Most locked-chip jobs come down to three questions: can this exact part number be read, how long will it take, and what will it cost. The answer depends almost entirely on the chip family and its protection generation. An older 8051 or AVR with lock bits set is routine work. An STM32 sitting at RDP Level 2 is often a hard no. Everything else falls somewhere between, and the part marking tells us most of what we need to know.
This page is written for the engineer who already has the board on the bench — a legacy controller nobody can reflash, a discontinued MCU, a hex file that vanished with a former contractor. It explains how feasibility is judged, what changes the price, what we need from you, and where the real limits sit.
Which chip families are realistically readable
Protection on a microcontroller is not a single switch. It’s a mix of lock bits, fuses, password gates, debug-port disable, and on newer parts, hardware that erases flash the moment an unauthorized read is attempted. The generation of that mechanism matters far more than the brand on the package.
Routine, well-understood families
Classic 8-bit parts are the easiest category. AT89C51, AT89S52, STC89/STC12, W78E series, PIC12F/PIC16F, ATmega and ATtiny — these use lock bits or security fuses that predate modern anti-tamper design. Older EEPROM and serial flash (24Cxx, 93Cxx, 25xx) is usually a straight read once the part is off the board.
Mid-range families that depend on the exact die revision
STM8, STM32F1 and F4 at RDP Level 1, GD32F103, C8051F, MSP430 with the JTAG fuse blown, dsPIC30F/33F, NXP LPC17xx, HCS12 and MC9S08 — these are frequently doable, but the answer moves with silicon revision and date code. Two chips with the same printed part number, made three years apart, do not always behave the same way. That’s why we ask for a photo of the actual marking rather than just the part number typed into an email.
Hard or not feasible
Anything with a genuine secure element, an on-die crypto boundary, or a protection level designed to make the flash unreadable rather than just inaccessible. STM32 at RDP Level 2 permanently disables the debug interface and there is no supported path back — if you want the mechanics of why, our explanation of how read-out protection works covers the level structure. Recent ARM parts with secure boot and encrypted external flash, smart card ICs, and some automotive-grade MCUs also sit in this category. We say so up front rather than taking the money and reporting failure three weeks later.
| Chip class | Typical protection | Feasibility | Usual lead time |
|---|---|---|---|
| 8051 / AVR / older PIC | Lock bits, security fuse | Usually straightforward | Days |
| Serial EEPROM / NOR flash | Little or none | Usually straightforward | Fast |
| STM8, STM32 RDP L1, GD32 | Read-out protection, debug lock | Often possible, revision-dependent | Days to a couple of weeks |
| MSP430, C8051, dsPIC, LPC | Fuse, password, code protect | Case by case | A week or more |
| CPLD / FPGA bitstream | Security bit, encrypted config | Depends heavily on family | Longer, evaluation first |
| STM32 RDP L2, secure elements | Permanent debug disable, crypto boundary | Generally not feasible | — |
You can check your specific part against the full list of chips we support before writing to us, though the list is never fully current — new parts get added as the lab works through them.
What actually happens in the lab
The workflow is boring and methodical, which is the point. Nothing about it resembles the “advanced proprietary technology” phrasing you see on competing pages.
- Identification. We read the top marking under a microscope, including the revision code and date code, and confirm the package. A relabeled or remarked part changes the plan entirely, and we’ve seen plenty.
- Protection check. The chip is placed in a socket or on a breakout and interrogated through its normal programming interface — SWD, JTAG, ICSP, BSL, whatever the family uses. We confirm which protection state it is actually in. Customers often assume the worst case when the part is only partly locked.
- Approach selection. Non-invasive methods are always tried first because they leave the part alive and reusable. Only when those are exhausted do we consider semi-invasive or invasive work, which usually consumes the sample.
- Extraction. The flash and, where present, the data EEPROM are read out to a binary or hex image.
- Verification. This is the step that separates a real dump from a plausible-looking one. We check the reset vector and interrupt table for sanity, look for the expected string and constant regions, confirm the image size matches the device memory map, and where possible program the dump into a blank part of the same type and run it on your board or on a test fixture. A dump that boots and behaves is a dump. Anything else is a hypothesis.
If the read comes back partial — say the code space reads clean but a calibration block in EEPROM is unreadable — we tell you which region failed and what that means functionally, rather than shipping the file and staying quiet.
What drives the price of an IC unlock quote
There’s no flat rate, and any lab quoting one without seeing the marking is guessing. The cost of an IC unlock job is set by a short list of factors:
- Family and protection generation. A fused MSP430F149 and an ATmega8 are not the same amount of work, even though both are “locked.”
- Whether a non-invasive route exists. Decapsulation, sample preparation and microprobing carry real consumable and labor cost, and they need more than one sample.
- Number of samples you can supply. One irreplaceable chip restricts what we’re willing to attempt. Three identical parts open up options.
- Package. Removing a TQFP is routine. A BGA or a chip-on-board blob adds rework time and risk.
- Deliverable scope. A raw binary is one price. Binary plus programmed blank samples, plus verification on your assembly, plus disassembly notes for migrating to a current part, is another.
- Whether board-level work is bundled. Firmware recovery combined with schematic and Gerber recovery is quoted as one project and is usually cheaper than two separate ones.
Urgency matters too. A queue-jumping rush job costs more because it displaces other work on the same bench and the same equipment.
Realistic turnaround, and why it varies
A common 8-bit part with a known route is often a matter of days from the sample arriving. A mid-range 32-bit MCU where the first two approaches fail and a third has to be developed can run into weeks. Families we haven’t worked on before need an evaluation phase first, and we’d rather spend two days confirming feasibility than promise a date we can’t hold.
Three things extend a schedule more than anything else: only one sample available, an unexpected silicon revision, and a package that has to come off a live board without damaging the board. Shipping time from your location to Shenzhen is on top of lab time — build that into your own planning.
What to send us, and what comes back
Getting a useful answer takes about five minutes of your time. Send:
- A sharp, well-lit photo of the chip’s top marking — every line of text, including revision and date code. Dark background, chip filling the frame.
- The package type and pin count, if you know it.
- How many identical samples you have, and whether any are expendable.
- Whether the chip can be desoldered or must stay on the board.
- One line on what you need: raw dump only, dump plus programmed blanks, or firmware plus board files.
- Anything you already know about the part’s state — does it respond on SWD, does a programmer see it at all, has anyone attempted a read.
What comes back is a feasibility assessment for that specific marking, an honest note on confidence, a lead time, and a price. If we think it can’t be done, you get that answer for free instead of an invoice. Our page on what we need from you to unlock a chip covers the sample-handling details in more depth.
On the legal side: this work supports legitimate engineering — recovering firmware you own but no longer have source for, keeping out-of-production equipment in service, migrating off an obsolete part, failure analysis, and authorized security research. You’re responsible for holding the rights to the design and for complying with applicable IP law in your jurisdiction, and every project runs under NDA.
Common questions
How much does it cost to read a locked MCU?
It depends on the family, the protection state, and the deliverables, so we quote per part number rather than publishing a rate card. A common 8-bit part with a known route sits at the low end. Work that requires decapsulation and multiple samples costs considerably more. Send the marking photo and you’ll get a real number, not a range.
Can you do it without desoldering the chip?
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote