High-Tech PCB Reverse Engineering Serices PCB Clone & IC Unlock

Price and lead time

Starting prices, published. Most suppliers in this trade will not put a number on a page, which makes budgeting impossible and wastes a week of emails.

How Much Does PCB Reverse Engineering Actually Cost?

PCB reverse engineering cost typically falls between $600 and $15,000+ for a complete deliverable package (schematic, Gerber files, BOM). A simple 2-layer consumer board with through-hole components sits at the low end. A 12-layer HDI board with multiple BGAs, blind vias, and a locked microcontroller pushes well past the high end. The price you pay is a direct function of measurable board characteristics—not guesswork.

This page breaks down every variable that moves your quote, gives you realistic ranges, and explains where most of the engineering hours actually go. If you already know your board specs, you can skip straight to the decision table below and then read the deep dive on individual cost drivers.

The Seven Variables That Set PCB Reverse Engineering Cost

pcb reverse engineering cost: PCB inner layers exposed during reverse engineering de-lamination process

When our engineers open a quote request, they evaluate seven things before they type a number. Each one independently shifts cost, and several compound each other.

1. Layer Count

Layer count is the single largest cost lever. A 2-layer board can be imaged, traced, and netlisted in a fraction of the time a 10-layer board requires. Every additional copper layer means another de-lamination or cross-section cycle, another imaging pass, and another round of net verification. Expect roughly a 25–40% cost increase per pair of added layers once you pass four.

2. Board Area and Component Density

A 50 × 50 mm IoT sensor board with 60 components is a different job than a 300 × 200 mm industrial controller with 800+ parts. Larger boards take more imaging tiles to stitch and more hours to trace. High component density—especially 0201/01005 passives packed around fine-pitch QFPs—slows BOM extraction and net verification.

3. IC Complexity and Firmware

If the board carries a microcontroller, FPGA, CPLD, or DSP with protected firmware, the project splits into two separate cost centers: the PCB work and the firmware recovery process. An unlocked STM32F1 with an unprotected flash adds modest cost. A code-protected PIC18 or an RDP Level 2 STM32 may require invasive techniques or may not be recoverable at all—and feasibility assessment itself costs time.

4. Via Technology

Through-hole vias are straightforward. Blind, buried, and stacked microvias (common in HDI boards) complicate layer-to-layer connectivity mapping. Each via type demands a different cross-sectioning approach and adds verification steps. A 6-layer board with only through-hole vias costs meaningfully less to reverse engineer than a 6-layer HDI board with stacked microvias.

5. Board Condition

A clean, functional board is the ideal starting point. Burned, corroded, or potted boards demand extra prep work—chemical removal of conformal coating, careful cleaning of corrosion, or mechanical extraction from potting compound—before imaging even begins. Damaged reference designators or missing components force additional detective work that adds hours.

6. Deliverable Scope

Not every customer needs the same output. Some want only a schematic for failure analysis. Others need a full production-ready package: Gerber/ODB++ files, drill files, BOM with verified manufacturer part numbers, centroid/pick-and-place data, and a netlist-verified schematic. Each additional deliverable adds engineering time.

7. Turnaround Time

Standard turnaround for a mid-complexity board runs 10–20 working days. Rush service—3 to 7 working days—typically carries a 30–60% surcharge because it requires dedicated bench time and priority scheduling. For details on how turnaround tiers work, see our turnaround time breakdown.

PCB Reverse Engineering Cost Table: Realistic Ranges

The table below reflects actual project ranges from our lab. Your specific board may fall outside these bands if it has unusual characteristics (e.g., RF impedance-matched traces, flex-rigid construction, or military-spec materials).

Board Profile Layers Typical Area Components Estimated Cost (USD) Typical Turnaround
Simple consumer / IoT 1–2 ≤ 80 cm² 30–80 $600 – $1,500 5–10 days
Mid-range industrial controller 4 80–200 cm² 100–300 $1,500 – $4,000 10–15 days
Complex power / motor drive 4–6 150–400 cm² 200–500 $3,000 – $7,000 12–20 days
HDI / telecom / networking 8–12 100–300 cm² 300–800 $6,000 – $12,000 15–25 days
High-layer-count server / aerospace 14–20+ 200–600 cm² 500–1,500+ $10,000 – $20,000+ 20–35 days

Note: These ranges cover schematic + Gerber + BOM. Firmware recovery, if needed, adds $500–$5,000+ depending on the IC family and protection level. Rush surcharges are not included.

Where Do the Engineering Hours Actually Go?

Clients sometimes wonder why a “small” board still costs $1,200. The answer is that most of the cost is labor, not materials. Here is a typical hour breakdown for a 4-layer, 200-component industrial board quoted at roughly $2,800:

  • Board prep and imaging (3–5 hrs): High-resolution optical scanning of each layer, de-lamination or controlled milling to expose inner layers, image stitching and alignment.
  • Trace extraction and CAD rebuild (8–14 hrs): Converting raster images to vector data, rebuilding pad stacks, routing traces in Altium/KiCad, defining net classes.
  • BOM extraction and cross-referencing (3–6 hrs): Reading every part marking (often under magnification), cross-referencing datasheets, flagging obsolete or house-marked parts, sourcing alternates.
  • Schematic generation and net verification (6–10 hrs): Back-annotating the layout into a logical schematic, verifying every net against the physical board with continuity testing, DRC/ERC checks.
  • Output packaging and QA review (2–3 hrs): Gerber export, drill file generation, centroid file, final peer review against the physical sample.

Total: roughly 22–38 engineering hours at $75–$120/hr effective rate. That math lines up with the $2,800 quote. More complex boards simply push each phase longer.

What Makes Certain Industries More Expensive?

Industry context changes cost because it changes requirements. An automotive ECU board may need impedance-controlled differential pairs documented to IPC-2581 and every component traced to AEC-Q qualified alternates. An aerospace avionics board may require IPC Class 3 documentation, material callouts (polyimide vs. FR-4), and controlled-impedance verification data in the deliverable package.

By contrast, a straightforward HVAC control board or audio amplifier board usually stays in the mid-range because the tolerances and documentation requirements are less demanding.

Firmware Recovery: The Hidden Cost Multiplier

Original PCB and its reverse-engineered clone compared on a workbench

If the board’s intelligence lives in a locked microcontroller, budget for firmware recovery as a separate line item. Here is how protection level maps to cost:

Protection Level Example ICs Recovery Likelihood Added Cost Range
Unprotected / read-enabled ATmega328 (no lock bits), STM32 RDP 0 Near-certain $200 – $500
Software-protected (moderate) PIC16/18 CP bit, STM32 RDP 1 High (family-dependent) $800 – $2,500
Hardware-protected (strong) STM32 RDP 2, some Renesas RH850 Low to uncertain $2,000 – $5,000+ (feasibility study first)
Fuse-blown / eFuse OTP Certain Xilinx/Lattice FPGAs Very low Feasibility assessment only; often not viable

We always run a feasibility assessment before committing to firmware recovery on protected parts. You only pay for the full recovery if feasibility is confirmed. Authorization and proof of IP ownership are required—see our lab and authorization policy for details.

How to Reduce Your PCB Reverse Engineering Cost

You have more control over the final number than you might think. These steps consistently bring quotes down:

  • Supply a working board. A functional sample eliminates guesswork about missing components and damaged traces. If you only have a dead board, send it anyway—but expect a 10–20% cost bump for reconstruction work.
  • Share any existing documentation. Even a partial schematic, an old BOM, or a photo of the board before damage helps. Every verified data point our engineers don’t have to derive from scratch saves time.
  • Define your deliverable scope tightly. If you only need a schematic for failure analysis, don’t pay for production Gerbers. If you need Gerbers but not firmware, say so up front.
  • Choose standard turnaround. Rush fees are real. If your timeline allows 15 working days instead of 5, you save 30–60%.
  • Bundle multiple boards. If you have three related boards from the same equipment, quoting them together lets us reuse BOM research and schematic blocks, lowering per-board cost.

Before shipping your board, run through our PCB copy checklist to make sure you are sending everything we need on the first pass. Incomplete shipments cause requotes and delays.

What You Get for Your Money: Standard Deliverables

Every full-scope project from our lab ships with:

  • Schematic (Altium .SchDoc / KiCad .kicad_sch / PDF)
  • Gerber RS-274X or ODB++ fabrication files
  • Excellon drill files
  • Bill of Materials with MPN, quantity, value, package, and sourcing notes
  • Centroid / pick-and-place file (CSV)
  • Layer stackup drawing with material and thickness callouts
  • Net verification report (netlist diff against physical board)

Optional add-ons include 3D STEP model export, impedance simulation data, SPICE sub-circuit extraction, and firmware binary (where recovery is feasible and authorized).

Getting an Accurate Quote: What We Need From You

To return a quote within one business day, our team needs:

  • Clear top and bottom photos of the board (high resolution, good lighting)
  • Approximate board dimensions (or we measure from photos)
  • Known or estimated layer count
  • Whether firmware recovery is needed (and which IC)
  • Desired deliverable scope
  • Target turnaround

Upload these through our main service page and you will receive a line-itemized quote—not a vague range—within 24 hours.

How much does it cost to reverse engineer a simple 2-layer PCB?

A 2-layer board under 80 cm² with fewer than 80 through-hole and SMD components typically costs $600–$1,500 for schematic, Gerber, and BOM. If firmware recovery is not needed and you choose standard turnaround, expect the lower end of that range. Add $200–$500 if the board is damaged or conformal-coated.

Does layer count affect PCB reverse engineering cost linearly?

Not linearly—it compounds. Going from 2 to 4 layers roughly doubles cost because inner-layer exposure and imaging are added. Going from 4 to 8 adds another 60–80% because blind/buried via mapping and impedance documentation become necessary. Beyond 10 layers, each pair adds 25–40% to the base.

Is firmware recovery included in a standard reverse engineering quote?

No. Firmware recovery is always quoted as a separate line item because its cost depends on the specific IC, its protection level, and feasibility. We run a feasibility assessment first and only charge for full recovery if the read-out is confirmed possible. Proof of IP ownership is required before we begin.

Can I get just a schematic without Gerber files to save money?

Yes. A schematic-only deliverable skips the CAD layout rebuild and Gerber export phases, which can reduce cost by 30–40% compared to a full package. This is common for failure analysis, second-source evaluation, or design review projects where you do not intend to fabricate a new board.

What is the cheapest way to get a PCB reverse engineered?

Supply a clean, working board with any existing documentation. Request only the deliverables you need. Choose standard (not rush) turnaround. Bundle multiple boards if applicable. These steps alone can cut a quote by 30–50% compared to a worst-case scenario of a damaged board, full scope, and rush delivery.

PCB copy

BoardFromLead timeNotes
1-2 layer$1503-5 daysPer board area and part count
4-6 layer$2807-12 daysBlind or buried vias add time
8-10 layer$55010-14 daysLayer separation is the slow part
10+ layer, HDI, RF, ceramic$1,10012-15 daysPhotos needed before quoting

Reverse engineering and production

ServiceFromLead timeNotes
Schematic recovery + BOM$4007-15 daysScope follows what you plan to change
Prototype build and test$6005-8 daysAfter files are approved
SMT assembly, small batchquoted10-15 daysIncludes X-ray BGA inspection

IC unlock, IC crack and chip decipher

FamilyFromLead timeNotes
8051, STC, AT89, Holtek$2202-4 daysMost parts non-invasive
AVR ATmega / ATtiny$3403-5 daysTwo samples preferred
Microchip PIC$9003-5 daysDIP and SOIC fastest
STM32 F0 / F1 / F3$7003-5 daysDepends on RDP level
STM32 F4 / L / G, GD32$1,1005-8 daysReviewed per date code
ARM, Kinetis, Renesas, Infineon$2,0007-15 daysFeasibility check first
CPLD and FPGA$80010-20 daysDepends on fuse state
EEPROM and serial flash$3,0002-4 daysPriced per die, secure parts cost more
Exact quote

The real number, same working day

Starting prices only tell you the floor. Send the marking or the photos and you get the actual figure.

A clear photo of the marking usually removes one round of questions.

Judy answers personally, High-Tech PCB Reverse Engineering Serices. NDA available before you send any file.

WhatsApp Send board details