Security Fuse Recovery | Reading a Fuse-Locked Chip

What Is Security Fuse Recovery?

Security fuse recovery is the extraction of firmware or configuration data from a microcontroller whose internal protection fuse has been programmed to block external read access. Fuses may be one-time-programmable (OTP) metal links, flash-based lock bits, or eFuse registers. Recovery techniques range from non-invasive electrical methods to advanced semi-invasive die-level probing, and success depends entirely on the silicon vendor’s protection architecture, the specific fuse type, and the device revision. Not every fuse-locked chip is recoverable—understanding the limits before committing time and money is critical.

How Security Fuses Work Inside the Silicon

Most MCUs implement read protection through one or more of these mechanisms:

• OTP metal fuses — a physical metal link on the die is blown irreversibly. Common in older 8-bit parts and some TI MSP430 devices where the JTAG fuse blocks debug access permanently.
• Flash-based lock bits — a dedicated flash cell stores the protection state. Resettable in theory (a full erase clears the bit), but the erase also destroys the firmware you want to recover. Atmel/Microchip AVR lock bits and STM32 RDP Level 1 work this way.
• eFuse / anti-fuse registers — electrically programmable, one-time. Found in many ARM Cortex-M parts from NXP, some Renesas RX devices, and newer RISC-V MCUs.
• Security-bit + encryption — the fuse enables AES or proprietary on-chip encryption of the flash contents. Even if the data is read out, it is ciphertext without the key. STM32 RDP Level 2 and some NXP Kinetis parts fall here.

The distinction matters because it determines whether recovery is a matter of hours, days, or simply not feasible.

Which Fuse Types Can Be Recovered?

We are transparent about limits: if a chip uses hardware-encrypted storage with a blown key fuse, we will tell you up front rather than accept a job we cannot complete.

Our Security Fuse Recovery Process

Step 1 — Device Identification & Fuse Audit

You ship the locked device (or a populated board). Our engineers identify the exact part number, die revision, and package. We probe the debug port—JTAG, SWD, ICSP, or BSL—to determine which protection level is active. On an STM32 with RDP enabled, for example, we distinguish between Level 1 (recoverable) and Level 2 (permanent) within the first diagnostic session.

Step 2 — Feasibility Report

Within 1–3 working days we issue a written feasibility assessment: fuse type identified, estimated success probability, technique category (non-invasive vs. semi-invasive), turnaround, and cost range. If recovery is not viable, you pay only the evaluation fee—typically $50–$150 depending on the MCU family.

Step 3 — Extraction

For non-invasive recoveries (voltage glitching, protocol exploits), turnaround is typically 3–7 working days. Semi-invasive work—decapping, micro-probing—adds 5–15 working days and a higher cost tier because it requires chemical or laser decapsulation and precision probing equipment.

Step 4 — Verification & Delivery

Extracted firmware is verified against a checksum or known signature where available. We deliver a binary (.bin / .hex / .srec) plus a short report noting fuse configuration, read-back settings, and any anomalies. If the chip also contained EEPROM data or calibration bytes, those are included.

Common Failure Modes and Honest Caveats

• Die damage during decap: aggressive chemical etching (fuming HNO₃) or over-exposure to laser ablation can destroy bond wires or the flash array. Success on semi-invasive jobs is inherently lower (~60–75%) than non-invasive routes.
• Silicon revision drift: a technique that works on Rev A of a chip may fail on Rev C because the vendor patched the glitch vector. We maintain a revision database, but new revisions require fresh R&D.
• Encrypted flash: reading out ciphertext is technically a “successful read,” but useless without the AES key. We do not claim success unless we deliver usable plaintext firmware.
• Partial reads: some protection schemes allow reading certain flash sectors but not others (e.g., NXP LPC secure sectors). We document exactly which regions were recovered.

Authorization and Legal Requirements

Security fuse recovery is performed only for authorized parties: the original firmware developer, the product OEM, or a licensee with documented ownership. Before work begins, we require proof of ownership or a signed authorization letter. All projects are covered by NDA. For full details on our compliance framework, see our authorized firmware extraction service page.

Family-Specific Recovery Notes

AVR (ATmega, ATtiny, ATxmega)

AVR lock bits are flash-based. On many ATmega parts (ATmega328P, ATmega2560), high-voltage parallel programming combined with carefully timed glitches can read flash before the lock-bit check completes. Success rates on mature AVR families exceed 85%. More detail is available in our AVR lock-bit and fuse recovery guide.

STM32 (Cortex-M0/M3/M4/M7)

STM32 RDP Level 1 is recoverable on most F1, F2, F4, and L4 families using voltage fault injection on the VCAP pin during the RDP check sequence. RDP Level 2 fuses are permanent and encrypt the debug interface—recovery is not feasible with non-destructive methods.

NXP (LPC, Kinetis, S12)

NXP parts vary widely. LPC1700-series Code Read Protection (CRP) levels 1 and 2 are recoverable; CRP Level 3 triggers a mass-erase on any debug attempt, making firmware extraction extremely difficult. Kinetis K-series flash security can sometimes be bypassed through SWD glitching on older revisions. Consult our NXP MCU security-byte reference for family-by-family details.

Other Vendors

We support security fuse recovery across dozens of additional families including Renesas (RL78, RX, SH), Cypress/Infineon PSoC, GigaDevice GD32, WCH CH32, and legacy architectures from Zilog and Fairchild. Each vendor implements protection differently, which is why the feasibility step is non-negotiable.

What You Need to Send Us

Pricing Signals

Non-invasive security fuse recovery on common 8-bit and 32-bit MCUs typically starts at $300–$800 per device. Semi-invasive (decap + probe) jobs range from $1,500–$5,000+ depending on process node and die complexity. Evaluation / feasibility fees ($50–$150) are credited toward the recovery cost if you proceed. Exact quotes are issued after the feasibility audit.

Related reading

• Oct 2026NXP IC Unlock | Families We Can Read & Recovery
• Oct 2026ATSAM3 Unlock | Feasibility, Cost & Lead Time
• Oct 2026MSP430 IC Unlock | Which Families We Can Read