Yes — in most cases you can unlock a PIC microcontroller and recover the protected firmware, but feasibility depends on the specific family, the code-protection (CP) fuse configuration, silicon revision, and the technique applied. Older 8-bit families like PIC12F and PIC16F have well-understood protection schemes with success rates above 90 %. Newer PIC18FK and PIC32 parts use stronger flash-security mechanisms that require more advanced methods, longer turnaround, and occasionally yield only partial recovery. Every engagement requires proof of ownership or written authorization before work begins.
Why PIC Code Protection Exists — and When Recovery Is Legitimate
Microchip’s code-protection fuses (CP, CPB, CPD, WRT bits) prevent casual readout of program memory through the ICSP or JTAG interface. This safeguards OEM intellectual property in mass-produced products. However, there are legitimate reasons to recover firmware you already own:
- Legacy maintenance — the original source code or hex file was lost, and the product must stay in service.
- Second-source production — a discontinued board needs to be re-manufactured with the identical firmware.
- Failure analysis — verifying that field-returned units contain unmodified code.
- IP audit — confirming that a contract manufacturer programmed the correct revision.
All work at our lab is performed under NDA with documented authorization. For details on our compliance process, see our authorization and trust framework.
Can You Unlock PIC Microcontroller Families? A Comparative Table
The table below summarizes feasibility across the major PIC families our engineers encounter. “Difficulty” reflects the combination of protection strength, die geometry, and availability of proven attack vectors.
| PIC Family | Core | Typical CP Scheme | Difficulty | Est. Success Rate | Turnaround (working days) |
|---|---|---|---|---|---|
| PIC10F / PIC12F | 8-bit Baseline | Single CP bit | Low | 95 %+ | 3–5 |
| PIC16F (classic) | 8-bit Mid-Range | CP + CPD bits | Low–Medium | 90–95 % | 3–7 |
| PIC16F15xx / PIC16F18xx | 8-bit Enhanced Mid-Range | CP + WRT + SAF | Medium | 80–90 % | 5–10 |
| PIC18F (classic) | 8-bit High-Performance | CP + CPB + WRT + EBTR | Medium | 85–90 % | 5–10 |
| PIC18F-K / PIC18F-Q | 8-bit (new core) | Enhanced CP + boot-sector lock | Medium–High | 70–85 % | 7–14 |
| PIC24F / dsPIC33 | 16-bit | General Segment + Secure Segment | High | 60–80 % | 10–20 |
| PIC32MX | 32-bit MIPS | CP + boot flash lock | High | 55–75 % | 14–25 |
| PIC32MZ | 32-bit MIPS | Crypto engine + secure boot | Very High | 40–60 % | 20–30+ |
Rates reflect our lab data across several hundred PIC unlock engagements. Individual results vary by silicon revision and prior tampering.
What Makes Some PIC Parts Harder to Unlock?
Die-Level Protections
Classic PIC16F parts store the CP fuse in a single flash cell that can be targeted with UV exposure or micro-probing. Newer enhanced mid-range and PIC18F-K/Q devices distribute protection across multiple configuration words and add write-protect (WRT) layers that complicate non-invasive approaches.
Boot-Sector and Secure-Segment Isolation
PIC24F and dsPIC33 families implement a separate “secure segment” with its own code-protection bits. Even if the general segment is recovered, the secure segment may remain locked, yielding a partial dump. Our engineers evaluate both segments independently during the feasibility phase.
Silicon Revision Drift
Microchip periodically updates die masks. A technique that works on PIC18F46K22 rev A3 may fail on rev B1 because the fuse cell layout shifted. We maintain a revision database covering over 400 PIC part numbers to pre-screen feasibility before committing to a method.
PIC16F15 and PIC16F18 — Enhanced Mid-Range Specifics
The PIC16F15xx and PIC16F18xx sub-families are among the most requested. They use Microchip’s enhanced mid-range core with Storage Area Flash (SAF) and multiple CP/WRT configuration bits. Our current success rate on PIC16F15 series parts sits around 85 %, while the PIC16F18 family is slightly more involved due to additional peripheral configuration data stored alongside the protected firmware. Turnaround for both is typically 5–10 working days.
PIC18FK — The Newer 8-Bit Challenge
PIC18F-K and PIC18F-Q series devices represent Microchip’s latest 8-bit silicon. They add boot-sector code protection (CPB) and enhanced block-erase restrictions. Semi-invasive methods — controlled decapsulation plus micro-probing — are often required. Our PIC18FK unlock page details the specific constraints, including the risk of partial recovery when the boot block uses a different protection level than the main program flash.
How the Unlock Process Works
- Feasibility check — You submit the exact part number (e.g., PIC16F1789-I/PT), silicon revision if known, and a brief description of why recovery is needed. We respond within one business day with a difficulty assessment and quote.
- Authorization & NDA — We require a signed declaration of ownership or a letter of authorization from the IP holder. No exceptions.
- Chip receipt & inspection — The physical device arrives at our lab. We inspect for prior decapsulation attempts, remarking, or damage.
- Protection analysis — We read the configuration word(s) through standard ICSP to confirm which CP/WRT bits are set.
- Recovery execution — Depending on the family, this may involve non-invasive electrical techniques, UV-based fuse reset, or semi-invasive micro-probing under a metallurgical microscope.
- Verification — The extracted hex file is programmed into a blank device of the same part number and tested for functional equivalence.
- Delivery — You receive the .hex file, a configuration-word summary, and (optionally) a disassembly listing.
What Can Go Wrong
Transparency matters. Here are failure modes we see in real engagements:
- Die damage during decapsulation — aggressive acid exposure or mechanical lapping can destroy bond wires or the flash array. Risk is highest on small-die parts (PIC10F, SOT-23 packages).
- Partial reads — on PIC24F/dsPIC33, the secure segment may resist readout even when the general segment is recovered. We report partial results honestly.
- Counterfeit or remarked chips — we occasionally receive parts that are not genuine Microchip silicon. Die inspection reveals this early, but the engagement cannot proceed.
- One-Time Programmable (OTP) parts — older PIC16C series use EPROM cells. If the UV window was previously exposed or the die is degraded, data integrity may be compromised.
Cost and Turnaround Ranges
| Category | Typical Price Range (USD) | Turnaround |
|---|---|---|
| PIC10F / PIC12F / PIC16F classic | $300–$600 | 3–7 days |
| PIC16F15 / PIC16F18 enhanced | $500–$900 | 5–10 days |
| PIC18F classic | $500–$900 | 5–10 days |
| PIC18FK / PIC18FQ | $800–$1,500 | 7–14 days |
| PIC24F / dsPIC33 | $1,200–$2,500 | 10–20 days |
| PIC32MX / PIC32MZ | $2,000–$4,000+ | 14–30 days |
Pricing depends on quantity (single chip vs. batch), urgency, and whether semi-invasive methods are needed. We provide a firm quote after the feasibility check — no hidden charges.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewHow PIC Compares to Other MCU Families
Engineers sometimes ask whether switching to a different vendor’s MCU would have prevented the need for unlock. In practice, every major vendor’s protection has known limitations:
- MSP430 — TI’s JTAG fuse blow is well-documented. Parts like the MSP430F2 series are generally recoverable with non-invasive methods.
- ARM Cortex-M (various vendors) — Read-out protection (RDP) levels vary. Some Cortex-M0 parts are easier than PIC32; others with TrustZone are harder.
- WCH RISC-V — Newer parts like the CH585 use flash-based protection that is still being characterized.
PIC microcontrollers, particularly the 8-bit families, remain among the most recoverable MCUs on the market — which is precisely why the question “can you unlock PIC microcontroller” comes up so frequently.
Frequently Asked Questions
Is it legal to unlock a PIC microcontroller I designed?
Yes. If you are the IP owner or have written authorization from the IP holder, recovering firmware from your own PIC microcontroller is legal in most jurisdictions. We require proof of ownership before starting any work. Our trust and compliance page explains the documentation we accept.
Can you unlock a PIC microcontroller without destroying it?
For most 8-bit PIC families (PIC12F, PIC16F, PIC18F classic), non-invasive or minimally invasive techniques preserve the chip. Semi-invasive methods used on PIC18FK, PIC24F, and PIC32 families involve chemical decapsulation, which renders the specific device non-reusable — but the firmware is recovered intact for programming onto a fresh part.
What if the PIC part number is discontinued?
Discontinued parts are actually one of the most common reasons for PIC unlock requests. As long as the physical chip is intact and not counterfeit, discontinuation does not affect our ability to recover the firmware. We can also help source NOS (new-old-stock) replacement chips for reprogramming.
Do you need multiple sample chips?
For low-difficulty families (PIC10F–PIC16F classic), a single chip is usually sufficient. For PIC24F, dsPIC33, and PIC32 engagements, we recommend sending 2–3 samples in case the first requires a destructive approach. We always attempt the least invasive method first.
Can you recover EEPROM data along with program flash?
Yes. When the CPD (Data Code Protection) bit is set, we recover EEPROM contents as part of the same engagement. The EEPROM dump is delivered as a separate section in the hex file, clearly labeled by address range.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote