What Is an IC Clone Service?
An IC clone service extracts the firmware (program code, EEPROM data, configuration fuses) from a protected microcontroller and programs it into a blank device of the same part number. The result is a functionally identical chip you can drop into a replacement board, a test fixture, or a second-source production run. Our engineers perform this work exclusively for clients who own the intellectual property or hold documented authorization—covering scenarios like legacy equipment maintenance, disaster recovery, and end-of-life component bridging.
We currently support more than 50 MCU families spanning STM32, STM8, PIC, dsPIC, AVR ATmega/ATtiny, AT89 (MCS-51), MSP430, C8051, Renesas RL78/RX, NXP LPC, and Freescale/NXP Kinetis. Success depends on the specific read-protection level the original programmer enabled—some parts yield a binary-identical readout in under a day; others require invasive techniques and carry inherent risk. That is why every engagement starts with a free feasibility check.
How Does the IC Clone Process Work?
Step 1 — Feasibility Assessment (Free)
You send us the chip part number, package marking, and a brief description of why you need the clone. Within 1–2 business days our team returns a feasibility rating (high / medium / low / not feasible), an estimated cost range, and a turnaround window. No payment, no commitment. If you can ship a sample device, we can sometimes narrow the estimate further by probing the debug port before committing to extraction.
Step 2 — NDA and Authorization
Before extraction begins, both parties sign a mutual NDA. You provide proof of ownership or a letter of authorization for the firmware. This protects your IP and ensures the work stays within legal and ethical boundaries.
Step 3 — Firmware Extraction
Depending on the protection scheme, our engineers use one or a combination of these techniques:
- Non-invasive readout — exploiting debug-port or bootloader-level vulnerabilities to dump flash without decapping. Fastest path; preserves the original chip.
- Semi-invasive attack — UV or laser fault injection to glitch the security fuse state, then read via standard interface. Chip may or may not survive.
- Invasive microprobing — decapping the die, imaging the metal layers, and probing internal buses. Used on high-security parts (e.g., certain STM32L4 or PIC24 families with RDP Level 2 or equivalent). The donor chip is consumed.
Step 4 — Verification and Delivery
Extracted firmware is verified against a CRC or functional test on a reference board (yours or ours). We deliver the binary file (.hex / .bin / .s19) plus, if requested, a batch of pre-programmed blank chips ready for assembly. Typical end-to-end turnaround: 5–15 working days, depending on technique complexity.
Which MCU Families Can Be Cloned?
| Vendor / Family | Common Parts | Typical Protection | Feasibility |
|---|---|---|---|
| ST STM32 (Cortex-M) | STM32F1xx, STM32L1xx, STM32L4xx | RDP Level 1 / Level 2 | High (L1) to Medium (L2) |
| ST STM8 | STM8S105, STM8L051 | ROP byte | High |
| Microchip PIC16/18 | PIC16F1509, PIC18F series | CP / CPD bits | High |
| Microchip PIC24 / dsPIC | PIC24FJ, dsPIC33FJ | Code-protect + GCP | Medium to High |
| Atmel AVR | ATmega8/16/32, ATtiny13/85 | Lock bits (LB1/LB2/LB3) | High |
| Atmel MCS-51 | AT89C52, AT89S51 | Lock bit modes 1–3 | High (mode 1–2), Medium (mode 3) |
| TI MSP430 | MSP430F149, MSP430G2553, MSP430FR5969 | JTAG fuse / BSL password | High (F/G), Medium (FR FRAM) |
| Silicon Labs C8051 | C8051F340 | Read lock byte | High |
This table is representative, not exhaustive. If your part isn’t listed, our free feasibility check covers it. For specific part-number details, see our dedicated pages: STM32L151 firmware recovery, PIC24FJ code extraction, or ATmega8 lock-bit bypass.
What Affects IC Clone Success Rate and Cost?
Not every IC clone service engagement succeeds. Transparency about limitations is part of our process—and it helps you make an informed decision before spending money.
Protection Level
A single-level read-protect (e.g., STM8 ROP, AVR LB mode 2) is straightforward. Multi-level schemes like STM32 RDP Level 2 trigger a mass-erase on tamper detection, requiring invasive die-level work that raises cost from a few hundred dollars to potentially $2,000+ and extends turnaround to 10–15 days.
Package and Die Process Node
Older 0.35 µm – 0.18 µm nodes (common in AT89, PIC16, ATmega) have wider metal traces that are easier to probe. Modern 90 nm or 40 nm parts (some STM32L4, Kinetis) have denser interconnects and more metal layers, increasing invasive-work difficulty and the chance of destroying the die before a full readout.
Number of Donor Chips Available
Invasive extraction consumes the chip. If you have only one sample, the margin for error is zero. We recommend shipping at least two programmed devices when possible—especially for parts rated “medium” feasibility.
Encrypted or Obfuscated Firmware
Extracting the raw binary is one thing; if the firmware is AES-encrypted and decrypted at runtime by an on-chip key stored in OTP, the cloned binary will only run on a chip with the same key. We flag this during feasibility and discuss workarounds (key extraction, re-encryption) before proceeding.
Typical Pricing Ranges
| Complexity Tier | Example Parts | Price Range (USD) | Turnaround |
|---|---|---|---|
| Standard (non-invasive) | ATmega8, AT89C52, STM8S105, PIC16F1509 | $150 – $500 | 5–7 working days |
| Advanced (semi-invasive) | STM32F1 RDP1, MSP430F149, dsPIC33FJ | $500 – $1,200 | 7–12 working days |
| High-security (invasive) | STM32L4 RDP2, PIC24FJ high-security | $1,200 – $3,000+ | 10–15 working days |
Prices include the firmware file. Pre-programmed blank chips can be ordered in batches at additional per-unit cost (typically $3–$15/chip depending on the part). Volume discounts apply above 100 units.
Who Uses an IC Clone Service?
- Maintenance engineers keeping legacy industrial controllers running after the original vendor discontinued support.
- OEMs recovering firmware from a contract manufacturer who went out of business or refuses to release source.
- Repair depots needing a drop-in replacement MCU for field-returned boards where the chip has failed.
- Product designers migrating firmware to a pin-compatible successor part during an end-of-life transition.
In every case, the client must demonstrate ownership or authorization. We do not perform extraction for the purpose of copying a competitor’s proprietary design. For details on our authorization policy, see our pages on STM8S105 unlock procedures and MSP430G2553 recovery requirements.
What You Receive
- Firmware binary in .hex, .bin, or .s19 format
- Fuse/option-byte configuration report (so you can replicate the exact device state)
- CRC/checksum verification log
- Optional: batch of pre-programmed replacement chips, tested and tape-and-reel or tray packed
- NDA-protected project archive retained for 12 months in case you need a repeat order
Frequently Asked Questions About IC Clone Services
Is an IC clone service legal?
Cloning firmware you own or are authorized to duplicate is legal in most jurisdictions, similar to making a backup of software you’ve licensed. We require proof of ownership or a written authorization letter before starting work, and all projects are covered by a mutual NDA. We refuse engagements that appear intended to infringe third-party IP.
Will the original chip survive the cloning process?
For non-invasive and most semi-invasive extractions, the donor chip remains functional. Invasive microprobing—required for high-security parts—destroys the die. We always disclose this during the feasibility stage so you can decide whether to proceed, especially if you have only one sample.
Can you clone a chip if I don’t know the exact part number?
Yes. Send us clear photos of the chip markings (top and side), the board it sits on, and any documentation you have. Our engineers can usually identify the MCU family, package, and flash size from markings, die inspection, or JTAG/SWD probing. Parts with sanded or laser-erased markings take longer but are often still identifiable through electrical signature analysis.
What if the firmware is encrypted or the clone doesn’t boot?
If the binary is AES-encrypted with an on-chip OTP key, a raw flash dump won’t execute on a blank chip without that key. We attempt key extraction where technically feasible and flag this risk upfront. If a clone fails functional verification, we troubleshoot fuse settings, clock configuration, and peripheral initialization before concluding the project. You are not charged for an unsuccessful extraction.
How do I start?
Send us the chip part number and a brief project description through our quote form. You’ll receive a feasibility report within 1–2 business days—no cost, no obligation. If you want to explore related chip families first, browse our pages on ATtiny85 unlock or C8051F340 readout for part-specific detail.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote