Flash Read Service | Recover Firmware From Any Chip

What Is a Flash Read Service?

A flash read service is a professional firmware extraction process that recovers the binary contents of flash-based memory ICs — including on-chip flash inside microcontrollers, standalone NOR/NAND flash, and serial SPI/I²C EEPROMs. When a chip is code-protected, obsolete, or physically degraded, standard programming tools return blank reads or errors. Our engineers use a combination of protocol-level techniques, bypassing read-protection mechanisms, and in some cases die-level microprobing to pull the complete binary image from the device.

This service is used exclusively for authorized recovery: restoring your own production firmware, supporting legacy equipment you own, or recovering prototypes where source code has been lost. Every engagement requires proof of ownership or written authorization, and work is performed under NDA.

Why Standard Tools Fail — and When You Need Professional Flash Reading

Off-the-shelf programmers (Dediprog, FlashcatUSB, J-Link) work fine on unprotected parts. They fail when:

• Read-protection fuses are set. Most MCU families (STM32 RDP Level 1/2, PIC Code Protect, Renesas ICE-lock) return 0x00 or 0xFF on every read attempt.
• The chip is in a proprietary package or uses a non-standard protocol. Some industrial controllers use custom SPI command sets or encrypted boot handshakes.
• The flash is degraded. After 10–15 years, NOR flash cells may show partial bit-rot, especially at the edges of the retention spec (typically rated 20 years at 85 °C). A professional read uses adjusted timing and voltage margining to recover marginal cells.
• The part is discontinued. No supported device profile exists in mainstream programmer software.

If any of these apply, a dedicated flash read service is the reliable path to a verified binary.

How Our Flash Read Process Works

Step 1 — Feasibility Assessment (Free)

You send us the chip part number, package photo, and a brief description of the protection state (if known). Within 1–2 business days we respond with a feasibility rating (high / medium / low), estimated cost range, and expected turnaround. There is no charge for this step.

Step 2 — Chip Receipt and Inspection

Ship the programmed device (or the entire PCB). We inspect the package under a stereo microscope at 40× to check for remarked parts, damaged pads, or signs of prior decap. If the chip is soldered to a board, we handle desoldering with IR reflow profiling to avoid thermal shock to the die.

Step 3 — Protection Analysis

Our engineers identify the exact protection scheme. This varies widely by vendor and silicon revision — an STM32F1 with RDP Level 1 is a very different challenge from an STM32H7 with RDP Level 2 and PCROP. We map fuse states, JTAG/SWD lock status, and boot-mode restrictions before choosing an extraction path.

Step 4 — Extraction

Depending on the protection level, extraction may involve voltage glitching, debug-interface exploitation, UV exposure on older EPROM-based fuses, or die-level microprobing after chemical or laser decapsulation. The raw binary is captured in its entirety, including bootloader regions and configuration bytes (option bytes, fuse maps, calibration data).

Step 5 — Verification and Delivery

We perform a CRC-32 and SHA-256 hash check on the extracted image, compare expected flash size versus actual data length, and flag any anomalous regions. The deliverable is a verified .bin or .hex file, plus a brief extraction report noting the protection method, extraction technique used, and any caveats (e.g., “last 2 KB is OTP region, confirmed empty”).

Which Flash Chip Families Can We Read?

We maintain active tooling and documented success across more than 50 IC families. The table below covers the most commonly requested categories. For less common vendors — including SST flash and microcontroller families, Analog Devices mixed-signal ICs, and Panasonic embedded controllers — check the relevant chip page or request a feasibility review.

Success rates are realistic estimates, not guarantees. Some silicon revisions within a family carry stronger protection than others, and physical damage to the die always introduces risk. We will tell you upfront if the odds are poor.

Deliverables and File Formats

Turnaround, Pricing, and What Affects Both

Standard turnaround for a flash read service is 5–10 working days from chip receipt. Rush service (2–3 days) is available for an expedite fee. Pricing depends on three variables:

• Protection complexity. An unprotected SPI flash read starts around $150. A protected MCU with RDP Level 2 or equivalent can range $800–$2,500+ depending on die work required.
• Package type. BGA and CSP packages require more careful desoldering and sometimes reballing, adding $50–$150 to handling costs.
• Quantity. Reading 10 identical chips is not 10× the price — once the extraction method is validated on the first unit, subsequent units are faster. Volume discounts apply above 5 units.

We operate on a no-read-no-fee basis for most chip families: if we cannot extract a valid binary, you pay only a nominal evaluation fee (typically $50–$100).

Authorization and Legal Compliance

Every flash read engagement requires documented proof that you are the rightful owner of the firmware or have written authorization from the IP holder. This can be a purchase invoice for the hardware, a letter of authorization, or an internal engineering declaration. We work under mutual NDA and our full IC unlock service and compliance policies are detailed on our main site. We decline work where ownership cannot be established.

Common Failure Modes and Honest Limitations

Not every flash read succeeds. Transparency about failure modes is part of our process:

• Die damage during decapsulation. Chemical decap with fuming nitric acid can damage bond wires or the flash array if the die is unusually thin (≤100 µm). Risk is low (~3% of jobs) but real.
• Irreversible protection. Some newer MCUs (e.g., STM32H7 RDP Level 2, NXP CRP Level 3) implement protection that physically disables the debug interface. Success depends on silicon revision and may require fault-injection research that is not always viable.
• Encrypted firmware. If the flash contents are AES-encrypted and the key is stored in a one-time-programmable (OTP) fuse bank that self-destructs on tamper, we can read the ciphertext but cannot decrypt it without the key.
• Severe physical damage. Chips recovered from fire, water immersion, or heavy corrosion may have flash-array failures that make full recovery impossible. Partial recovery (80–95% of sectors) is sometimes achievable.

Flash Read vs. Full IC Unlock — What’s the Difference?

The terms overlap, but there is a practical distinction. A flash read targets the extraction of the stored binary — the firmware image. An IC unlock (e.g., on WCH CH32 parts) may also involve clearing protection bits so the chip can be reprogrammed in-circuit afterward. If you need both the firmware and a re-programmable chip, specify that when requesting a quote.

Related reading

• Oct 2026Nuvoton IC Unlock | Families We Can Read & Recover
• Oct 2026ATSAMD51 Unlock | Feasibility, Cost & Lead Time
• Oct 2026Cypress IC Unlock | Supported Families & Feasibility