What Is Read Protection Bypass?
Read protection bypass is the authorized extraction of firmware from a microcontroller whose flash-memory lock bits or option bytes have been set to prevent external read access. Nearly every modern MCU — from an STM32F1 to an STC 8051 derivative — ships with at least one level of read protection. When the original source code is lost, the development engineer leaves a company, or a legacy product needs maintenance, a controlled read protection bypass performed in a qualified lab is often the only path back to the binary.
Our engineers handle read protection bypass requests across more than 50 MCU families every month. Success depends on the specific protection level, die revision, and the technique applied — not every chip can be read, and no honest lab will guarantee 100 % recovery on every part. Below we break down what determines feasibility, the methods involved, and what you should prepare before submitting a chip.
How MCU Read Protection Actually Works
Read protection is implemented through hardware fuses, option bytes, or dedicated security registers that gate access to internal flash and SRAM via the debug interface (JTAG, SWD, C2, SWIM, etc.). When protection is active, a debug probe connection either returns all zeros, triggers a mass-erase, or is rejected outright.
Common Protection Tiers
| Protection Level | Typical Behavior | Bypass Feasibility |
|---|---|---|
| Level 0 / Unlocked | Full debug read/write access | No bypass needed — direct readout |
| Level 1 (soft lock) | Debug read blocked; flash intact; can be downgraded but triggers erase | High — multiple non-invasive and semi-invasive paths |
| Level 2 (permanent lock) | Debug port permanently disabled; JTAG fuse blown | Low to moderate — requires invasive techniques; die-revision dependent |
| Proprietary / OTP fuse | Vendor-specific one-time-programmable security bits | Case-by-case — some families have known silicon-level weaknesses |
Level 1 protections are the most commonly encountered in production boards. They block casual readout but leave the silicon debug circuitry physically intact, which gives a skilled lab room to work. Level 2 locks — such as STM32 RDP Level 2 or the permanent JTAG disable on certain NXP LPC parts — are far harder and sometimes impossible to reverse without destroying the die.
Techniques Used for Read Protection Bypass
Non-Invasive Methods
- Voltage glitching (VCC / VCORE fault injection): A precisely timed voltage spike during the boot-up security check can cause the protection logic to skip, leaving flash readable for a narrow window. Timing resolution of 1–5 ns is typical; our rigs use sub-nanosecond trigger jitter.
- Clock glitching: Injecting extra clock edges on the external oscillator input to upset the instruction pipeline at the moment the lock-bit register is evaluated.
- Bootloader-level exploits: Some vendor bootloaders (UART/ISP/USB-DFU) have documented or undocumented commands that leak flash contents when specific protocol sequences are issued. These are version-dependent and often patched in later mask revisions.
- Cold-boot / power-analysis side channels: Monitoring power traces during boot to infer internal state, then combining with glitch triggers.
Semi-Invasive Methods
- UV exposure (older EPROM/OTP parts): Directed UV light through a decapped window can reset protection fuses on legacy devices — effective on many Motorola 68HC series MCUs and vintage 8051 variants.
- Laser fault injection: A focused IR or visible laser targets specific transistors in the security logic after chemical decapsulation. This is the primary approach for Level 2 parts where electrical glitching fails.
Invasive Methods
- FIB (Focused Ion Beam) circuit editing: Cutting or reconnecting metal traces on the die to disable protection circuitry. Used as a last resort — cost starts around $2,000–$5,000 per device and requires detailed knowledge of the target’s security-cell layout.
- Micro-probing: Direct contact with internal bus lines using tungsten probes under a probing station. Requires a decapped die and is limited to older process nodes (≥ 180 nm feature size in practice).
Which Chip Families Respond Best to Read Protection Bypass?
Recovery success varies enormously by vendor and even by die revision within the same part number. Here is a realistic snapshot based on our lab’s track record:
| Vendor / Family | Typical Protection | Estimated Recovery Rate | Notes |
|---|---|---|---|
| STC 8051 derivatives | Proprietary ISP lock | ~90 % | Most STC11/12/15 series respond to glitch attacks |
| Megawin MPC82 / MG82 | ISP code-protect bit | ~85 % | Older masks more susceptible; newer G series harder |
| Sinowealth SH79F / SH68F | OTP fuse + code lock | ~80 % | Semi-invasive UV + glitch combination |
| STM32F0/F1/F4 (RDP1) | Option-byte Level 1 | ~85 % | Well-documented voltage-glitch path; RDP2 is near-impossible |
| Nordic nRF51 / nRF52 | APPROTECT / SECUREAPPROTECT | ~70 % | nRF51 is accessible; nRF52840 with SECUREAPPROTECT is much harder |
| PIC16/PIC18 (Microchip) | CP / CPD config bits | ~80 % | Glitch-based; some PIC18 parts need semi-invasive |
| Toshiba TLCS-870 / TMP86 | Mask-ROM lock | ~60 % | Mask-ROM parts require invasive read; flash parts higher |
Rates above reflect first-attempt success on parts in good physical condition. Corroded pins, prior decap damage, or missing bypass capacitors on the board can reduce yield.
Our Authorized Read Protection Bypass Workflow
- Feasibility assessment (1–2 business days): You submit the part number, package photo, and a brief description of why recovery is needed. We confirm whether the protection level is within our capability and provide a fixed-price quote.
- Proof of ownership / NDA: Before any work begins, we require a signed declaration that you are the IP owner, the original designer’s authorized agent, or that the firmware is needed for legitimate maintenance of equipment you own. We will not proceed without this document.
- Chip preparation: Depending on the method, the chip may be desoldered (BGA/QFP rework station), decapped (acid or laser decap), or tested in-circuit.
- Extraction: The appropriate bypass technique is applied. For glitch-based methods, our rigs run automated parameter sweeps — a typical STM32 RDP1 glitch campaign takes 4–48 hours of machine time.
- Verification: The extracted binary is verified against known CRC/checksum fields, vector-table sanity checks, and — where possible — functional re-programming into a blank device for power-on testing.
- Delivery: You receive the firmware as a raw .bin or Intel HEX file, plus a brief extraction report noting the method used and any caveats.
Typical turnaround is 5–15 working days from chip receipt, depending on queue depth and technique complexity. Rush service (3–5 days) is available for an additional fee.
What Can Go Wrong
Honest disclosure matters. Here are the most common failure modes:
- Permanent lock (Level 2 / blown JTAG fuse): If the designer set the highest protection tier, non-invasive methods will not work. Invasive methods may succeed but cost significantly more and carry a risk of die damage.
- Die-revision mismatch: A technique proven on Rev A silicon may fail on Rev C because the vendor patched the vulnerability. We maintain a revision database, but new revisions sometimes appear without public documentation.
- Physical damage: Corrosion, ESD damage to the debug port, or a cracked die from prior rework can make extraction impossible regardless of protection level.
- Encrypted flash: Some newer parts (e.g., STM32L4+, nRF5340) encrypt flash contents with a device-unique key. Even if read protection is bypassed, the resulting binary is ciphertext without the key — and the key is stored in a separate, heavily protected OTP block.
Preparing Your Chip for Submission
- Send at least two samples when possible — one for primary extraction, one as backup if the first is damaged during decap or glitching.
- Include the full part number and date code from the package marking. A photo of the marking is ideal.
- If the chip is still on a PCB, note whether you want the board returned intact or if desoldering is acceptable.
- Provide any known details: compiler used, approximate firmware size, expected CRC — these help us validate the dump.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Is read protection bypass legal?
Yes, when performed on firmware you own or are authorized to recover. In most jurisdictions, extracting your own IP from a locked chip for maintenance, re-production, or archival is lawful. We require proof of ownership or a signed authorization letter before starting any project, and all work is covered by NDA. See our trust and legal compliance page for details.
Can you bypass Level 2 / permanent read protection?
Sometimes. Level 2 locks (e.g., STM32 RDP2, NXP CRP3) disable the debug port at the hardware level. Recovery requires invasive techniques such as laser fault injection or FIB editing, which cost more and carry a lower success probability — roughly 40–60 % depending on the specific die. We always perform a feasibility check first so you know the odds before committing.
How much does read protection bypass cost?
Pricing depends on the chip family and protection level. Non-invasive glitch-based recovery on common MCUs like STM32F1 or PIC16 typically starts at $300–$800 per device. Semi-invasive or invasive work (decap + laser/FIB) ranges from $1,500 to $5,000+. We provide a fixed quote after the feasibility assessment — no hidden charges.
Will the original chip still work after extraction?
For non-invasive methods (voltage/clock glitching, bootloader exploits), the chip is usually returned fully functional with its firmware intact. Semi-invasive and invasive methods require decapsulation, which permanently alters the package — the die may still function on a test bench but is not suitable for field redeployment.
What file format will I receive?
We deliver the raw binary (.bin) and an Intel HEX (.hex) file by default. If you need Motorola S-Record or a specific segment layout, let us know when you submit the job. A brief extraction report is included with every delivery.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote