Chip Code Extraction | Delivered as .hex or .bin

What Is Chip Code Extraction?

Chip code extraction is the process of reading embedded firmware or configuration data from an integrated circuit—typically a microcontroller, FPGA, CPLD, or serial memory—and delivering it as a usable binary file (.hex, .bin, or .s19). The procedure is performed when the original source code or programming files have been lost, when legacy hardware must be replicated for maintenance, or when an authorized owner needs to verify what is actually running on production silicon. Our engineers handle code-protected, fuse-locked, and read-disabled devices daily, using a combination of non-invasive, semi-invasive, and invasive techniques selected per chip family and protection level.

Why Engineers Need Chip Code Extraction

Hardware teams encounter extraction needs in several recurring scenarios:

• Legacy equipment repair. The original firmware developer is unavailable, the company that wrote the code no longer exists, or the source repository was lost. The only surviving copy of the program lives inside the chip on the board.
• Production continuity. An MCU goes end-of-life and you need the binary to port it to a pin-compatible replacement. Without the extracted code, you cannot migrate.
• Quality audit. You need to confirm that a contract manufacturer programmed the correct firmware revision. A post-extraction firmware verification compares the readout against your golden binary.
• IP recovery. You own the design but the programmer file was never archived. Extraction is the fastest path back to a deployable binary.

Authorization and proof of ownership are required before we begin any chip code extraction engagement. We operate under NDA, and every project file is purged from our systems after delivery.

Supported Chip Families and Protection Levels

Not every device can be read, and success depends on the specific protection scheme the silicon vendor implemented. The table below summarizes common families, their typical protection mechanisms, and realistic extraction feasibility.

For vendor-specific details, see our dedicated pages covering NEC IC unlock families, Altera FPGA and CPLD recovery, and dsPIC code-protection bypass.

How Chip Code Extraction Works: Step by Step

1. Feasibility Assessment

You send us the chip part number (full marking, including revision letter and date code) plus a description of the protection state if known. Our lab cross-references the device against our internal database of over 30,000 tested part numbers and returns a feasibility verdict—usually within one business day. There is no charge for this step.

2. Device Preparation

Depending on the method, we may work with the chip still soldered to the board (in-circuit) or desoldered. For BGA and QFN packages, we use hot-air rework stations with thermal profiling to avoid die damage. Serial memories (SOP-8, TSSOP-8) are typically read in-circuit via clip probes.

3. Protection Defeat

This is the core of chip code extraction. The technique chosen depends on the protection tier:

• Non-invasive: Voltage glitching, clock glitching, or protocol-level exploits that bypass read-protect without altering the die. Turnaround: 1–5 working days.
• Semi-invasive: UV exposure, focused-ion-beam (FIB) probing of bond pads, or laser fault injection. Requires decapsulation but does not destroy the die. Turnaround: 5–15 working days.
• Invasive: Full die decapsulation, delayering, and micro-probing of internal bus lines. Reserved for high-security parts where no other path exists. Turnaround: 15–30 working days. Success is not guaranteed—we quote a confidence percentage upfront.

4. Readout and Verification

The raw data is read multiple times (minimum three passes) and compared bit-for-bit. If even a single byte differs between passes, we investigate before delivering. The verified binary is packaged as an Intel HEX (.hex), raw binary (.bin), or Motorola S-record (.s19) per your preference. We also supply a SHA-256 checksum for integrity tracking.

5. Delivery

Files are transferred via encrypted link. On request, we can also program the extracted code onto blank replacement chips—useful when you need a drop-in spare immediately.

Deliverable Formats Explained

If you need the extracted data in a different container—ELF with debug sections stripped, or a particular programmer’s proprietary format—let us know at quote time.

What Can Go Wrong — Realistic Constraints

Honest engineering means telling you where the limits are:

• Destructive protection. Some newer MCUs (e.g., STM32 RDP Level 2, certain Infineon Aurix parts) trigger a mass-erase if a readout attempt is detected. Chip code extraction on these devices requires careful pre-analysis; we will not attempt a brute approach that risks erasing the only copy of your firmware.
• Encrypted bitstreams. AES-256-encrypted FPGA bitstreams (Xilinx UltraScale+, Intel Stratix 10) cannot be decrypted without the key. We can read the encrypted blob, but it is unusable without the original key file. Our FPGA bitstream extraction guide covers which families are recoverable.
• Die damage. Chips that have been through severe over-voltage, moisture ingress, or physical trauma may have corrupted flash cells. We can often recover partial images and flag bad sectors.
• Anti-tamper packaging. A small number of security-focused ICs (smart-card controllers, HSMs) use active mesh layers that destroy the die on decapsulation. These are generally not candidates for extraction.

Chip Code Extraction vs. Related Services

The terminology overlaps, so here is how our service categories map:

• Chip code extraction — the umbrella term for any firmware or data readout from a protected IC.
• MCU firmware extraction — extraction specifically targeting microcontroller flash/EEPROM.
• External memory readout — reading SPI/I²C/parallel flash and EEPROM ICs that sit outside the MCU.
• Chip-level reverse engineering — a broader effort that may include extraction plus disassembly, annotation, and functional analysis of the recovered binary.

Turnaround and Pricing Signals

Turnaround ranges from 1 working day for a straightforward serial-flash read to 30 working days for an invasive extraction on a high-security MCU. Most projects (PIC, AVR, STM32 RDP-L1, standard serial flash) complete within 3–7 working days.

Pricing depends on the protection level and technique required. Non-invasive reads on common parts start from approximately USD 200–500. Semi-invasive and invasive work on advanced parts ranges from USD 1,500 to USD 8,000+, quoted after feasibility assessment. We never charge if extraction fails.

Frequently Asked Questions

Related Services

• Protected IC recovery and code readout
• MCU code extraction for 8-bit and 32-bit controllers
• FPGA bitstream extraction — Xilinx, Altera, and Lattice
• Post-extraction firmware verification
• SPI and I²C memory readout service
• Full chip reverse engineering

Related reading

• Oct 2026Texas Instruments IC Unlock | Families We Can Read
• Oct 2026AT90 Unlock | Feasibility, Cost & Lead Time
• Oct 2026AVR IC Unlock | Which Families We Can Read