What Does It Mean to Crack an IC?
To crack an IC is to bypass the read-protection fuses or security mechanisms inside a microcontroller so the embedded firmware can be extracted. The result is a binary image — typically a .hex or .bin file — that contains the executable code originally programmed into the chip. This process is used for authorized purposes: recovering your own lost source code, supporting legacy hardware when the original developer is unavailable, or migrating firmware to a replacement part during a redesign.
Protection mechanisms vary by vendor and family. Some chips use a single fuse bit (Microchip PIC’s CP bit), while others implement multi-level schemes (STM32’s RDP Level 1 vs. Level 2). The technique required to crack an IC depends entirely on which protection is active, the silicon revision, and the specific die architecture. There is no universal method — each family, and sometimes each revision within a family, demands a different approach.
How We Crack IC Firmware — Step by Step
1. Free Feasibility Assessment
You send us the chip part number (full marking, including revision suffix) and, if possible, a photo of the IC package. Within 1–2 working days we confirm whether the device is in our supported database, estimate the success probability, and quote a firm price. There is no charge for this step.
2. Device Receipt and Inspection
Once you ship the IC (or the complete PCB), our lab inspects the package condition, verifies the marking against the datasheet, and checks for remarked or counterfeit parts — a surprisingly common issue that would waste everyone’s time if missed.
3. Protection Analysis
We probe the chip’s JTAG/SWD/ICSP interface to confirm the active protection level. For devices with tiered security (e.g., STM32 RDP Level 1 vs. Level 2), this step determines the exact attack vector. Level 2 on many STM32 families, for instance, requires a physical die-level approach rather than a protocol-level bypass.
4. Firmware Extraction
Using the appropriate technique — voltage glitching, laser fault injection, micro-probing, or a protocol-level exploit — we extract the flash contents. The raw binary is then verified against the chip’s stated flash size and any known CRC or checksum structures.
5. Delivery
You receive the firmware as a .hex (Intel HEX) or .bin file, along with a brief extraction report noting the protection level bypassed, flash region boundaries, and any EEPROM or OTP data recovered alongside the main code. All work is covered by our NDA.
Which Chip Families Can We Crack?
| Vendor / Family | Protection Type | Typical Turnaround | Notes |
|---|---|---|---|
| STM32F0 / F1 / F2 / F3 | RDP Level 1 (some L2) | 5–10 days | F1 is the most commonly requested; STM32F2 crack details |
| STM32F4 / F7 | RDP Level 1–2 | 7–15 days | Level 2 requires die-level work; STM32F7 protection specifics |
| STM32G0 / G4 | RDP Level 1–2 | 7–12 days | STM32G0 crack feasibility |
| STM32L0 / L4 | RDP Level 1–2 | 7–12 days | Low-power families; same RDP scheme |
| STM8S / STM8L | ROP (Read-Out Protection) | 5–8 days | Generally high success rate on 8-bit STM8 |
| Microchip PIC12 / PIC16 / PIC18 | CP / CPD fuse bits | 5–10 days | Older revisions often easier; PIC16 unlock notes |
| Atmel / Microchip AVR | Lock bits (LB1/LB2) | 5–10 days | ATmega, ATtiny series widely supported |
| Renesas RX / RL78 | ID code protection | 10–15 days | Less common; feasibility varies by sub-family |
| NXP LPC / Freescale HCS | CRP levels / FSEC | 7–15 days | CRP Level 3 on some LPC parts is not recoverable |
This table is representative, not exhaustive. If your chip is not listed, submit a feasibility request — our database covers 1,000+ part numbers.
What You Actually Receive
- Firmware file: Intel HEX (.hex) or raw binary (.bin), your choice.
- Flash map: start address, end address, total size, and any gaps or reserved regions.
- EEPROM / OTP data (when present and recoverable): delivered as a separate file.
- Extraction report: protection level identified, method category used (no proprietary detail disclosed), and verification notes.
Files are delivered electronically via encrypted link. If you need the firmware programmed onto a blank replacement IC, we can do that as an add-on service — just note it in your request.
Realistic Constraints — What Can Go Wrong
Honesty matters more than a sales pitch. Here are the real limits:
- Irreversible protection: Some chips implement one-time-programmable (OTP) security fuses that physically destroy the read path. STM32 RDP Level 2 on certain silicon revisions, and NXP LPC CRP Level 3, fall into this category. We will tell you upfront during the feasibility check.
- Die damage: Physical techniques (decapsulation, micro-probing) carry a small risk of damaging the die. If you have only one chip, we discuss this risk explicitly before proceeding.
- Encrypted firmware: Extracting encrypted flash contents is possible, but the resulting file may be useless without the decryption key. We can recover the raw bits; decrypting them is a separate challenge that depends on where the key is stored.
- Counterfeit or remarked parts: Roughly 5–8% of ICs we receive from customers turn out to be remarked or counterfeit. The internal die may not match the external marking, making the crack IC process impossible for the expected part.
Authorization and Legal Standing
We perform IC cracking only under documented authorization. Before work begins, you confirm ownership of the intellectual property or provide written evidence of your right to access the firmware — for example, you are the original product manufacturer, the firmware developer, or you hold a license. All projects are executed under a mutual NDA. For a full explanation of our compliance framework, see our copy protection removal authorization policy.
Crack IC vs. Related Services — Which Do You Need?
| Service | What It Does | When to Choose It |
|---|---|---|
| Crack IC | Bypasses on-chip protection to extract firmware | You need the firmware from a specific protected MCU |
| Memory readout | Reads external memory ICs (EEPROM, SPI flash, NAND) | Firmware or data lives on an external chip, not inside the MCU |
| Chip-level reverse engineering | Full die analysis — gate-level netlist, IP block identification | You need to understand the silicon design, not just extract code |
Many projects combine two or more of these services. A typical legacy board recovery, for example, involves cracking the main MCU plus reading out a serial EEPROM that holds calibration data.
Pricing Signals
We do not publish a fixed price list because cost depends on the chip family, protection level, and quantity. As rough guidance:
- 8-bit MCUs (PIC12, PIC16, STM8, ATtiny): starting from approximately $300–$500 per unique device type.
- 32-bit MCUs, Level 1 protection (STM32F1 RDP1, LPC CRP1): starting from approximately $500–$1,200.
- 32-bit MCUs, advanced protection (STM32 RDP2, physical attack required): starting from $1,500 and up, depending on die complexity.
Quantity discounts apply when cracking multiple units of the same part number. The feasibility check is always free.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewIs cracking an IC the same as decapping it?
Not necessarily. Decapping (chemical or mechanical removal of the IC package) is one technique that may be used during an IC crack, but many chips can be cracked through electrical or protocol-level methods without opening the package. Decapping is typically reserved for chips with advanced physical protection or when micro-probing pads on the die is required.
Will the original IC still work after the crack process?
It depends on the method. Protocol-level and glitching attacks usually leave the chip fully functional. Physical die-level techniques (decapsulation, FIB editing) are destructive to the package and sometimes to the die. If preserving the original chip is critical, tell us during the feasibility stage so we can plan accordingly — or supply a second sample.
Can you crack an IC if I only have the PCB, not a loose chip?
Yes. We can desolder the IC from your board, perform the extraction, and optionally resolder it or a programmed replacement. We handle BGA, QFP, QFN, and SOIC packages routinely. Board-level handling adds 1–2 days to turnaround.
What if the feasibility check says my chip cannot be cracked?
We will explain exactly why — whether it is an irreversible fuse, an unsupported silicon revision, or encrypted flash with an inaccessible key. In some cases we can suggest alternatives, such as full IC reverse engineering at the die level or board-level functional cloning that sidesteps the need for firmware extraction entirely.
How do you verify the extracted firmware is correct?
We compare the extracted file size against the chip’s documented flash capacity, check for valid vector tables (on ARM Cortex-M parts) or reset vectors (on PIC/AVR), and where possible, program the file back into a blank device of the same type to confirm it boots. CRC and checksum validation is performed when the original firmware includes such structures.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote