MCU Firmware Extraction | Delivered as .hex or .bin

MCU Firmware Extraction: Recover Your Embedded Code as a Verified File

MCU firmware extraction is the process of reading the program memory contents from a microcontroller—whether its flash, EEPROM, or OTP ROM—and delivering the result as a usable .hex or .bin file. Our engineers perform authorized firmware recovery for hardware teams that have lost source code, need to maintain legacy products, or must clone their own designs for continued production. We handle 8-bit, 16-bit, and 32-bit MCUs across all major silicon vendors, with a verified read-back success rate above 95% on parts where feasibility is confirmed upfront.

Why Would You Need MCU Firmware Extraction?

Firmware gets lost more often than most teams admit. An engineer leaves and the repository wasn’t backed up. A contract manufacturer holds the only programmed samples. A product revision from 2011 needs a running change but the .hex file predates your current version-control system. In every case, the working firmware still lives inside the MCU on a functioning board—it just needs to be read out.

Common scenarios we handle include:

• Legacy product maintenance — keeping a 15-year-old industrial controller in production when the original developer is unreachable.
• Disaster recovery — retrieving code after a hard-drive failure, ransomware event, or repository corruption.
• Design migration — reading firmware from an obsolete MCU so it can be ported to a current-generation part.
• Quality audit — verifying that a contract manufacturer programmed the correct firmware version.

All work requires proof of ownership or written authorization. We document the chain of custody and operate under NDA for every project.

Which MCU Families Can We Extract Firmware From?

Coverage depends on the chip’s architecture, protection fuse configuration, and package type. The table below summarizes our current capability across the most-requested families.

For STM32 parts specifically, we maintain deep tooling. If you’re working with an STM32F3 that needs unlocking, or a more complex STM32H7 with multi-level read protection, we can provide a feasibility assessment within 48 hours of receiving the chip.

Vendor-specific IC recovery is also available for families like Mitsubishi microcontrollers and other specialized parts. If your MCU isn’t listed above, send us the full part number—we evaluate unlisted devices regularly.

How Does MCU Firmware Extraction Work?

Step 1: Feasibility Assessment

You provide the MCU part number (full marking, including revision suffix), package type, and a brief description of the protection state if known. Our team checks our internal database of successful extractions—covering over 12,000 part numbers—and returns a feasibility grade, estimated cost, and turnaround within 1–2 business days.

Step 2: Chip Preparation

For through-hole and large-pitch QFP parts, the MCU can often stay on the board. For BGA, QFN, and WLCSP packages, we desolder the chip using controlled-profile hot-air or IR rework stations. We photograph the part markings, log the die lot, and confirm the exact silicon revision before proceeding.

Step 3: Protection Analysis and Bypass

This is where the real engineering happens. Depending on the MCU, our approach may include:

• Debug-port probing — SWD, JTAG, or ICSP interfaces, testing for partial lock states or misconfigured fuses.
• Voltage glitching — precisely timed supply-rail transients (typically 3–15 ns pulses) that cause the protection check to skip during boot.
• UV exposure — for older EPROM-based or OTP parts where the security fuse can be selectively erased.
• Decapping and microprobing — chemical or laser decap followed by FIB (focused ion beam) editing or direct pad probing on the die. Reserved for high-value recovery where non-invasive methods fail.

Not every technique applies to every part. STM32 RDP Level 2, for example, blows a physical fuse—non-invasive bypass is not possible, and invasive methods carry a meaningful risk of data loss. We disclose these constraints before you commit.

Step 4: Readout and Verification

Once protection is bypassed, we perform a full memory dump: flash, EEPROM (if present), option bytes, and fuse configuration. We read the chip a minimum of three times and compare checksums (CRC-32) to confirm bit-perfect consistency. If even a single byte differs between reads, we flag the discrepancy and investigate before delivery.

Step 5: Delivery

You receive the firmware as an Intel HEX (.hex) and/or raw binary (.bin) file, along with a readout report documenting memory regions, checksums, fuse states, and any anomalies. If you need the file reprogrammed onto blank MCUs, we can handle that too.

Deliverable Formats and What You Get

For teams that also need the broader board reverse-engineered—schematic, Gerber, BOM—our dedicated MCU code extraction page details how firmware readout integrates with full PCB copy workflows.

What Can Go Wrong — Honest Limitations

We don’t promise 100% success, and anyone who does is misleading you. Here are the real constraints:

• Permanently locked parts — STM32 RDP Level 2, NXP CRP Level 3, and some TI MSP432 configurations physically destroy the readout path. Invasive recovery may still be possible, but success rates drop to 50–70% and the original chip is consumed.
• Encrypted firmware — some newer Cortex-M33 and Cortex-M55 MCUs store firmware encrypted with a device-unique key. We can dump the ciphertext, but decryption requires the key, which may reside in a secure element or eFuse block that is not externally readable.
• Damaged silicon — ESD damage, corrosion, or overheating can corrupt flash contents before we touch the chip. We’ll attempt a read, but corrupted sectors are unrecoverable.
• Anti-tamper wipe — a few MCUs (e.g., certain Maxim/Analog Devices secure micros) erase flash if they detect a decap or voltage anomaly. We assess this risk during feasibility.

We state the realistic probability in writing before you ship the part. No surprises.

Authorization and Legal Requirements

MCU firmware extraction is a legitimate engineering service when performed on code you own or are authorized to access. We require a signed declaration of ownership or a letter of authorization from the IP holder before starting work. Every project runs under a mutual NDA. If you need to understand how we handle IP protection and legal compliance, our protected IC recovery and readout overview explains the framework in detail.

Pricing Signals

Costs vary by MCU family, protection level, and whether invasive techniques are needed. As a rough guide:

• Unprotected or lightly protected 8-bit MCUs (ATmega, PIC16): $150–$400
• Protected 32-bit MCUs (STM32 RDP1, GD32, NXP CRP1): $400–$1,200
• High-security or invasive recovery (decap + FIB): $1,500–$5,000+

We provide a fixed quote after the feasibility check. No hourly billing, no hidden fees.

How to Get Started

Send us the MCU part number, a photo of the chip markings, and a brief description of why you need the firmware recovered. We’ll return a feasibility assessment, quote, and estimated turnaround—usually within one business day. If you already know you need a full board duplicated including firmware, our firmware cloning service covers the end-to-end workflow from readout to programmed replacement parts.

Related reading

• Oct 2026Infineon IC Unlock | Families We Can Read & How
• Oct 2026ATSAM4 Crack | Protection Levels & Firmware Recovery
• Oct 2026Renesas IC Unlock | Which Families We Can Read