If you have ever requested a quote for microcontroller firmware recovery, you already know the range is enormous. A straightforward 8-bit PIC can be a few hundred dollars. A modern Cortex-M33 with TrustZone may be several thousand. And a latest-generation automotive HSM? The answer is often “not feasible at any price.” Understanding what drives IC unlock cost helps you budget realistically, avoid scams, and decide whether recovery is worth pursuing at all.
What “IC Unlock” Actually Involves
Before we talk money, it helps to understand what happens behind the lab door. IC unlock — also called chip decryption or microcontroller read-out protection bypass — is the process of extracting firmware from a chip whose manufacturer-level security features are enabled. The work may be non-invasive (exploiting a protocol-level vulnerability), semi-invasive (using fault injection or laser techniques), or fully invasive (decapping the die and probing it physically). Each approach carries different equipment costs, skill requirements, and risk levels, all of which feed directly into the price you are quoted.
For a deeper look at how the overall process works, see our guide to recovering firmware from protected microcontrollers.
The Seven Factors That Determine IC Unlock Cost
No two chips cost the same to unlock. Below are the factors engineers weigh when they price a job, listed roughly in order of impact.
1. Protection Architecture and Generation
This is the single biggest cost driver. A chip with a simple one-time-programmable (OTP) lock bit — common on older 8051 derivatives and early PIC families — can often be bypassed with a known, repeatable technique. The lab has done it hundreds of times; the marginal cost is low.
Contrast that with a device that implements encrypted boot, secure key storage, anti-tamper mesh on the die, and active voltage-glitch detection. Each additional layer multiplies the engineering hours and may require custom tooling. Some Infineon TriCore and newer NXP S32 devices fall into this category, where the protection was designed from the ground up to resist exactly the attacks a lab would attempt.
2. Chip Family Popularity
Labs amortise research across customers. If a hundred people per year need the same STM32F103 unlocked, the per-job cost is low because the method is already developed, tested, and documented. If you bring in a rare Renesas RL78/I1E that the lab has never seen, someone has to study the datasheet, examine the die, and develop a new attack path — possibly over weeks. That R&D cost lands on your invoice.
3. Invasive vs. Non-Invasive Method
| Method Type | Typical Equipment | Relative Cost | Risk to Chip |
|---|---|---|---|
| Non-invasive (protocol exploit, glitch) | Programmer, glitch rig | Low – Medium | Very low |
| Semi-invasive (UV, laser fault) | UV source, laser station, FIB | Medium – High | Moderate |
| Fully invasive (decap + micro-probe) | Acid bench, optical/SEM microscope, probing station | High – Very High | High (destructive) |
Non-invasive methods keep costs down because they do not destroy the sample and can often be retried. Once a lab has to remove the chip package to expose the die, the price jumps — not just because of chemicals and microscope time, but because a failed attempt means you must supply another chip.
4. Number of Sample Chips Available
Invasive work is destructive. If you have only one chip, the lab bears enormous pressure to get it right the first time, and they price that risk in. Providing three to five samples usually lowers the per-unit cost and raises the overall success probability. Some labs will not accept a single-sample invasive job at all.
5. Process Node (Die Feature Size)
A chip fabricated on a 350 nm process has metal traces wide enough to probe with a standard tungsten needle. A 28 nm FinFET device has features smaller than the wavelength of visible light. Probing it requires a focused ion beam (FIB) system costing millions of dollars, and the operator needs years of training. Process node alone can move a quote from $500 to $50,000.
6. Output Verification Requirements
Extracting a raw binary is one thing. Verifying that every bit is correct is another. Some customers need a checksum-verified HEX file ready to program into a blank chip. Others need the binary disassembled and annotated. Verification adds time, especially if the lab must program a blank device and compare its behaviour against the original. This step is where the pre-assessment to determine whether recovery is realistic pays for itself — because knowing the expected output format up front prevents costly rework.
7. Urgency and Queue Position
Most labs run a queue. Standard turnaround for a common chip might be two to three weeks. If your production line is down and you need firmware in five days, expect a rush surcharge of 30 – 100 %. The surcharge is not greed; it reflects the opportunity cost of bumping other paying customers.
Realistic Price Ranges by Chip Category
The table below is a rough guide based on publicly available data and industry experience. Actual quotes depend on the seven factors above.
| Chip Category | Example Families | Typical IC Unlock Cost (USD) | Feasibility |
|---|---|---|---|
| Legacy 8-bit MCU (OTP lock) | PIC16F, AT89C51, MC68HC05 | $150 – $500 | High |
| Mainstream 8/16-bit MCU | MSP430, STM8, N76E003 | $300 – $1,200 | High |
| 32-bit Cortex-M0/M3 (basic RDP) | STM32F1, LPC1768, GD32 | $400 – $2,000 | Medium – High |
| 32-bit Cortex-M4/M7 (advanced RDP) | STM32F4, Kinetis K64 | $1,000 – $5,000 | Medium |
| DSP / high-performance | TMS320F28, ADSP-2148x | $2,000 – $15,000 | Low – Medium |
| Secure-element class | ATECC608, SLE78, Infineon HSM | Not quoted | Very Low / Not Feasible |
For specific families, our chip-level guides give more detail — for example, MSP430 JTAG fuse and BSL password handling or TI TMS320 and ADI SHARC protection in practice.
Why Some Chips Cannot Be Unlocked at Any Price
It is tempting to think that enough money solves every problem. In IC unlock, that is not true. Here is why.
Active Anti-Tamper Mesh
Some dies have a fine metal mesh covering the entire memory area. Any attempt to cut or probe through it triggers an erase of the flash contents. The mesh is monitored by a battery-backed circuit, so even powering the chip off does not help. This is standard on banking-grade secure elements and some automotive HSMs.
Encrypted Flash with Per-Device Keys
If the flash contents are AES-256 encrypted and the key is stored in a one-time-programmable (OTP) fuse that self-destructs on tamper, reading the flash gives you ciphertext with no practical path to the plaintext. The key never leaves the chip during normal operation.
Small Geometry + Redundant Sensors
Advanced nodes combine voltage-glitch detectors, temperature sensors, light sensors, and clock monitors. Defeating one sensor may trigger another. The combinatorial complexity makes a reliable attack path economically or technically impossible with current tooling.
An honest lab will tell you “not feasible” up front rather than take your money. That transparency is a hallmark of a reputable provider — and it is exactly what the IC crack feasibility assessment is designed to deliver.
Hidden Costs Most Customers Forget
The sticker price of an IC unlock is only part of the total spend. Budget for these as well:
- Sample procurement: If the chip is obsolete, buying three samples on the broker market can cost more than the unlock itself.
- Desoldering risk: Removing a QFP-144 or BGA from a populated board without damaging it requires rework equipment. One overheated pad can kill the chip.
- Shipping and customs: International shipments of bare ICs need proper ESD packaging. Some countries have export-control rules on certain chip families.
- Post-unlock programming: You will need a compatible programmer and the correct adapter socket. For BGA parts, this alone can be a $500+ investment.
- Firmware adaptation: If you are migrating to a different silicon revision, the extracted binary may need patching — register addresses, clock trees, or peripheral mappings may differ.
How to Get an Accurate Quote
The more information you provide, the tighter the estimate. At minimum, send the lab:
- Full part number — including revision suffix and date code. “STM32” is not enough; “STM32F103C8T6, date code 2019, revision Z” is.
- Number of samples available — and whether they are loose chips or soldered to a board.
- Known protection state — e.g., “RDP Level 1” or “JTAG fuse blown.” If you do not know, say so.
- Desired output format — raw BIN, Intel HEX, or annotated disassembly.
- Timeline — standard queue or rush.
A responsible provider will run a feasibility check before committing to a price. That check may itself carry a small fee (typically $50 – $150), but it protects you from paying thousands for a job that was never going to succeed.
When IC Unlock Cost Makes the Project Uneconomical
Sometimes the math simply does not work. If the unlock quote exceeds the cost of redesigning the product around a new MCU, redesign wins. This is especially true for Nuvoton N76E, NUC, and M0 series parts where the silicon is inexpensive and the application is straightforward — rewriting the firmware from a known specification may be faster and cheaper than extracting it.
Other scenarios where alternatives beat unlock:
- The product is still in production: Negotiate with the original firmware supplier for a license or source-code escrow.
- The board can be black-box tested: Stimulus-response characterisation can sometimes reconstruct the firmware’s behaviour without ever reading the binary.
- Only the PCB is needed: If the goal is board-level duplication rather than firmware recovery, a separate board-level cloning service may solve the problem at a fraction of the cost.
Red Flags in IC Unlock Pricing
The unlock market has its share of dishonest operators. Watch for these warning signs:
- “We can unlock any chip.” No lab can. If they claim otherwise, they are either lying or planning to take your money and return a corrupted file.
- No feasibility check offered. A lab that quotes a flat price without examining the part number is guessing.
- Price far below market. If every other lab quotes $2,000 and one quotes $200, the outlier is likely planning to attempt a generic attack and refund you when it fails — after holding your samples for months.
- No NDA or confidentiality terms. Your firmware is your IP. A professional lab will sign an NDA before you ship anything.
Bringing It All Together
IC unlock cost is not arbitrary. It is a direct function of the chip’s protection architecture, the lab’s existing tooling and experience with that family, the attack method required, and the number of samples you can provide. The table below summarises the decision framework:
| Question | Low-Cost Outcome | High-Cost Outcome |
|---|---|---|
| Is the chip family common? | Yes — method already developed | No — R&D needed |
| Protection type? | Simple lock bit or fuse | Encrypted boot + tamper mesh |
| Process node? | ≥ 130 nm | ≤ 40 nm |
| Samples available? | 3 – 5 chips | Only 1 chip |
| Method required? | Non-invasive | FIB + micro-probing |
| Timeline? | Standard queue | Rush |
If most of your answers fall in the left column, expect a quote in the hundreds. If they fall on the right, expect thousands — or a polite “not feasible.” Either way, an upfront feasibility assessment is the smartest money you will spend in the entire process.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote