serves legitimate recovery, legacy maintenance, and product-continuation purposes only.
Why Engineers Need to Break IC Firmware Locks
Firmware loss is more common than most teams admit. A departing contractor, a failed version-control migration, or a decade-old product with no surviving build environment can all leave you with a locked chip and no source. Here are the scenarios we handle most often:
- Lost source code — original developer unavailable; only production-programmed chips remain.
- End-of-life migration — the MCU is discontinued and firmware must be ported to a pin-compatible replacement.
- Failure analysis — comparing a field-failed unit’s firmware against the golden binary to isolate corruption.
- Second-source qualification — verifying that a contract manufacturer programmed the correct firmware revision.
- Legacy equipment repair — industrial or medical gear still in service after 15–20 years, with no OEM support.
In each case, the goal is the same: recover a binary image that can be re-programmed into the same or equivalent device. Our IC clone service can then duplicate the recovered firmware onto fresh chips for production or spares.
How We Break IC Protection — Technique Overview
Non-Invasive Methods
These exploit electrical or protocol-level vulnerabilities without physically altering the chip. Techniques include voltage glitching, clock glitching, and debug-port reactivation. They are fastest (often 3–7 working days) and carry zero risk of destroying the device. Applicable to many older PIC, ATmega, and STM8 families.
Semi-Invasive Methods
The package is decapsulated to expose the die, but no direct contact is made with internal metal layers. UV light exposure, laser fault injection, or photon-emission analysis may be used to reset or bypass fuse bits. Turnaround is typically 7–14 days. Common for mid-range ARM Cortex-M0/M3 parts with moderate protection.
Fully Invasive Methods
Micro-probing or FIB (focused ion beam) editing targets specific traces on the die to disable protection logic. This is reserved for high-security parts and typically takes 14–20+ working days. Success depends on the process node — parts at 90 nm and above have higher success rates than sub-40 nm designs with encrypted flash. For the most advanced targets, silicon reverse engineering may be required to map the protection circuit before extraction can proceed.
| Technique | Package Opened? | Typical Turnaround | Risk to Device | Best For |
|---|---|---|---|---|
| Non-invasive | No | 3–7 days | None | PIC, ATmega, STM8, some STM32 |
| Semi-invasive | Yes (decap only) | 7–14 days | Low | Cortex-M0/M3, mid-security parts |
| Fully invasive | Yes (probe/FIB) | 14–20+ days | Moderate–High | High-security MCUs, secure elements |
Which IC Families Can Be Broken?
We maintain an active feasibility database covering thousands of part numbers. Below is a representative sample of families our engineers routinely handle:
| Vendor | Family Examples | Protection Level | Typical Success |
|---|---|---|---|
| Microchip (PIC) | PIC16F, PIC18F, PIC24FJ, dsPIC33FJ | Code-protect fuse (CP) | High |
| Atmel / Microchip (AVR) | ATmega8/16/32/2560, ATtiny85 | Lock bits (LB1/LB2) | High |
| ST (STM8) | STM8S, STM8L | ROP Level 1 | High |
| ST (STM32) | STM32F1/F4, STM32L1/L4 | RDP Level 1–2 | High (L1); case-dependent (L2) |
| NXP / Freescale | LPC, Kinetis | CRP / FSEC | Moderate–High |
| Renesas | RL78, RX, SH | OCD security | Moderate |
| TI (MSP430) | MSP430F/G series | JTAG fuse | High |
For specific part numbers, see our dedicated pages: STM32F405 unlock, ATmega2560 unlock, or PIC18F4520 unlock. If your chip is not listed, our free feasibility check will tell you whether recovery is viable.
What About Secure Elements and High-Security Parts?
Parts specifically designed to resist physical attack — such as Infineon SLE, Maxim/Analog Devices DS28-series, NXP A7-series, and dedicated HSMs — are a different category. Their protection includes active mesh layers, encrypted buses, environmental tamper sensors, and anti-FIB coatings. Success rates drop significantly, and some parts are genuinely unbreakable with current technology. Our secure element analysis service provides an honest assessment before you invest. We will tell you “no” when the answer is no.
The Break IC Process — Step by Step
- Submit your request — provide the full part number (including revision/date code), package type, quantity of sample chips available, and a brief description of why recovery is needed.
- Free feasibility check — our engineers review the part against our database and lab capabilities. You receive a written feasibility report within 1–3 business days, including estimated cost, turnaround, and any caveats.
- Authorization & NDA — we sign a mutual NDA and you provide proof of design ownership or a written authorization letter.
- Ship sample chips — typically 2–5 units are needed. Non-invasive methods may need only one; invasive work requires spares in case of die damage.
- Extraction — our lab performs the break IC procedure. You receive progress updates at agreed milestones.
- Verification & delivery — the extracted binary (.hex / .bin) is verified by programming it into a blank chip and running functional tests where possible. Delivered via encrypted transfer.
Pricing Signals and What Drives Cost
We do not publish fixed prices because every break IC project depends on the specific chip and protection level. However, here are the variables that most influence cost:
- Protection tier — a PIC16F with a single CP fuse costs a fraction of an STM32 with RDP Level 2.
- Process node — older 180 nm / 130 nm parts are easier to decapsulate and probe than 40 nm designs.
- Number of samples — invasive work may consume 2–4 chips; providing extras avoids delays.
- Urgency — expedited turnaround (rush service) carries a surcharge, typically 30–50%.
Ballpark: simple non-invasive extractions on commodity MCUs start in the low hundreds of USD. Complex invasive jobs on modern Cortex-M4/M7 parts can reach several thousand. The feasibility report includes a firm quote before you commit.
What You Receive
| Deliverable | Format | Notes |
|---|---|---|
| Firmware binary | .hex, .bin, or .s19 | Exact copy of flash contents |
| EEPROM data (if applicable) | .hex / .bin | Separate file if chip has EEPROM |
| Fuse/config byte map | Text or programmer config file | Required for correct re-programming |
| Verification report | Hash comparison, functional test notes |
Limitations and Honest Caveats
No lab can break every IC. Here is what we cannot guarantee:
- RDP Level 2 on newer STM32 — some revisions trigger a mass-erase on any debug access attempt. Success is chip-revision-dependent.
- Encrypted flash — if the MCU stores firmware encrypted and the key is in OTP or a secure enclave, decryption may be infeasible.
- Sub-28 nm parts with active shields — physical probing becomes unreliable below certain geometries.
- Damaged dies — chips that have suffered ESD, latch-up, or corrosion may yield partial or corrupted data.
Our feasibility check exists precisely so you know the odds before spending money. If we assess a project at below 70% confidence, we tell you upfront.
For MCU-specific feasibility details and the techniques applicable to your exact part number, our MCU crack assessment page provides deeper technical background.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewIs it legal to break IC protection on a chip I designed?
Yes. Recovering firmware from a chip you designed or own the IP rights to is a legitimate engineering activity in most jurisdictions. We require proof of ownership or a signed authorization letter before starting work. This protects both parties and ensures compliance with IP law.
How many sample chips do I need to send?
For non-invasive methods, one chip is often sufficient. For semi-invasive or invasive work, we recommend sending 3–5 units. The decapsulation and probing process can damage a die, so spares prevent project delays. Your feasibility report will specify the exact number needed.
What if the break IC attempt fails?
If extraction is unsuccessful despite a positive feasibility assessment, we do not charge the full service fee. Our policy covers the cost of consumed samples and lab time at a reduced rate. Specifics are outlined in the project agreement before work begins.
Can you break IC protection on a chip and then clone it onto new parts?
Yes. Once the firmware binary is recovered, we can program it onto blank chips of the same part number — or a pin-compatible replacement — as part of our IC clone service. This is common for end-of-life replacements and production spares.
How long does the free feasibility check take?
Typically 1–3 business days after we receive the full part number and project details. For unusual or very new parts not yet in our database, it may take up to 5 days while our engineers evaluate the protection scheme.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote