Supported IC List for IC Unlock | 70+ Families

Supported IC List for IC Unlock — Complete Reference Guide

Our supported IC list for IC unlock spans more than 70 distinct microcontroller and memory IC families from 15+ silicon vendors. Every entry below represents a part our engineers have successfully recovered firmware from under authorized conditions — the requester owns the IP, holds a valid license, or requires legacy maintenance access. If your specific part number does not appear on this supported IC list, submit a free feasibility inquiry through our IC unlock service; we evaluate new devices weekly and add roughly 5–10 new part numbers every quarter.

How We Organize the Supported IC List for IC Unlock

ICs are grouped by vendor, then by protection mechanism. This structure matters because the unlock method, turnaround time, and cost all depend on the type and generation of read protection — not just the part number. A device with single-level RDP (Read-out Protection) is fundamentally different from one using TrustZone or hardware-fuse encryption.

For each family on the supported IC list we note:

• Protection type — software lock bits, OTP fuses, hardware encryption, or combined.
• Typical success tier — High (>90%), Moderate (60–90%), or Case-by-case (<60%, dependent on silicon revision).
• Turnaround range — working days from receipt of the physical IC or valid dump.
• Package notes — where BGA or WLCSP handling adds preparation time.

ARM Cortex-M MCUs (STMicroelectronics)

STM32 parts are the single most requested family on our supported IC list for IC unlock. STMicroelectronics implements Read-out Protection in three levels: Level 0 (unprotected), Level 1 (debug access blocked but reversible), and Level 2 (permanent OTP fuse). The distinction between Level 1 and Level 2 is critical — Level 1 recovery is well-documented and repeatable, while Level 2 requires invasive die-level techniques that are silicon-revision dependent.

Important caveat: STM32 RDP Level 2 permanently disables the debug port via OTP fuses. Recovery from Level 2 requires invasive techniques that are silicon-revision dependent. We provide a candid feasibility assessment before quoting Level 2 jobs — no charge, no obligation. On STM32F4 parts specifically, certain die revisions manufactured before Q3 2019 have a higher success rate than later steppings.

NXP / Freescale Kinetis & LPC

NXP’s LPC and Kinetis lines use Code Read Protection (CRP) levels 1 through 3 and Flash Security bytes respectively. CRP1 restricts ISP commands but leaves partial access; CRP2 blocks most read paths; CRP3 disables ISP entry entirely. Our IC unlock engineers have documented repeatable success on CRP1 and CRP2 across all tested LPC revisions, while CRP3 outcomes depend on specific die characteristics.

Nuvoton & Renesas

Nuvoton’s NUC and N76E families use straightforward flash lock bits that our lab clears with high reliability. Renesas ID-code protection on the older R8C and M16C lines is similarly well-understood. The newer RA-series parts with Device Lifecycle Management (DLM) and TrustZone are evaluated individually — silicon revision and key provisioning state both affect the outcome.

Nordic Semiconductor (BLE SoCs)

Nordic’s nRF5x series is widely used in IoT, wearables, and industrial sensors. The APPROTECT mechanism disables SWD access when set. Our lab has repeatable methods for certain silicon revisions of the nRF51 and nRF52 families, making them frequent entries on our supported IC list.

Newer nRF53 and nRF91 parts use ARM TrustZone and hardware root-of-trust. These are evaluated strictly on a case-by-case basis — contact us with the full part marking and revision code. Early nRF52832 revisions (QFAA-Bx0) tend to yield higher success rates than later steppings.

Cypress / Infineon PSoC

PSoC devices combine configurable analog blocks with an ARM or M8C core, making them common in industrial controls and medical peripherals. Flash protection on PSoC 1 (CY8C2xxxx) is software-configurable; PSoC 4/5/6 adds multi-level protection rows.

Microchip PIC & AVR, TI MSP430, STC

These families represent some of the highest-volume IC unlock requests we handle. Microchip’s PIC and AVR lines use code-protect (CP) bits and lock bits respectively — both are well-characterized across decades of silicon revisions. TI’s MSP430 relies on a JTAG fuse that, once blown, blocks debug access; our techniques restore read capability on all tested MSP430F and MSP430G variants.

Serial EEPROM & Flash Memory ICs

Memory ICs are often overlooked, but they frequently store calibration data, configuration parameters, or even full application firmware in systems that boot from external flash. These devices typically use write-protect pins or software lock-down registers rather than cryptographic protection, making readout highly reliable. They form one of the simplest categories on our supported IC list for IC unlock.

Maxim (Analog Devices) Specialty MCUs

What Determines Whether an IC Can Be Unlocked?

Three factors control feasibility more than anything else:

1. Protection level and generation. A single software lock bit (e.g., STM32 RDP Level 1 or PIC CP bit) is far easier to bypass than a hardware OTP fuse or AES-encrypted boot chain. Newer silicon revisions within the same family sometimes patch previously viable attack vectors — an STM32F1 from 2012 may respond to a technique that fails on a 2022 lot.
2. Physical condition of the die. Corrosion, reballing damage, or decapsulation artifacts reduce success rates. We inspect every device under 200× magnification before committing to invasive work.
3. Package and bond-wire accessibility. BGA and WLCSP packages require more preparation than LQFP or DIP. Turnaround for BGA parts typically adds 1–3 working days. QFN packages with exposed pads are intermediate in difficulty.

If your IC is not on this supported IC list, that does not mean recovery is impossible — it means we have not yet documented repeatable success. We accept evaluation samples for new parts at no charge beyond return shipping.

Authorization & Legal Requirements

Every IC unlock engagement requires proof of ownership or written authorization from the IP holder. This protects both parties and keeps the service within the bounds of legitimate reverse engineering for interoperability, maintenance, and archival purposes. Before work begins, clients sign an NDA and provide one of the following:

• Purchase order or invoice showing device procurement.
• Written authorization from the original equipment manufacturer.
• A declaration of ownership for legacy/end-of-life hardware recovery.

We maintain strict chain-of-custody documentation throughout the process. Read more about our compliance and IP-protection policies.

Typical Workflow for IC Unlock Requests

1. Submit your part number and protection details — use our online form or email. Include the full part marking (top and bottom lines), package type, and any known protection level.
2. Receive a feasibility report — within 1–2 working days, we confirm whether the device is on our supported IC list for IC unlock and provide a quote with turnaround estimate.
3. Ship the device or board — we accept bare ICs or complete PCBAs. For EEPROM readout, a board photo with pinout is often sufficient for remote guidance.
4. Firmware extraction and verification — recovered data is verified against known checksums or functional testing where possible. Deliverable formats include Intel HEX, Motorola S-Record, or raw BIN.
5. Secure delivery — files are transferred via encrypted channel. Physical devices are returned insured.

For projects that also require full board-level duplication — schematic capture, Gerber generation, and BOM extraction — our PCB reverse engineering service integrates directly with IC unlock to deliver a complete reproduction package.

[pcb_cta type=”feasibility”]

Deliverable Formats & Verification

Recovered firmware is delivered in the format most useful for your reprogramming workflow. Standard options include:

For multi-region devices — common in STM32 and PIC32 parts with separate bootloader, application, and EEPROM data sections — we provide an annotated memory map at no extra charge, identifying each region’s start address, size, and CRC where applicable.

Pricing Signals & Turnaround Summary

IC unlock pricing depends on the protection mechanism, not just the part number. As a general guide:

• EEPROM / simple lock-bit MCUs (24Cxx, ATmega, PIC16F, STC): starting from approximately $50–$150, 1–5 working days.
• Mid-tier protection (STM32 RDP L1, NXP CRP1/2, MSP430 JTAG fuse): starting from approximately $150–$500, 3–10 working days.
• High-tier / invasive (STM32 RDP L2, NXP CRP3, nRF52 APPROTECT, PSoC 5LP): quoted per-project after feasibility assessment, 7–25 working days.

Exact pricing is provided after we confirm the part number and protection state. Request a quote through our project quotation page.

Frequently Asked Questions

Related reading

• Sep 20261-Layer PCB Reverse Engineering | Process & Deliverables
• Sep 2026HDSC HC32 Unlock | Feasibility, Cost & Lead Time
• Sep 2026PCB Reverse Engineering Turkey | Ship Board, Get Files