What Is MCU Unlock and When Do You Need It?
MCU unlock is the process of bypassing or resetting the read-protection fuses on a microcontroller so that the internal flash and EEPROM contents can be extracted as a binary file. Engineers request this service when original source code is lost, a chip vendor has discontinued a part, or a legacy product needs maintenance and the original developer is unavailable. Our lab performs MCU unlock strictly under proof-of-ownership or written authorization — every project begins with an NDA and documentation review.
How Does MCU Unlock Work?
Every microcontroller vendor implements read protection differently. Some use single-bit fuses (Microchip PIC code-protect bit), others use multi-level schemes (STM32 RDP Level 0 / 1 / 2). The technique our engineers select depends on the specific protection mechanism:
- Voltage glitch attacks — precisely timed power or clock glitches during the boot sequence can bypass protection on many older 8-bit and some 32-bit MCUs. Typical success window is 2–15 ns.
- Debug-port exploitation — certain firmware revisions leave JTAG/SWD partially accessible even with RDP enabled; protocol-level commands can extract flash blocks.
- UV or laser fault injection — focused energy on decapped die can flip individual fuse bits. This is a destructive-to-package method used when non-invasive routes fail.
- Proprietary tool chains — vendor-specific programmers combined with custom scripts can reset protection under controlled conditions on select families.
Not every method works on every chip. RDP Level 2 on STM32 parts, for example, permanently disables the debug interface at the silicon level — no known non-destructive bypass exists. We always run a feasibility assessment before quoting.
Supported MCU Families for Unlock
Our lab maintains tooling and documented success across more than 30 MCU families. The table below covers the most frequently requested parts. If your chip is not listed, submit it for a free feasibility check.
| Vendor | Family / Series | Protection Type | Typical Success Rate | Turnaround |
|---|---|---|---|---|
| ST Microelectronics | STM32F0 (e.g., F030, F051) | RDP Level 1 | High | 3–5 days |
| ST Microelectronics | STM32F4 (e.g., F405) | RDP Level 1 / 2 | High (L1) / Not feasible (L2) | 5–8 days |
| ST Microelectronics | STM32L1 / L4 (e.g., L151, L432) | RDP Level 1 | High | 3–7 days |
| ST Microelectronics | STM32G4 (e.g., G431) | RDP Level 1 | Moderate–High | 5–10 days |
| ST Microelectronics | STM8S / STM8L (e.g., S003, S105, L051) | ROP bit | High | 2–4 days |
| Microchip | PIC16F (e.g., 16F1509) | Code-protect fuse | High | 2–5 days |
| Microchip | PIC18F (e.g., 18F452, 18F4520) | Code-protect + table-read protect | High | 3–5 days |
| Microchip | PIC24FJ / PIC32MX / dsPIC33FJ | Code-guard / General Segment | Moderate–High | 5–10 days |
| Microchip (Atmel) | ATmega (e.g., ATmega328, 16, 32) | Lock bits (LB1/LB2/BLB) | High | 3–5 days |
| NXP | LPC1xxx / LPC2xxx | CRP Levels 1–3 | High (CRP1/2) / Low (CRP3) | 5–10 days |
| Renesas | RL78 / RX | ID code / OCD protection | Moderate | 7–14 days |
| GigaDevice | GD32F1 / GD32F3 | SWD readout protection | High | 3–7 days |
For STM32F0-series requests, see our detailed pages on STM32F030 firmware recovery and STM32F051 unlock feasibility. Atmel AVR projects — including the ATmega328 lock-bit bypass — are among the fastest to complete due to well-understood fuse architecture.
What Does MCU Unlock Cost?
Pricing depends on three variables: protection complexity, chip package (decapping adds cost), and whether the part is sacrificial or must survive intact. Here are realistic ranges:
| Complexity Tier | Examples | Price Range (USD) | Notes |
|---|---|---|---|
| Standard 8-bit | ATmega328, PIC16F1509, STM8S003 | $150 – $400 | Non-invasive; chip survives |
| Standard 32-bit (Level 1) | STM32F030, STM32L151, GD32F103 | $300 – $800 | Glitch or debug exploit; chip usually survives |
| Advanced 32-bit | STM32F405 (RDP1), PIC32MX, dsPIC33FJ | $500 – $1,500 | May require decap; chip may not survive |
| High-security / new silicon | STM32H7, SAML11 TrustZone, CRP3 parts | $1,200 – $3,000+ | Feasibility-dependent; no-success-no-fee option |
We offer a no-success-no-fee policy on most projects: if we cannot extract a verified binary, you pay nothing beyond the initial feasibility assessment (typically $0–$50). Bulk orders of 5+ identical MCUs receive a 15–25% volume discount.
Turnaround: What to Expect
Standard MCU unlock turnaround is 3–10 working days after we receive the chip or development board. Rush service (48-hour) is available for standard-tier parts at a 40% surcharge. Complex or new-family parts may take 2–3 weeks while we develop or adapt tooling.
The timeline breaks down as follows:
- Day 1 — Receive sample, photograph, verify part number and package against your order.
- Days 1–2 — Feasibility test: probe debug port, read device ID, determine active protection level.
- Days 2–7 — Execute unlock procedure; extract raw binary; verify CRC against flash size.
- Day 7–8 — Deliver .hex / .bin file via encrypted transfer; provide a verification report showing read address range and checksum.
Deliverables You Receive
- Firmware binary — .hex (Intel HEX) and .bin formats, covering full flash and EEPROM where applicable.
- Fuse / option-byte dump — exact configuration register values so you can reprogram a blank part identically.
- Verification report — CRC-32 checksum, address map, extraction method summary, and any caveats (e.g., one-time-programmable region unreadable).
- Optional disassembly — annotated disassembly listing for ARM Cortex-M or AVR targets, quoted separately.
Authorization and Legal Requirements
MCU unlock touches intellectual-property boundaries. We require at least one of the following before starting work:
- Proof that you designed or own the product containing the MCU.
- Written authorization from the IP holder (letter on company letterhead or email from a verifiable corporate domain).
- A statutory declaration that the firmware is needed for legacy maintenance, interoperability, or personal backup under applicable law.
Every project is covered by a mutual NDA. We do not redistribute extracted firmware, and all files are purged from our systems 30 days after delivery unless you request extended storage.
Choosing the Right MCU Unlock Provider
Not all labs are equal. Here is what separates a reliable MCU unlock service from a risky one:
- Chip-level tooling — ask whether the lab owns glitch-injection hardware (e.g., ChipWhisperer Pro or custom FPGA rigs) and a die-level probing station. Generic JTAG programmers alone cannot bypass real protection.
- Documented success on your exact part number — protection varies between silicon revisions. A lab that has unlocked an STM32F405RG Rev Z may still fail on Rev 3.
- No-success-no-fee guarantee — any lab confident in its capability will offer this.
- NDA and IP policy — if a provider does not ask about authorization, that is a red flag for both legal exposure and data handling.
Our engineers have processed over 4,000 MCU unlock requests across the families listed above. For Microchip PIC parts specifically, see our pages on PIC18F452 code-protect recovery and PIC32MX general-segment unlock.
When MCU Unlock Is Not Feasible
Transparency matters. These scenarios have low or zero success probability:
- STM32 RDP Level 2 — the debug port is permanently disabled by blowing eFuses; no non-destructive recovery path exists.
- NXP CRP Level 3 — similar permanent lockout; ISP and JTAG are both killed.
- Secure-element MCUs (e.g., ATECC608, Infineon OPTIGA) — designed specifically to resist physical attack; cost-to-attack typically exceeds $50,000.
- Severely damaged die — corrosion, ESD damage, or prior failed decap attempts can destroy bond pads needed for probing.
If your chip falls into one of these categories, we will tell you during the free feasibility assessment rather than waste your time and budget.
How to Get Started
Submit your MCU part number, package type, and a brief description of why you need the firmware recovered. Our team returns a feasibility verdict within one business day for common families. For STM32G4-series parts, start with our STM32G431 unlock guide. For 8-bit STM8 projects, see the STM8S003 readout-protection bypass page.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCan you unlock my MCU without destroying the chip?
For most 8-bit MCUs (ATmega, PIC16F, STM8) and many 32-bit parts at protection Level 1, yes — non-invasive glitch or debug-port methods leave the chip fully functional. Advanced cases requiring die decap and laser fault injection are destructive to the package, so we recommend shipping at least two samples when possible.
What if my MCU is set to the highest protection level?
Permanent protection levels — such as STM32 RDP Level 2 or NXP CRP Level 3 — disable the debug interface irreversibly at the silicon level. No known non-destructive technique can recover firmware from these parts. We identify the active protection level during our free feasibility check and will not charge you if recovery is impossible.
How do you verify the extracted firmware is correct?
We compute a CRC-32 checksum over the full address range and compare it against the MCU’s internal CRC peripheral (where available). We also perform a test re-program on a blank sample of the same part number and verify functional boot. You receive the checksum and address map in the verification report.
Is MCU unlock legal?
MCU unlock for firmware you own or are authorized to access is legal in most jurisdictions under maintenance, interoperability, and backup provisions. We require proof of ownership or written authorization before starting any project, and every engagement is covered by a mutual NDA. Unauthorized extraction of third-party IP is something we do not perform.
Do you support obsolete or discontinued MCU families?
Yes. Legacy parts like PIC16F84, AT89C51, and MC68HC11 are among our most common requests. Because these older families use simpler protection, success rates are generally above 90% and turnaround is 2–5 working days.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote