For a typical IoT device board — a two- or four-layer design with a wireless module, a small MCU, a switching regulator, and a sensor front end — schematic recovery and Gerber extraction usually runs a few business days to a bit over a week. Cost tracks layer count, component count, whether the RF section needs impedance work, and whether you also need firmware off a locked MCU. Send photos and a board, and you get a fixed price and a date before anything starts.
That’s the short version. Below is what actually drives those two numbers, because IoT boards have a specific set of quirks that make them cheaper than an industrial drive and more annoying than a plain sensor breakout.
Why IoT boards price differently than other boards
IoT hardware sits in an unusual spot. The boards are small and the copper count is low, which pushes cost down. But three things push cost back up, and they show up on almost every project we see.
First, the antenna and RF front end. A 2.4 GHz trace antenna, a pi-network match, and a 50-ohm feed line are not features you can copy by geometry alone. If the copy has to work at the same range and pass the same radiated tests, we need the dielectric thickness, the copper weight, and the actual stackup — not a guess. That means measuring the board cross-section, not just imaging the layers.
Second, the modules. An ESP32-WROOM, a Quectel or SIMCom cellular module, an nRF52 module, a LoRa SX12xx module — these are shielded cans soldered over a keep-out area. Under the shield is a second small board. Whether we open the can depends on what you need. If you are keeping the module as a purchased part, we capture its footprint and pin nets and stop there. If the module is obsolete, the job just grew.
Third, the firmware. On an IoT board the schematic alone is often useless to you. The value lives in the MCU flash and, sometimes, in a serial EEPROM holding provisioning data, calibration constants, or certificates. That’s a separate workstream with its own feasibility question.
What raises the price on an IoT board
- Layer count. Four layers with a dedicated ground plane under the RF section costs meaningfully more than two layers, because the inner layers have to be imaged separately after controlled removal of the outer copper.
- Component count. A board with 40 passives is not the same job as a board with 300. Every 0402 resistor needs a measured value and a verified net.
- 0201 and 01005 passives. Common on wearables and small trackers. Slower to identify, slower to verify, easier to lose.
- BGA and QFN with center pads. A WLCSP sensor or a BGA applications processor means X-ray for the hidden balls and via structure.
- Buried and blind vias / HDI. Typical on cellular and camera-bearing IoT designs. Adds imaging steps and adds stackup ambiguity.
- Conformal coating or potting. Outdoor sensors and utility meters are often coated. Removal is slow and risks pad damage on a single-sample job.
- Firmware work. Reading a locked MCU is priced by chip family and protection state, not by board complexity.
- Deliverable set. Gerbers plus BOM is one price. Gerbers, BOM, netlist, editable schematic, and a working assembled prototype is another.
How long an IoT device PCB reverse engineering job takes
Lead time is mostly driven by three gates: layer imaging, component identification, and verification. Each one has a floor you can’t compress by throwing people at it.
Layer imaging on a two-layer board is fast — both sides scan directly. Four layers means the board goes through controlled copper removal so the inner planes and routing can be imaged cleanly, and that is sequential work. Six layers on a small cellular gateway takes longer still, and the risk of losing detail on a single sample goes up, which is why we ask for two boards when you have them.
Component identification is where IoT boards eat time. Marking codes on 0402 caps don’t exist. Small QFNs carry three-character house codes. A no-name Chinese buck converter in SOT-23-6 may need in-circuit behavior checks to pin down. That work is measurement, not lookup, and it is the honest reason a small board can take a week.
Verification is the last gate and we don’t skip it. The recovered netlist gets checked back against the physical board point-to-point on every net, and the drill and copper output is reviewed against IPC-A-600 acceptability criteria and IPC-2221 spacing rules before it leaves. If you are having boards built and assembled, add fabrication and assembly time on top of the engineering time.
| Board type | Typical engineering effort | What drives it |
|---|---|---|
| 2-layer BLE sensor node, module-based, <60 parts | Shortest — a few business days | Direct scan both sides, small BOM |
| 4-layer Wi-Fi/LoRa gateway, 100–200 parts | Moderate — about a week | Inner-layer imaging, RF stackup measurement |
| 4–6 layer cellular tracker with SIM, GNSS, charger | Longer | More nets, coating removal, antenna matching |
| 6+ layer HDI wearable, 0201 passives, WLCSP | Longest | Blind/buried vias, X-ray, fine-pitch verification |
| Any of the above plus locked MCU firmware | Runs in parallel, sets the critical path | Chip family and protection state |
What to send us for a quote
Feasibility and price come from photos first. You don’t need to ship anything to find out whether the job makes sense.
- Clear photos of both sides of the board, laid on a dark, non-reflective background, with the whole board in frame and square to the camera. No flash glare across the silkscreen.
- Board dimensions in millimeters, plus total thickness if you can measure it with calipers.
- The chip markings — a close-up of the MCU and the wireless module, all lines of text readable. If the module has a shield can, tell us whether it can be removed.
- One line on deliverables. Schematic only? Gerbers for refab? BOM with substitutes? Working prototype? Firmware too?
- Quantity and intent. One repair board, a small maintenance batch, or a production migration. It changes what we optimize for.
What comes back is a feasibility opinion, a lead time, and a fixed price — with any hard spots named explicitly rather than buried. If the RF section can’t be reproduced to the original performance from the sample you have, we say so up front. Our general notes on how much PCB reverse engineering costs explain how the same variables apply outside the IoT space.
Firmware: the part that decides whether the project is worth doing
Most IoT reverse engineering requests we get are really firmware requests wearing a hardware costume. The product owner has the board, the enclosure, and the sales channel, and has lost the source tree — the contractor moved on, the repo died with a laptop, or the hex was only ever on a programmer PC that got wiped.
Feasibility depends entirely on the part and how it was locked. An ESP32 with flash encryption and secure boot enabled is a different problem than an ESP32 with an unencrypted external SPI flash. An STM32 at RDP Level 1 behaves differently than one at Level 2. AVR and 8051 derivatives depend on which lock bits were programmed. An external 24Cxx or 25Qxx that holds config data is often the easy win, and sometimes it’s all you actually needed.
We won’t tell you a specific chip is guaranteed readable, and we won’t quote a success rate. What we will do is look at the exact marking, tell you which category it falls into, and say plainly if we think the odds are poor before you spend money. Legitimate reasons we do this work: recovering code you own, keeping out-of-production equipment in service, migrating off an end-of-life MCU, and failure analysis. You need to hold the rights to the design, you’re responsible for complying with applicable IP law, and every project runs under NDA.
Where IoT jobs get hard, and where we say no
Honest limits, because they save both of us a week.
Certified RF performance. We can reproduce the layout and the stackup. We cannot promise your copy passes FCC or CE radiated emissions, because that depends on enclosure, cable dress, and the specific build. If the design used a pre-certified module, keeping that same module is by far your cheapest path to a compliant product.
Obsolete modules. If the wireless module itself is discontinued, a straight duplication doesn’t solve your problem. You need a migration to a current module, which is redesign work on the RF section and firmware changes on top.
Secure elements and provisioned keys. Device certificates in an ATECC-class secure element, or keys fused into a secure boot chain, are not recoverable. If your fleet identity lives there, the honest answer is that new units need new provisioning, not a clone.
Single damaged sample. A board with a blown regulator and lifted pads still yields a schematic, but destructive layer separation on your only copy is a one-shot process. Two samples cut the risk a lot.
Heavily coated outdoor nodes. Coating removal is slow and sometimes takes pads with it. It’s doable; it’s just not fast or cheap.
Adjacent board families we handle regularly have their own timing profiles — telecom board recovery tends to be layer-count bound, while recovering a switch-mode power supply design is bound by magnetics characterization instead. IoT sits between the two: small copper, difficult small parts.
FAQ
Can you reverse engineer an IoT board if the MCU is locked?
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote