A microcontroller crack means reading the program memory out of a locked MCU so you get a usable binary — a .hex or .bin you can reflash into the same part. Feasibility depends almost entirely on the exact die and the protection setting used, not on the family name printed on the package. Most 8-bit parts and older 32-bit parts are routine; recent parts with hardware-enforced lockdown often aren’t. You need to send the marked chip, not just the part number.
Why engineers order a microcontroller crack in the first place
Almost every job that comes through our lab falls into one of four buckets, and none of them involve stealing somebody’s product.
- Lost source or lost hex. The design is yours, the contractor who wrote the firmware is gone, the build server was decommissioned, and the only surviving copy of the code is inside the chips on the shelf.
- Legacy equipment support. A twenty-year-old machine tool, elevator controller or medical instrument still runs, but the spare control boards are gone and the MCU on the working board is locked.
- Obsolescence migration. The original part is end-of-life. You need the existing binary as a reference before porting to a current device.
- Failure analysis and authorized security review. Comparing the running image against the release build to see whether flash actually corrupted, or auditing your own product’s protection.
You need to hold the rights to the firmware you’re asking us to read, and complying with applicable IP law is on you. Every project runs under NDA, and we don’t retain client binaries after handover.
Which MCU families are usually readable, and which aren’t
The honest answer is that a family name tells you very little. An “STM32” could be an F1 die from 2009 at RDP Level 1 or a recent part with RDP Level 2 permanently set. Those are completely different jobs, and one of them may not be a job at all.
What actually decides the outcome:
- The specific die revision. Silicon shrinks and mask revisions change what’s possible. Two chips with the same marketing part number, made five years apart, can behave differently.
- Which protection level was set. Lock bits on an 8051 or AVR, RDP level on STM32, the JTAG security fuse or BSL password on MSP430, code protect bits on PIC. Some of these are reversible in the sense that the memory can still be reached; some physically disconnect the debug path or blow a fuse that cannot be un-blown.
- Whether the memory is encrypted on-die. Reading ciphertext out of a flash array is not the same as recovering usable code. Parts with per-device flash encryption keys held in hardware are a different class of problem.
- Package and sample condition. A DIP or TQFP part in good condition is easier to handle than a WLCSP scraped off a potted board.
Rough difficulty map
| Chip group | Typical protection | General difficulty |
|---|---|---|
| 8051 derivatives (AT89C, STC, W78E, N76E) | Lock bits, encryption arrays | Usually straightforward on older dies |
| AVR (ATmega, ATtiny) | Lock bits + fuse settings | Well-understood; depends on lock byte state |
| PIC / dsPIC | Code protect configuration bits | Varies widely by generation |
| STM8 / STM32 F1, F2, F4 era | ROP byte, RDP Level 0/1/2 | Level 1 commonly feasible; Level 2 often not |
| MSP430 | JTAG fuse, BSL password | Depends on fuse state and BSL version |
| NXP LPC, Kinetis, ARM Cortex generally | CRP levels, flash security byte | Case by case; highest settings can be terminal |
| C2000 DSP (TMS320F28xxx) | CSM password | Older devices more tractable than recent ones |
| Serial EEPROM / flash (24Cxx, 25xx, 93Cxx) | Write protect, block protect | Usually a read job, not a crack |
| Secure elements, smart cards, MCUs with hardware crypto | Active shields, encrypted flash | Frequently not feasible at any price |
Family-level pages go deeper on the individual parts we see most often — for example the ATmega328P read-out notes cover lock-bit behavior on that specific die, and the TMS320F28335 write-up explains why C2000 password protection behaves differently from a plain lock bit.
What actually happens to your chip in the lab
We don’t publish attack rec
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote