Yes, you can clone a board with a locked MCU — but the real answer is conditional. The board itself (copper, solder mask, silkscreen, BOM) can always be reverse-engineered from the physical sample. The locked microcontroller is the bottleneck: whether its firmware can be read out depends on the chip vendor, the protection tier that was set, and the specific silicon revision on your board. Below we walk through every variable so you know exactly where your project stands before you ship anything.
Why the MCU Lock Is the Main Obstacle When You Clone a Board
A PCB without its firmware is a paperweight. The copper layout, component placement, and netlist can all be captured through optical scanning and delayering — our lab does this routinely on boards up to 24 layers. But when the MCU’s read-protection bits are set, the binary inside the flash cannot be extracted through standard JTAG, SWD, or ISP interfaces. The chip returns all zeros or triggers an erase.
This is by design. Manufacturers like STMicroelectronics, Microchip, NXP, and Renesas implement multiple protection tiers precisely to stop casual readout. Understanding how chip security mechanisms such as fuses, lock bits, and encryption function is the first step in evaluating whether your locked MCU can be recovered.
Protection Levels Across Common MCU Families
Not all locks are equal. Some can be bypassed through well-documented voltage-glitch or UV techniques; others require invasive decapping and micro-probing. The table below summarizes real-world recoverability for families we encounter most often.
| MCU Family | Typical Protection | Recovery Difficulty | Estimated Success Range |
|---|---|---|---|
| STM32F0 / F1 / F4 (RDP Level 1) | Read-out protection, debug disabled | Moderate | High — well-studied glitch vectors |
| STM32 (RDP Level 2) | Permanent lock, JTAG fuse blown | Very high — invasive only | Case-by-case; some revisions vulnerable |
| PIC16 / PIC18 (CP bit set) | Code-protect fuse | Low to moderate | High for most older silicon |
| ATmega / ATtiny (lock bits 11) | LB mode 3, no verify | Moderate | High via HV techniques on many revisions |
| NXP LPC1xxx (CRP Level 1–2) | Code-read protection | Moderate | CRP1 high; CRP2 lower |
| NXP LPC (CRP Level 3) | ISP entry disabled, no external access | Very high | Low without decap |
| Renesas RX / RL78 | OCD security ID + flash shield | High | Depends on revision; some bypass exists |
| GD32 / CKS clones | Varies by clone generation | Low to moderate | Often easier than the original they copy |
Key takeaway: if your board uses a chip with a single-tier lock (PIC CP, ATmega LB3, STM32 RDP1), recovery odds are strong. Multi-tier or permanent locks (STM32 RDP2, NXP CRP3) require invasive methods and carry real risk of destroying the only sample.
How We Clone a Board With a Locked MCU — Step by Step
1. Board-Level Reverse Engineering (Independent of MCU)
We start with the PCB itself. Optical scanning at 1200 DPI or higher captures every copper layer. For multilayer boards we use chemical delayering to expose inner planes. The output is a full Gerber set, drill files, and a verified BOM — typically within 7–12 working days for a 4-to-8-layer board. This part of the work is unaffected by the MCU lock. You can review our physical delayering and scanning workflow for the complete sequence.
2. MCU Identification and Protection Assessment
We decap a sacrificial sample (or use the markings if legible) to confirm the exact die revision. Silicon revisions matter: an STM32F103C8T6 from 2016 may respond to a glitch attack that fails on a 2021 batch. We document the protection tier and issue a feasibility report before any firmware work begins.
3. Firmware Extraction
Depending on the protection level, extraction follows one of three paths:
- Non-invasive bypass — voltage glitching, timing attacks, or bootloader exploits. Fastest and safest; typically 1–5 working days.
- Semi-invasive — UV exposure or laser fault injection after partial decap. Adds 3–7 days and requires a second sample as backup.
- Fully invasive (micro-probing) — the die is exposed, bond pads or internal buses are probed directly under a probe station. This is last-resort territory: expensive, slow (10–20+ days), and the chip is destroyed in the process.
For a deeper look at each technique and when it applies, see our guide on the firmware recovery process from locked chips.
4. Verification and Programming
Recovered firmware is loaded onto a blank MCU of the same part number. We power the cloned board, run functional checks against the original, and compare I/O behavior with a logic analyzer. Only after the clone board boots and behaves identically do we mark the job complete.
What Happens When Recovery Fails?
Honesty matters here. Some locked MCUs cannot be read — period. STM32 parts with RDP Level 2 on newer silicon, or NXP LPC parts with CRP3 and no known bootloader vulnerability, may resist every technique we have. In those cases your options are:
- Rewrite the firmware from scratch — using the schematic and board behavior as a specification. This is a full embedded-engineering project, not a copy job.
- Source pre-programmed chips — if the original manufacturer or a licensed distributor can supply programmed parts, the board clone still works.
- Functional substitution — replace the MCU with a compatible part running new code that replicates the original behavior. Viable when the board’s function is simple (motor driver, LED controller, sensor interface).
We flag unrecoverable situations in the feasibility report so you never pay for work that can’t deliver.
Authorization and Legal Requirements
We only perform firmware extraction on MCUs where the client demonstrates ownership or authorization — your own product, a legacy board you manufactured, or a device you hold IP rights to. Every project runs under NDA. If you need details on how we verify ownership and handle sensitive files, visit our lab and authorization policy page.
This is not optional. Extracting firmware from a competitor’s locked MCU without permission is IP theft, and we will decline the project.
Cost and Timeline to Clone a Board With a Locked MCU
| Work Scope | Typical Timeline | Starting Price Range (USD) |
|---|---|---|
| PCB reverse engineering only (Gerber + BOM) | 7–15 working days | $600 – $3,000+ |
| MCU firmware extraction (non-invasive) | 1–5 working days | $200 – $1,500 |
| MCU firmware extraction (semi-invasive) | 5–12 working days | $800 – $4,000 |
| MCU firmware extraction (fully invasive) | 10–25 working days | $2,000 – $8,000+ |
| Full board clone with locked MCU (end-to-end) | 12–30 working days | $1,200 – $10,000+ |
Prices depend on layer count, board complexity, chip family, and number of locked devices on the board. Some boards carry two or three different locked MCUs or CPLDs — each adds its own extraction scope.
How to Improve Your Chances Before Shipping
- Send two identical boards — one for PCB work, one as a sacrificial sample for invasive MCU work. Check the board sample condition and quantity checklist for packing guidance.
- Identify the MCU — photograph the chip markings clearly. If the markings are sanded off, note that in your request; we can often identify the die after decap.
- Provide any documentation you have — schematics, old firmware binaries, programming jig pinouts. Even partial data cuts our turnaround significantly.
- State the end goal — are you cloning for production, for a one-off repair, or to migrate to a new MCU? The goal shapes how we scope the firmware work.
When Cloning Isn’t the Right Move
If the board is 15+ years old and uses a chip family with no supply, or if the firmware is trivial enough to rewrite in a week, a full redesign may cost less than invasive extraction. We help clients weigh that decision — read more on when reverse engineering beats a redesign.
Can I clone just the PCB and skip the locked MCU firmware?
Yes. We deliver Gerber files, drill files, and a BOM regardless of MCU status. You receive a manufacturable board; you just need to source or program the MCU separately. This is common when clients have access to programmed chips from their original supplier.
Will the extraction damage my only board?
Non-invasive methods leave the board and chip intact. Semi-invasive and invasive methods destroy the MCU — and sometimes the board around it. We always recommend sending at least two samples. If you have only one, we complete all PCB imaging before touching the MCU.
What if the chip markings are sanded or lasered off?
Sanded markings are common on contract-manufactured boards. We can often identify the die through decapping and comparing the die photo against known databases. This adds 2–4 days but rarely blocks the project entirely.
Do you guarantee firmware recovery on every locked MCU?
No. We issue a feasibility assessment before work begins and quote only what we believe is achievable. If extraction fails after an agreed attempt, you pay only for the diagnostic phase, not the full extraction fee. Transparency on success probability is part of our standard workflow.
Is it legal to extract firmware from a locked MCU?
It is legal when you own the IP or have written authorization from the rights holder. Common lawful scenarios include legacy product maintenance, second-sourcing your own design, and disaster recovery. We require proof of ownership or authorization before starting any firmware work.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote