93C46 Unlock: Authorized EEPROM Data Recovery
The 93C46 is a 1-Kbit serial EEPROM (128 × 8 or 64 × 16 organization) that uses the Microwire (3-wire SPI-like) interface. Despite its tiny capacity, this chip frequently stores irreplaceable calibration data, configuration parameters, MAC addresses, license keys, and machine settings. When the original firmware project files are lost or a legacy board needs cloning for maintenance, a 93C46 unlock — meaning a full, verified readout of its contents — becomes essential.
Our engineers perform 93C46 data extraction routinely, with a success rate that approaches 100 % on chips that have not suffered physical damage. Below we detail exactly what’s involved, what it costs, and how quickly you can expect results.
What Protection Does the 93C46 Actually Use?
Unlike microcontrollers with code-read-protection fuses (CRP, RDP, etc.), the 93C46 EEPROM family relies on a much simpler security model. Understanding this is the key to assessing feasibility.
- No hardware code-protection fuse. The 93C46 does not have a dedicated lock bit that blocks read access the way an STM32 RDP Level 2 or PIC CP bit would.
- Write-protect pin (ORG/PE). Some package variants expose a write-protect or chip-select mechanism, but this only guards against accidental writes — it does not prevent reads.
- Software EWEN / EWDS commands. The Microwire protocol includes Erase/Write Enable (EWEN) and Erase/Write Disable (EWDS) opcodes. These control write permission at the protocol level but leave the READ opcode fully accessible at all times.
- Board-level protection. In some designs the 93C46 sits behind a supervisory IC, bus buffer, or is powered down by a GPIO. This is the only real obstacle — and it is a board-level issue, not a chip-level one.
Bottom line: the 93C46 itself has no anti-readout mechanism. The challenge is purely about correct interfacing and, in some cases, desoldering the chip for off-board reading.
How We Perform a 93C46 Unlock
Method 1 — In-Circuit Readout
When the 93C46 is accessible on the target PCB and no other device is driving the Microwire bus, we connect directly to the CS, SK, DI, and DO lines using a clip (SOIC-8 or DIP-8) or test-point probes. A protocol-aware programmer (e.g., TL866II Plus, RT809F, or a custom Microwire adapter) issues sequential READ commands across all addresses. The full 128-byte (or 256-byte for ×16 mode) content is captured in under one second.
Method 2 — Off-Board (Desoldered) Readout
If bus contention from the host MCU or other peripherals corrupts reads, we desolder the 93C46 using hot-air rework at 260 °C with a controlled profile to avoid thermal damage. The chip is placed in a socket adapter and read on a dedicated programmer. After extraction, we can resolder the original chip or supply a programmed replacement.
Method 3 — Logic-Analyzer Sniffing
For boards where the host MCU reads the 93C46 at power-up, we can passively capture the Microwire traffic with a logic analyzer (Saleae, Kingst, or similar) at ≥ 10 MHz sample rate. The captured READ transactions are decoded to reconstruct the stored data without touching the EEPROM at all.
Feasibility by Variant
| Variant / Manufacturer | Package | Organization | Read Feasibility | Notes |
|---|---|---|---|---|
| AT93C46 (Atmel / Microchip) | SOIC-8, DIP-8, TSSOP-8 | 64×16 or 128×8 | ~100 % | Most common; no protection |
| M93C46 (STMicroelectronics) | SOIC-8, TSSOP-8 | 64×16 or 128×8 | ~100 % | ORG pin selects word size |
| 93C46 (Catalyst / ON Semi) | SOIC-8 | 64×16 | ~100 % | Legacy part, still readable |
| BR93L46 (ROHM) | SOP-8, SSOP-B8 | 128×8 | ~100 % | Low-voltage variant; use 1.8 V VCC |
| 93LC46 (Microchip) | SOIC-8, DIP-8, MSOP-8 | 64×16 or 128×8 | ~100 % | Low-current CMOS version |
Across all variants, the only scenario where readout fails is physical die damage — cracked bond wires, ESD damage, or corrosion from moisture ingress. We verify die integrity under a microscope before quoting if the chip was exposed to harsh conditions.
What Data Comes Out of a 93C46?
Because the 93C46 holds only 1 Kbit (128 bytes), the data is compact but often critical. Typical contents we encounter include:
- Calibration coefficients — sensor offsets, gain values, DAC trim codes.
- Configuration registers — baud rates, I/O mapping, operational modes.
- MAC addresses and serial numbers — especially in networking and industrial Ethernet devices.
- License or feature flags — single bytes that enable/disable product tiers.
- CRC or checksum bytes — the host MCU often validates the EEPROM contents at boot; we document the checksum algorithm so you can modify data safely.
We deliver the raw binary file (.bin, 128 or 256 bytes), a human-readable hex dump, and — if requested — an annotated memory map showing which addresses hold which parameters.
Cost and Turnaround for 93C46 Unlock
| Service Level | Turnaround | Typical Price Range | Includes |
|---|---|---|---|
| Standard readout | 1–2 working days | $150 – $250 | Raw .bin + hex dump |
| Readout + annotated map | 2–3 working days | $250 – $400 | Annotated memory map, checksum documentation |
| Rush (same-day) | < 24 hours | +50 % surcharge | Priority queue, same deliverables |
Pricing depends on whether in-circuit reading succeeds immediately or desoldering is required, and whether you need the data annotated. For boards where the 93C46 is one component of a larger 93C56 or higher-density serial EEPROM recovery, we bundle pricing across multiple chips.
How Does 93C46 Unlock Compare to MCU Flash Extraction?
Engineers sometimes confuse EEPROM readout with MCU firmware unlock. The two are fundamentally different in difficulty and risk.
| Factor | 93C46 EEPROM | Protected MCU (e.g., STM32, nRF52) |
|---|---|---|
| Protection mechanism | None (protocol-level write-disable only) | Hardware fuse / encrypted boot |
| Read method | Standard Microwire READ opcode | Glitching, FIB, side-channel, debug exploit |
| Success probability | ~100 % (barring physical damage) | 60–95 % depending on family and level |
| Typical cost | $150 – $400 | $500 – $8,000+ |
| Turnaround | 1–3 days | 5–30+ days |
| Risk of data loss | Negligible | Low to moderate (invasive methods) |
If your board carries both a 93C46 and a protected MCU — say an nRF52840 with APPROTECT enabled or an STM32WB55 with RDP Level 1 — we handle both extractions as a single project, reducing total turnaround and cost.
Authorization and Legal Requirements
All 93C46 unlock work is performed strictly for authorized purposes: recovering your own configuration data, maintaining legacy equipment you own, or supporting redesign of boards for which you hold IP rights. We require a signed declaration of ownership or authorization before starting any extraction. Our full approach to IP protection and NDA coverage is detailed on our trust and compliance page.
Common Applications Where 93C46 Recovery Is Needed
- Industrial PLCs and HMIs — legacy Siemens, Omron, and Mitsubishi I/O modules store configuration in 93C46 EEPROMs that cannot be re-downloaded from the programming software.
- Network interface cards — MAC address and PXE boot settings live in the 93C46; replacing the NIC without this data breaks network authentication.
- Automotive ECUs — immobilizer codes, VIN data, and sensor calibration tables are stored in 93C46 chips on older ECU designs (pre-2010).
- Medical device calibration — ISO 13485-compliant instruments store factory calibration in EEPROM; loss of this data renders the device non-compliant until recalibrated.
- Test and measurement equipment — oscilloscope front-end trim, multimeter ADC offset, and power supply voltage references are common 93C46 payloads.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can a 93C46 be read without desoldering it?
Yes, in most cases. We use an SOIC-8 test clip to connect directly to the chip on the board. Desoldering is only needed when another device on the Microwire bus causes contention that corrupts the read. Roughly 80 % of our 93C46 jobs are completed in-circuit.
Is the 93C46 the same as the 93LC46 or AT93C46?
Functionally, yes. The 93LC46 (Microchip) and AT93C46 (Atmel/Microchip) are low-power CMOS versions of the original 93C46 design. They share the same Microwire protocol, pinout, and memory organization. Our readout process works identically across all variants.
What if my 93C46 data is corrupted?
We read the chip multiple times and compare checksums. If bit-level corruption exists, we flag the affected addresses and, where possible, reconstruct values using the host MCU’s checksum algorithm or known data patterns. Partial recovery is documented transparently.
Do you also program blank 93C46 chips with recovered data?
Yes. We can write the extracted data to new 93C46 chips and verify the write. This is useful when the original chip is failing or when you need cloned spares for legacy equipment maintenance.
How does 93C46 unlock relate to MCU firmware extraction?
They are separate processes. The 93C46 is a passive storage device with no code-protection fuses. MCU firmware extraction — from devices like the MSP430F2 or PIC16F18 — involves bypassing active security mechanisms and is significantly more complex and costly.
Related IC Unlock Services
- SST25VF SPI flash data recovery — larger serial flash, similar extraction workflow
- 93C56 EEPROM unlock — the 2-Kbit sibling in the same family
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote