An IoT device PCB copy is usually four jobs bundled into one: recover the copper and stackup, identify the wireless module or SoC, deal with the firmware that lives in it, and preserve the antenna geometry so the radio still passes. Skip the last two and you get a board that assembles fine and won’t connect to anything. That’s the part most shops gloss over, and it’s where these projects actually fail.
Why IoT boards behave differently from ordinary control boards
Most industrial boards are digital logic plus power. You trace them, you verify the netlist, you’re done. An IoT node adds a radio, and a radio makes the physical layout part of the circuit function rather than just a routing choice.
The antenna feed line, the ground clearance around it, the keep-out under a chip antenna, the exact length and reference plane of the 50-ohm trace — those aren’t cosmetic. Change the dielectric thickness between layer 1 and layer 2 by a few mils and the feed impedance shifts. The board still boots. Range drops, and you find out during field trials instead of during bring-up.
So on an IoT device PCB copy we treat the RF section as a measured region, not a redrawn one. Trace widths get measured, dielectric thickness gets measured on a cross-section, and the copper geometry around the antenna is reproduced dimensionally rather than “cleaned up.” Impedance math of the IPC-2141 kind only tells you what the original designer probably intended; the physical board tells you what they actually built.
The four zones we split an IoT board into
- RF front end — antenna, matching network, feed line, shield can footprint. Reproduced dimensionally, tolerances tight.
- MCU / SoC and memory — ESP32, nRF52, STM32WB, CC13xx, or a pre-certified module. Netlist accuracy matters, layout tolerance is normal.
- Sensors and analog — usually the part with unmarked or laser-ablated parts. Identification work, not tracing work.
- Power — LDO, buck, battery charger, sometimes energy harvesting. Straightforward, but low-quiescent parts are often obsolete.
What actually happens to your board in the lab
Here’s the sequence for a typical four-layer IoT node, roughly 40 × 60 mm, with a module and a handful of sensors.
- Intake and photography. Both sides, high resolution, before anything is touched. Silkscreen, date codes, rework wires, any conformal coating.
- X-ray. Non-destructive first. This shows the via structure, whether there are buried or blind vias, and what’s under any shield can or BGA. On dense IoT boards this often tells us the layer count is not what the customer assumed.
- Component identification. Every part gets read, measured, or probed. Unmarked SOT-23 parts get curve-traced. Modules get identified by FCC ID or the marking on the shield.
- Shield can removal. Carefully — what’s underneath is often the crystal, the PA, and the matching components that matter most.
- Desolder and clean. Bare board, then measure dielectric thickness, copper weight, and drill sizes.
- Layer imaging. Outer layers scanned, then controlled delamination or grinding to image inner layers. Ground and power planes get their splits and stitching recorded, because a split plane under an RF trace changes behavior.
- Netlist build and verification. The reconstructed netlist is checked pin-by-pin against continuity readings on the original board. This is the step that catches errors, and it’s non-negotiable.
- Output generation. Gerbers, drill, stackup notes, BOM, pick-and-place, and schematic if ordered.
The verification step is what separates a usable deliverable from a plausible-looking one. Every net on the rebuilt file gets checked against the physical board, not against our own drawing. If you want to see the same discipline applied under stricter documentation pressure, the way regulated-device boards are handled follows an almost identical order of operations.
Firmware: the part that decides whether the copy is useful
A cloned IoT board with no firmware is a paperweight. Most of these projects come to us because the original binary is gone — the contractor disappeared, the build server was retired, the engineer left and nobody has the toolchain. That’s legitimate recovery work on a design you own, and we run it under NDA; you’re responsible for holding the rights to the product and for staying inside applicable IP law.
What’s feasible depends heavily on the silicon:
| Part family | Common IoT use | Typical difficulty |
|---|---|---|
| STM32 (F/L/WB) | Sensor nodes, gateways | Depends on RDP level. RDP Level 1 is a different problem from Level 2 — Level 2 is permanent and closes off debug entirely. |
| ESP32 / ESP8266 | Wi-Fi nodes, consumer IoT | Highly variable. Flash encryption and secure boot state determine everything. |
| nRF52 series | BLE sensors, wearables | APPROTECT state matters; newer revisions behave differently from older ones. |
| External SPI flash (25xx) | Firmware, config, certs | Often readable in-circuit or after removal — unless contents are encrypted by the host. |
| 8-bit (AVR, PIC, STC) | Simple sensor and relay nodes | Lock bits and security fuses vary widely by die revision. |
We’ll say plainly what we can and can’t determine before you pay for anything. Feasibility on a locked part is a per-device answer, not a per-family answer — two chips with the same marking and different date codes can behave differently. Nobody honest quotes a success rate for this.
What lives in flash besides code
IoT devices store provisioning data: MAC addresses, device certificates, pre-shared keys, cloud endpoint URLs, calibration constants. If your clone has to join the same fleet, that data matters as much as the code. Sometimes it’s in a separate EEPROM, sometimes in a reserved flash sector, sometimes in the module’s own NVS partition.
Tell us up front if the copy needs to work with an existing cloud backend. It changes what we look for and often changes the scope.
Regulatory reality: the part nobody mentions in the quote
If your device has a radio and you’re selling it, it needs certification. A copied board is not covered by the original device’s FCC ID or CE marking. Your options:
- Keep the same pre-certified module and the same antenna and layout. This is why we reproduce RF geometry exactly — modular certification generally requires the reference antenna and layout conditions be respected.
- Change anything in the RF chain and you’re likely looking at fresh testing.
We’re a reverse engineering lab, not a test house, and we won’t pretend to give you regulatory advice. But we will flag when a change you asked for — a smaller board, a different antenna, a substituted module — is the kind of change that has certification consequences. Better to hear it before layout than after.
What to send us for an IoT device PCB copy, and what comes back
The quote gets faster and more accurate with these five things:
- Clear photos of both sides on a dark, non-reflective background, whole board in frame, in focus, silkscreen readable.
- Board dimensions and your best guess at layer count.
- The main chip or module marking — exact text, including the line under the part number.
- What the device does in one sentence, and which radio it uses.
- Which deliverables you need: Gerbers only, Gerbers plus BOM, full schematic, firmware, or assembled boards.
Back from us: a feasibility assessment naming any parts we can’t source or can’t read, a lead time, and a price. If the honest answer is “the MCU is probably not readable, but everything else is straightforward,” you’ll get that in writing rather than a cheerful yes.
Deliverable tiers
| You need | You get | Good for |
|---|---|---|
| Manufacturing files | Gerbers, drill, stackup, BOM, pick-and-place | Rebuilding an obsolete board as-is |
| Files + schematic | Above plus verified schematic and netlist | Modifying the design, swapping a discontinued sensor |
| Files + firmware | Above plus recovered binary and any config data | Restoring a working product from a dead unit |
| Turnkey | Assembled, tested boards | Field replacements now, engineering later |
Where these projects get hard, or stop
Honest constraints, because you’d rather know now:
- Potted or epoxy-encapsulated modules. Common on industrial LoRa and NB-IoT gear. Removal is possible but risks the only sample you have.
- HDI with stacked microvias. Wearables and small trackers use these. Layer separation on 0.4 mm-pitch BGA with via-in-pad is slow and unforgiving.
- Sanded or blank-marked chips. We can often identify by package, pinout behavior, and function — but “often” isn’t “always,” and a custom ASIC may be unidentifiable.
- Discontinued low-power parts. A 2014-era sub-GHz transceiver may simply not exist anymore. Then it’s a redesign conversation, not a copy conversation.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quoteRelated reading