What Is Chip Reverse Engineering?
Chip reverse engineering is the process of reading embedded firmware—typically delivered as a .hex or .bin file—from a microcontroller, CPLD, or memory IC whose read-protect fuses have been set. When original source code is lost due to a departed engineer, a bankrupt vendor, or simple version-control failure, this process recovers the binary so you can reprogram replacement parts, analyze legacy behavior, or migrate to a new platform. Our lab handles roughly 300 chip reverse engineering projects per month across more than 20 MCU and memory families.
Why Engineers Need Firmware Recovery
The most common scenario is straightforward: a production MCU fails, the original .hex is gone, and the product line stops. Other triggers include:
- End-of-life silicon — the original part is discontinued and firmware must be ported to a pin-compatible successor.
- Legacy equipment maintenance — industrial controllers or medical devices whose OEM no longer exists.
- IP audit and compliance — verifying that contract firmware matches the agreed specification.
- Second-source qualification — confirming a replacement MCU runs identical code before committing to a production change.
In every case, authorization and proof of ownership are required before we begin work. All projects are executed under NDA, and we document the chain of custody from sample receipt to file delivery.
How Chip Reverse Engineering Works
Non-Invasive Techniques
The first approach is always the least destructive. Our engineers connect to the chip’s debug interface (JTAG, SWD, UART bootloader, ISP header) and attempt a standard readout. If read-protection is set at a low level—for example, STM32 RDP Level 1 or Microchip Code Protect with a known bypass—voltage glitch attacks and fault injection can force the chip into an unprotected state long enough to dump flash contents. Success rates for non-invasive methods on Level-1-class protection typically exceed 85%.
Semi-Invasive Techniques
When non-invasive paths fail, we decapsulate the package using fuming nitric acid or laser decap to expose the die. UV-light exposure can reset certain OTP fuse bits on older process nodes (≤180 nm). Focused-ion-beam (FIB) circuit editing lets us reroute a single metal trace to bypass a lock bit without destroying the die. These methods add 3–7 working days and are applicable to roughly 60–70% of parts that resist non-invasive reads.
Invasive / Full-Die Analysis
For the hardest targets—encrypted flash, anti-tamper mesh, active shield layers—we image the die layer by layer using SEM or optical microscopy and reconstruct the ROM or flash contents from the physical bit pattern. This is time-intensive (2–6 weeks), expensive, and reserved for high-value recovery where no alternative exists. Realistic success on modern 40 nm or smaller nodes with encrypted flash is below 30%; we always disclose this before quoting.
What Protection Levels Mean for Your Project
| Protection Class | Typical Examples | Primary Attack Vector | Estimated Success | Turnaround |
|---|---|---|---|---|
| Level 0 – None | Unprotected PIC, AVR, STC | Standard programmer read | >99% | 1–2 days |
| Level 1 – Soft Lock | STM32 RDP1, GD32 SWD lock | Voltage glitch / bootloader exploit | 80–90% | 3–5 days |
| Level 2 – Hard Lock | STM32 RDP2, Renesas ID-code | Decap + UV / FIB reroute | 50–70% | 7–14 days |
| Level 3 – Encrypted Flash | Infineon AURIX, NXP LPC55S | Full-die imaging / side-channel | 20–35% | 14–42 days |
We perform a free feasibility assessment on every inquiry. If a part falls into Level 3 with poor odds, we say so upfront rather than waste your budget.
Supported Chip Families
Our lab maintains tooling and documented attack flows for a wide range of vendors. Below is a partial list—if your part isn’t here, send us the full part number and we’ll evaluate it within one business day.
- Texas Instruments — MSP430, TMS320, CC-series wireless MCUs. See TI-specific capabilities.
- Infineon / Cypress — XMC, AURIX TC2xx/TC3xx, PSoC 4/5/6. Details for Infineon families and Cypress PSoC devices.
- Silicon Labs — EFM8, EFM32 Gecko, C8051F series.
- Nuvoton — N76E, M051, M480 Cortex-M series.
- GigaDevice — GD32F1/F3/F4, GD32E series (pin-compatible STM32 alternatives).
- Espressif — ESP8266, ESP32, ESP32-S/C/H series with flash-encryption considerations. Espressif readout details.
- Legacy vendors — Motorola/Freescale 68HC, NEC 78K, Zilog Z8/eZ80, Fujitsu MB series, Mitsubishi/Renesas M16C, Samsung S3C/S3F, SST 89-series, Winbond W78/W79.
- Smart-card ICs — contact and contactless secure elements where authorized recovery is needed.
Deliverable Formats and Verification
Every completed chip reverse engineering project ships with:
- Raw binary (.bin) and Intel HEX (.hex) images of the extracted flash/EEPROM.
- Fuse-byte / option-byte map so the replacement part is configured identically.
- SHA-256 checksum of the delivered file for integrity verification.
- A brief technical report noting the method used, any anomalies observed, and recommended handling for reprogramming.
If you also need the firmware disassembled or annotated, we offer that as a separate analysis service—contact us with your requirements.
What Can Go Wrong — Honest Constraints
Chip reverse engineering is not guaranteed. Factors that reduce or eliminate the chance of success include:
- Damaged die — corrosion, ESD, or previous failed decap attempts can destroy flash cells before we get to them.
- Active tamper detection — some automotive and payment MCUs erase flash the moment a decap or voltage anomaly is detected.
- Encrypted external flash — the .bin can be read easily, but without the AES key stored in the MCU’s OTP, the data is unusable.
- One-time-programmable parts with blown readout fuses — if the fuse is truly irreversible (anti-fuse, not poly-fuse), UV reset is impossible.
We never charge for a failed attempt. If the feasibility check indicates high risk, we quote on a success-only basis so you pay nothing if the read fails.
Authorization and Legal Framework
All chip reverse engineering at our facility requires documented proof of IP ownership or written authorization from the rights holder. Typical evidence includes a purchase order for the original development, a signed letter from the product owner, or board-level traceability showing the chip was programmed by your organization. We maintain ISO-grade NDA templates and can work within your company’s legal framework. Smart-card IC recovery carries additional compliance steps that we handle on a case-by-case basis.
Pricing Signals
| Project Type | Starting Price (USD) | Notes |
|---|---|---|
| Standard MCU, Level 0–1 | $150–$500 | Most 8-bit and many 32-bit parts |
| Hard-lock MCU, Level 2 | $500–$2,000 | Decap + FIB or UV required |
| Encrypted / Level 3 | $2,000–$8,000+ | Success-only billing available |
| Batch (10+ identical parts) | Per-unit discount 20–40% | One-time engineering, replicated read |
Final pricing depends on the exact part number, protection level, and quantity. Request a quote with your chip marking and we respond within 24 hours.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCan chip reverse engineering recover firmware if the MCU is physically damaged?
It depends on the damage location. If flash memory cells are intact but bond wires or the package are damaged, we can often decap and probe the die directly. If flash cells themselves are corroded or shorted, recovery is unlikely. Send photos of the damage and the part number for a free assessment.
What is the difference between a .hex and a .bin file?
A .bin file is a raw byte-for-byte image of the chip’s flash memory. A .hex file (Intel HEX format) wraps the same data with address records and checksums, making it compatible with most programmers. We deliver both formats by default so you can use whichever your toolchain expects.
How long does a typical chip reverse engineering project take?
Simple Level-0 or Level-1 reads complete in 1–5 working days. Level-2 projects requiring decapsulation average 7–14 days. Level-3 encrypted targets can take 2–6 weeks. We confirm the estimated timeline during the feasibility review before any work begins.
Is chip reverse engineering legal?
Yes, when performed on firmware you own or are authorized to recover. Legitimate uses include replacing failed production MCUs, maintaining legacy equipment, and auditing contract code. We require proof of ownership or written authorization and execute all work under NDA. Unauthorized copying of third-party IP is outside our scope.
Do you need the chip desoldered from the board?
Not always. For non-invasive reads we can often connect to debug headers or pads on the populated board. If decapsulation is required, we desolder the chip in-house using hot-air rework with appropriate ESD precautions. Ship the entire board if you prefer—we handle the rest.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote