Most Holtek parts that show up on our bench are readable. The 8-bit OTP and Flash families — HT48R, HT46R, HT66F, HT68F, HT32 ARM parts, and the BS8x touch series — cover the large majority of Holtek IC unlock requests we see, and for those we can usually give you a straight feasibility answer within a day of seeing photos of the chip. Holtek’s security fuse approach is well understood; what varies is die revision, package, and whether the part has been damaged.
This page tells you which families we handle, what actually determines whether your specific part can be read, and what we need from you to quote it.
Which Holtek families we routinely read
Holtek’s catalog is wide but structurally consistent. The 8-bit core is a Holtek proprietary RISC design, and the security mechanism is a fuse or configuration bit that blocks the programmer’s verify path rather than a layered protection scheme like STM32’s RDP levels. That makes the family-by-family picture fairly predictable.
| Family | Memory type | Typical feasibility | Notes |
|---|---|---|---|
| HT48R / HT48C | OTP / mask | Usually straightforward | Older industrial and appliance parts; mask ROM versions need a different route than OTP |
| HT46R (A/D type) | OTP | Usually straightforward | Very common in power supplies, chargers, sensor front ends |
| HT66F / HT68F | Flash | Usually feasible | Newer enhanced 8-bit; more variation between die revisions |
| HT67F / HT69F (LCD types) | Flash | Case by case | Larger dies, more segments of config to reconstruct |
| BS83B / BS84B / BS86 touch | Flash | Case by case | Touch-key parts; body-effect calibration data matters as much as code |
| HT32F ARM Cortex-M | Flash | Depends on option bytes | ARM parts behave more like other Cortex-M devices than like Holtek 8-bit |
| HT1621 / HT16xx drivers | No user code | Not applicable | Peripheral drivers, nothing to extract |
If your marking isn’t in that table, it doesn’t mean no. Holtek uses a lot of customer-specific part numbers, and a chip marked with a house code often turns out to be a standard HT46R or HT66F underneath. Send the photo and we’ll identify it.
The OTP question, specifically
A large slice of the Holtek installed base is one-time-programmable, not Flash. That matters for two reasons. First, an OTP part can’t be reprogrammed, so if you need working replacement units we have to either source blank OTP parts of the same type or migrate the recovered code to a Flash equivalent. Second, OTP arrays respond differently to read techniques than Flash arrays — the physics of the storage cell is not the same, and the approach we choose reflects that.
Customers are often surprised by the sourcing side. Recovering the code from a 2009-vintage HT48R is one problem; finding new HT48R dice in the same package is another. We’ll tell you which one is the bottleneck before you commit.
What actually decides whether your Holtek part can be read
Not all of it is about the chip. In practice, feasibility on a Holtek IC unlock job comes down to five things:
- Exact part number and date code. Holtek revised dies over long production runs. An HT66F318 from one production window can behave differently from the same marking five years later. The date code narrows it down.
- Whether the part is electrically alive. A chip that took a lightning surge through an I/O pin may have a damaged Flash array or a blown internal regulator. We can often still read it, but the odds drop and the effort goes up.
- Package and pin count. A DIP-18 or SOP-28 is easy to handle. A QFN with no exposed leads, or a chip-on-board die under black epoxy, adds a preparation step before anything else happens.
- Whether there’s external memory in the loop. Many Holtek designs park calibration constants or logs in a 24Cxx EEPROM next to the MCU. If the firmware alone won’t make a working unit, we need that EEPROM too.
- Quantity of donor samples. One sample is workable. Two or three gives us room to verify a read against a second device instead of trusting a single dump.
Cases we treat as genuinely uncertain: mask ROM parts with no programming interface at all, heavily potted modules where the die can’t be reached without destroying it, and single-sample jobs on a chip that’s already partly dead. We’ll say so up front rather than take your money and report back a failure three weeks later.
What we need from you to quote a Holtek unlock
Getting a real quote instead of a range takes about five minutes on your side. Send:
- A sharp photo of the chip marking, straight on, on a dark background, with enough light that the laser or ink marking is legible. All lines, including the date code.
- Photos of both sides of the whole board, whole board in frame, dark background. This tells us the package, what’s around the MCU, and whether there’s an EEPROM or external Flash in play.
- Board dimensions and rough component count, if the job might extend beyond the chip into a board-level copy.
- How many samples you can ship, and whether they’re known-good working units or pulls from failed boards.
- One line on what you need back — a raw binary, programmed replacement chips, or firmware plus a full board package.
What comes back from us: a feasibility read on your specific part, a lead time, a price, and a note on anything that could change the answer once the sample is on the bench. If we think it’s a coin flip, we say coin flip.
Deliverables
The standard handover is the binary or hex dump of program memory, plus the configuration and option settings, plus any external EEPROM contents we read alongside it. If you want working hardware rather than files, we program and verify replacement parts and test them in your board. When the request is broader — you’ve lost the original design files, not just the firmware — we combine the chip work with schematic and Gerber recovery so you end up with a buildable product again. That pairing shows up in a lot of our past project work on discontinued industrial controls.
How a Holtek job runs on the bench
Order of operations, roughly, for a typical HT66F or HT46R:
Identification. The engineer confirms the die matches the marking. House-coded parts get cross-checked against pinout and peripheral behavior. This step catches relabeled and counterfeit parts, which are common enough in the Holtek space that we always look.
Non-destructive attempt first. We always try to get the data out with the package intact. If that works, your sample survives and the cost stays lower. Whether it works depends on the die revision and how the security bits were set.
Preparation, only if needed. If the non-invasive path doesn’t produce a clean read, we move to physical access — controlled decapsulation, then work at the die level under a microscope. This consumes the sample. We tell you before we do it, not after.
Verification. A dump is not a result until it makes sense. We check the reset vector points somewhere sane, that the interrupt table is populated, that the code doesn’t dissolve into 0xFF regions where real code should be, and that a second read of the same device matches byte for byte. Where we have two samples, we compare across them. Where the customer has a working reference unit, we program a fresh part and run it in the actual board — that’s the only test that really settles it.
Handover. Files, notes on what we found, and any warnings about regions we couldn’t fully account for. If part of the memory space is unreadable, you get told which part.
Why people ask for this
The jobs that come to us are boring in the best way. A machine builder still ships a product designed around an HT48R and the engineer who wrote the code retired without checking anything into a repository. A repair shop keeps three identical control boards in stock and the fourth failure has no spare. A product owner needs to move off an obsolete Holtek OTP part onto something currently in production, and can’t do that without the original code as a reference.
All of those are the same technical problem: the firmware exists only inside a chip that won’t give it up. Holtek isn’t unusual here — the same conversation happens with STC 8051-derived parts and Nuvoton devices in equally long-lived designs.
We work under NDA on every project, and we ask that you hold the rights to the design or have the owner’s authorization. Legitimate maintenance, obsolescence, failure analysis, and authorized security research are what this service is for.
FAQ
Can you unlock a Holtek chip if I only have one sample?
Usually yes, but with less margin. A single sample means one shot at the non-invasive path and no second device to cross-check the dump against. If the chip has to be decapsulated, you lose that unit. Two or three samples materially improve the odds and let us verify the read properly, so send extras if you have them.
How long does a Holtek IC unlock take?
A common HT46R or HT66F in a friendly package is typically a matter of days once the sample arrives. Unusual die revisions, damaged parts, QFN or chip-on-board packages, and jobs where we also have to source replacement OTP devices take meaningfully longer. We give you a lead time with the quote rather than a blanket promise.
Will I get working replacement chips or just a file?
Either, your choice. Most customers want the binary plus the option and configuration settings so they can program parts themselves. If you’d rather receive programmed and tested devices, we do that — for OTP families it’s often the more practical route, since the part number has to match and blanks aren’t always easy to buy.
What if my
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote
Related reading
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote