Chip Clone: What Determines Whether It Is Possible

A chip clone is the process of reading the internal firmware, configuration data, or bitstream from a programmed integrated circuit and writing that data into a blank device of the same part number. Success is never guaranteed. It depends on five concrete, measurable factors: the chip’s read-protection level, the silicon process node, the physical package type, the firmware or bitstream size, and whether you hold legal authorization to perform the work. Our engineers evaluate every request against these five criteria before quoting — and we turn down roughly 30 % of submissions because the technical or legal requirements are not met.

What Exactly Happens During a Chip Clone?

The operator connects to the target IC — through its debug port, test pads, or directly to the die — and extracts the stored binary. That binary is verified (checksum, functional test on a reference board), then programmed into one or more blank ICs of the identical part number. The result is a device that behaves identically to the original in the target circuit.

This is not the same as designing a replacement from scratch. A chip clone preserves the exact register configuration, calibration constants, bootloader, and application code. It is the fastest path to restoring a legacy system, recovering from a failed chip, or producing authorized spares for equipment you own.

The Five Factors That Decide Chip Clone Feasibility

1. Read-Protection Level

Every modern MCU and FPGA ships with some form of code-protection. The level varies enormously:

Our feasibility check identifies the exact protection variant on your chip before any invasive work begins. For many Holtek microcontrollers, the fuse architecture is well-documented and recovery rates are high. For families with hardware-level lockout — such as certain Xilinx FPGAs with AES-256 bitstream encryption — we will tell you upfront that a chip clone is not realistic.

2. Silicon Process Node

Older chips fabricated on 350 nm, 250 nm, or 180 nm processes have larger transistor geometries. That matters because invasive techniques — focused ion beam (FIB) editing, micro-probing, chemical decapsulation — are far more reliable when features are physically larger. A chip built on a 90 nm or smaller node has interconnect pitches below 200 nm, making probe contact extremely difficult and increasing the risk of damaging the die.

Rule of thumb from our lab: chips on ≥ 130 nm processes have a meaningfully higher success rate for invasive firmware readout than those on ≤ 65 nm. This doesn’t mean sub-65 nm is impossible, but the cost and turnaround increase sharply.

3. Package Type and Accessibility

The IC package determines how — and whether — we can reach the die or test points:

• DIP / SOIC / TQFP: Easy to desolder, decap, and re-ball. Low risk of collateral damage.
• QFN / BGA: Requires precision rework station; X-ray inspection to verify ball integrity post-decap.
• WLCSP / Flip-chip: Die is exposed but extremely fragile. Decapsulation margin is near zero.
• Multi-die / SiP (System-in-Package): Multiple stacked or side-by-side dice; each must be addressed individually. Complexity and cost multiply.

If you are unsure of the package, send us a clear photo of the top marking and the PCB footprint. Our team can identify the package and assess access options within one business day.

4. Firmware / Bitstream Size and Complexity

A small 8-bit MCU with 8 KB of flash is a different proposition from a 2 MB Cortex-M7 or a 32 Mbit FPGA bitstream. Larger binaries take longer to extract, longer to verify, and are more likely to contain integrity checks (CRC, signature blocks) that must be accounted for during the clone process. Encrypted bitstreams on FPGAs — common on Lattice ECP and MachXO families — add another layer: even if the bits are read, they may be useless without the decryption key.

5. Legal Authorization and Proof of Ownership

We perform chip clone work only for parties who can demonstrate they own the IP or the hardware containing it. Typical scenarios we accept:

• You designed the firmware but lost the source — recovery of your own code.
• You own legacy equipment and the original vendor is defunct — authorized maintenance spare production.
• You hold a license agreement granting reproduction rights for the firmware.

We require a signed declaration of ownership or license before work begins. All projects are covered by NDA. For details on our authorization process, see our MCU crack feasibility page, which walks through the documentation we need.

Chip Clone Process: Step by Step

1. Submission: You send the target IC (or the full PCB) along with your ownership documentation.
2. Identification: We confirm the exact part number, revision, and protection level — often using die marking, X-ray, or JTAG scan.
3. Feasibility report: Within 1–3 business days, you receive a written assessment: possible / possible with caveats / not feasible. Includes estimated cost and turnaround.
4. Extraction: If approved, our lab reads the firmware using the least-invasive viable method. Non-invasive (debug exploit, glitch attack) is always preferred over invasive (decap + microprobe).
5. Verification: The extracted binary is programmed into a blank IC and functionally tested — either on your board or on our bench setup.
6. Delivery: You receive the verified binary file (Intel HEX or raw BIN) and, optionally, pre-programmed replacement ICs.

Typical turnaround for a straightforward chip clone (Level 0–1 protection, common package) is 5–10 working days. Complex cases — Level 2 protection, BGA packages, large bitstreams — can take 15–25 working days.

Which Chip Families Are Most Commonly Cloned?

Our lab handles requests across dozens of vendors. The table below shows families where we have established tooling and high success rates:

For vendor-specific details, see our dedicated pages: Nuvoton IC recovery, GigaDevice firmware readout, and Silicon Labs IC unlock.

When a Chip Clone Is Not the Right Answer

Cloning is not always the best — or even a viable — path. Consider alternatives when:

• The chip uses Level 3 / secure-enclave protection. Cost may exceed the value of redesigning the firmware from scratch.
• The part is obsolete with no blank stock available. Even a successful readout is useless if you cannot source programmable blanks. In this case, a full PCB reverse-engineering effort with a chip migration may be more practical.
• You need to modify the firmware. A clone gives you a binary, not source code. If you need to change functionality, you need disassembly, decompilation, or a clean-room rewrite — a different (and larger) project.
• You do not own the IP. We will not proceed without authorization, and neither should any reputable lab.

Cost and Turnaround Expectations

Pricing for a chip clone depends on protection level, package complexity, and quantity of programmed replacements needed. General ranges:

These are starting ranges, not fixed quotes. Every project receives a binding quote after the feasibility assessment — you pay nothing if we determine the clone is not viable.

Related reading

• Oct 2026ATSAMD21 Crack | Protection Levels & Recovery Guide
• Oct 2026Silicon Labs IC Unlock | Families We Can Read
• Oct 2026ATSAMD21 Unlock | Feasibility, Cost & Lead Time