IC Unlock Success Rate: How a Chip Is Assessed Before You Pay

Why IC Unlock Success Rate Is the First Question You Should Ask

When a client contacts a lab about recovering firmware from a protected microcontroller, the conversation almost always starts with the same question: “What are the chances this will actually work?” That question—about the IC unlock success rate—is not just reasonable; it is the single most important factor in deciding whether to proceed.

A reputable microcontroller firmware recovery lab will never quote a price without first estimating feasibility. The assessment is a structured process, not a guess. It considers the chip family, the specific protection mechanism, the physical condition of the device, the number of available samples, and the lab’s historical data on similar parts. The output is a probability range—sometimes expressed as a percentage, sometimes as a simple “high / medium / low / not feasible” rating—that tells you whether to invest.

This article walks through every variable that feeds into that rating, explains why some chips sit at 95 % while others sit at 0 %, and gives you a practical framework for interpreting the answer a lab gives you.

The Feasibility Assessment: What Happens in the First 48 Hours

Before any invasive work begins, the lab runs a triage process. Think of it as a diagnostic consultation rather than surgery. Here is the typical sequence:

1. Part identification. The chip marking is cross-referenced against internal databases. Remarked or sanded parts are flagged immediately—they lower confidence because the actual silicon may differ from the label.
2. Protection-level lookup. The lab checks which security features the chip family supports and, where possible, reads the device’s security register to determine which level is active.
3. Historical match. The lab searches its records for previous jobs on the same part number and revision. A chip that has been successfully unlocked dozens of times carries a very different risk profile from one the lab has never seen.
4. Sample inspection. The physical condition of the device matters. Corrosion, cracked packages, missing pins, or signs of previous rework all affect the IC unlock success rate.
5. Method selection. Based on steps 1–4, the engineer selects a candidate attack path—non-invasive, semi-invasive, or fully invasive—and estimates the probability of each path succeeding.

Only after this triage does the client receive a quote. If the assessment points to a very low IC unlock success rate, an honest lab will say so upfront rather than collect a fee for work that is unlikely to deliver a result.

Variables That Determine IC Unlock Success Rate

1. Chip Family and Manufacturer

This is the single largest factor. Different manufacturers implement protection at different levels of sophistication. A broad generalisation:

These ranges are approximations. Within each row, the actual number depends on the specific part revision, the silicon foundry node, and whether the manufacturer has patched known vulnerabilities in later mask sets.

For instance, STM32 read-out protection at RDP Level 1 is well-understood and has a high recovery rate, while RDP Level 2 on the same family is a permanent lock that drops the rate to near zero. Similarly, GD32 parts that mirror the STM32 architecture may respond to similar techniques, but subtle silicon differences can shift the outcome.

2. Protection Level Active on the Specific Device

Most MCU families offer multiple protection tiers. The higher the tier, the lower the IC unlock success rate. Consider a simplified model:

• Level 0 (no protection): Firmware can be read directly. Success rate is effectively 100 %—no “unlock” is needed.
• Level 1 (software read-out protection): Debug ports are disabled, but the protection is enforced by configuration bits that may be vulnerable to glitching, UV exposure, or side-channel attacks. Success rate: 70–95 %.
• Level 2 (permanent lock / hardware fuse): The protection is blown by a one-time-programmable fuse or an irreversible chemical change in the silicon. Success rate: 0–30 %, often requiring physical die exposure and micro-probing.
• Level 3 (encrypted storage + tamper mesh): Found on secure elements. The firmware is encrypted at rest, and the die is covered with an active shield that detects physical probing. Success rate: effectively 0 % for most commercial labs.

The critical takeaway: the same chip at different protection levels can have wildly different success rates. A lab that tells you “we can do STM32” without asking which RDP level is active is not doing a real assessment.

3. Physical Condition of the Sample

Even a chip with a theoretically high success rate can fail if the sample is damaged. Common issues include:

• Corroded or missing bond pads — prevents electrical contact for glitching or reading.
• Cracked die — may have severed critical interconnects.
• Previous decapsulation attempts — acid damage to the passivation layer or metal traces can destroy the very structures the lab needs to probe.
• ESD damage — the flash memory array may already be partially corrupted, meaning even a successful unlock yields garbage data.

This is why labs ask for photographs and, ideally, multiple samples. Each additional sample raises the aggregate IC unlock success rate because the lab can attempt different methods on different units without risking the only copy of the firmware.

4. Number of Available Samples

A single sample means a single attempt. If the method is destructive—decapsulation, laser cutting, FIB editing—there is no second chance. With three to five samples, the lab can:

• Use one sample for exploratory work (die imaging, process characterisation).
• Use a second sample for the actual attack.
• Hold a third in reserve if the first attack damages the die.

As a rule of thumb, providing three samples instead of one can raise the effective IC unlock success rate by 10–20 percentage points on medium-difficulty chips.

5. Attack Method Available

The method chosen is a function of all the variables above. Here is how each class of method maps to success probability:

Non-invasive methods are always preferred because they preserve the sample and are repeatable. The lab escalates to invasive methods only when the technical assessment of the IC crack path shows no viable software-only route.

6. Lab Experience and Tooling

Two labs given the same chip can report different success rates. The difference comes down to:

• Database depth. A lab that has processed thousands of NXP Kinetis, LPC, and S12 security configurations will have refined recipes that a less experienced lab lacks.
• Equipment. Focused ion beam (FIB) systems, femtosecond laser stations, and high-end probing stations cost millions. Not every lab has them.
• Process discipline. Repeatable results require documented procedures, calibrated equipment, and clean-room conditions for invasive work.

How to Read a Lab’s Feasibility Report

After the triage, a good lab will give you a structured answer. Here is what each part means and what you should look for:

Success Probability Tier

Most labs use a tiered system rather than a precise percentage, because the uncertainty is real:

• High (≥ 80 %): The lab has done this exact part many times. The method is well-characterised. You should expect success.
• Medium (40–79 %): The lab has a viable attack path but has not fully validated it on this specific revision, or the method has inherent variability (e.g., glitching timing windows).
• Low (10–39 %): The lab believes an attack is theoretically possible but has limited data. Expect to provide multiple samples and accept the risk of failure.
• Not feasible (< 10 %): The protection is beyond current commercial capabilities. The lab should decline the job or clearly state the near-zero odds.

Pricing Model

The IC unlock success rate directly affects how the lab prices the work:

• Fixed fee: Common for high-probability chips. The lab absorbs the small risk of failure.
• No-success-no-fee: Sometimes offered for medium-probability chips. The lab charges nothing if the unlock fails, but the quoted price is higher to compensate for the risk.
• Evaluation fee + success fee: Common for low-probability or novel chips. You pay a non-refundable evaluation fee to cover lab time, plus a larger success fee only if the firmware is recovered.

If a lab offers a flat fixed fee on a chip that should be in the “low” tier, be cautious. They may be overestimating their capabilities, or the fee may be non-refundable regardless of outcome.

Deliverables and Verification

A successful unlock is only useful if the extracted data is verified. The feasibility report should state:

• What format the firmware will be delivered in (Intel HEX, binary, S-record).
• Whether EEPROM data and configuration bytes are included.
• How the lab verifies integrity—typically by programming the extracted binary into a blank device and confirming functional equivalence.

Real-World Success Rate Ranges by Chip Family

The following table compiles approximate ranges based on publicly discussed results and industry experience. These are not guarantees; they are starting points for your own feasibility conversation.

What Lowers the IC Unlock Success Rate (and What You Can Do About It)

Factors That Lower It

• Only one sample available. Every destructive step becomes a one-shot gamble.
• Chip has been through reflow multiple times. Thermal cycling degrades flash retention and bond wire integrity.
• Unknown or remarked part. The lab cannot select the right method if the true silicon is uncertain.
• Latest mask revision. Manufacturers patch vulnerabilities in newer revisions. A technique that worked on Rev A may fail on Rev C.
• Encrypted firmware. Even if the binary is extracted, it may be AES-encrypted with a key stored in OTP memory that is destroyed during the unlock process.

Actions That Raise It

• Provide 3–5 samples. This is the single most impactful thing a client can do.
• Supply a working reference board. The lab can compare extracted firmware behaviour against the known-good board.
• Share the part datasheet and any known configuration. Knowing the exact part number, revision, and clock configuration saves the lab hours of guesswork.
• Be transparent about previous attempts. If another lab already tried and failed, knowing what they attempted prevents the new lab from repeating the same dead end.

When the Success Rate Is Too Low: Alternative Paths

If the feasibility assessment comes back as “low” or “not feasible,” the project is not necessarily dead. Consider these alternatives:

• Functional cloning. Instead of extracting the original firmware, the engineering team reverse-engineers the board’s behaviour and writes new firmware that replicates it. This is more expensive but bypasses the chip entirely.
• Board-level recovery. If the goal is to reproduce the entire product—not just the firmware—a board-level duplication workflow combined with new firmware development may be more cost-effective than an uncertain IC unlock.
• Sourcing a pre-locked replacement. In some cases, blank chips of the same part number can be sourced, and the firmware can be obtained from the original manufacturer under licence.

Red Flags: When a Lab’s Claimed Success Rate Should Not Be Trusted

Not every claim is honest. Watch for these warning signs:

• “100 % success rate on all chips.” No lab achieves this. Secure elements alone make the claim impossible.
• No questions asked about protection level or sample condition. A lab that quotes without asking is not doing an assessment.
• Full payment upfront with no milestone structure. Legitimate labs either offer no-success-no-fee or split the payment into an evaluation fee and a success fee.
• No verification step described. If the lab does not explain how they confirm the extracted binary is correct, the “success” may be a corrupted dump.

A trustworthy lab will tell you “we don’t know” or “we can’t do this” more often than you expect. That honesty is itself a signal of competence.

Summary: A Decision Framework

Before committing budget to an IC unlock project, run through this checklist:

1. Identify the exact chip part number, revision, and active protection level.
2. Count your available samples. If you have only one, seriously consider whether the risk is acceptable.
3. Request a written feasibility assessment from the lab, including the estimated IC unlock success rate tier, the proposed method, and the pricing model.
4. Compare the lab’s estimate against the general ranges in this article. If the numbers diverge significantly, ask why.
5. If the success rate is below 40 %, evaluate alternative paths before proceeding.
6. Ensure the quote includes a verification step—programming the extracted binary into a blank device and testing it.

The IC unlock success rate is not a mystery. It is a measurable, predictable quantity that depends on well-understood variables. The job of a good lab is to quantify it honestly. Your job is to make an informed decision based on that number.

Related reading

• Oct 2026AT90 Unlock | Feasibility, Cost & Lead Time
• Oct 2026AVR IC Unlock | Which Families We Can Read
• Oct 2026dsPIC33E-CH Crack | Protection Levels & Recovery