CH32X Unlock | Feasibility, Cost & Lead Time

CH32X Unlock: Authorized Firmware Recovery for WCH’s RISC-V MCUs

CH32X unlock is the process of reading protected firmware from WCH’s CH32X-series RISC-V microcontrollers when normal debug access has been disabled. The CH32X family—including the CH32X035 and related sub-variants—uses configurable read-out protection (RDP) that blocks SWD/JTAG readback once enabled. Our engineers recover flash contents from these devices for clients who own the IP but have lost source code, need to support legacy products, or must verify production firmware against a known-good binary. Authorization and proof of ownership are required before any work begins.

What Protection Does the CH32X Series Use?

WCH implements a two-tier protection scheme on the CH32X family, similar to the model used across their broader CH32V and CH32F lines but tuned for the RISC-V QingKe V4 core.

Most CH32X035 parts encountered in the field are set to Level 1. Level 2 permanent lock is rare in CH32X designs because it eliminates all field-update capability, but we do see it on security-sensitive products. Our feasibility assessment identifies the exact protection state before quoting.

Option Bytes and Boot Configuration

The CH32X stores protection settings in option bytes at a fixed flash address. These bytes also control boot-mode selection (main flash vs. system bootloader vs. SRAM). A misconfigured option-byte write is one of the most common reasons engineers seek CH32X unlock—a failed OTA update or debug session can inadvertently set RDP Level 1, locking out the developer’s own code.

How We Approach CH32X Unlock

Our workflow follows a least-invasive-first principle. Each step is attempted before escalating to the next, which preserves the device and minimizes cost.

1. Protocol-level analysis — We probe the SWD interface and WCH’s proprietary WCHLink protocol to confirm the protection tier and check for known configuration vulnerabilities specific to the CH32X silicon revision.
2. Glitch / fault-injection — For Level 1 devices, voltage-glitch and clock-glitch techniques can bypass the readback gate during the boot-ROM handshake window. The CH32X035’s QingKe V4 core has a relatively short boot sequence (~12 µs), requiring precise timing on our glitch rigs.
3. Semi-invasive methods — UV exposure or laser fault injection targeting the option-byte latch, applicable when glitching alone is insufficient.
4. Invasive decap + micro-probing — Reserved for Level 2 or hardened silicon revisions. We chemically decapsulate the die and use micro-probing stations to read internal bus lines directly. This is destructive to the package but not necessarily to the die.

For the majority of CH32X Level 1 jobs, steps 1–2 are sufficient. Our engineers have handled over a dozen CH32X035 recovery projects in the past year, and Level 1 recoveries consistently complete without decapping.

Typical Cost and Lead Time

Pricing depends on protection level, flash size, and whether the part is a standard CH32X035 or a custom-mask variant. The ranges below reflect our recent project history.

We offer a no-recovery-no-fee policy on Level 1 attempts. For Level 2 jobs, a non-refundable evaluation fee covers decap preparation and die inspection; the balance is invoiced only on successful readout.

What You Receive After CH32X Unlock

Deliverables are tailored to your downstream need:

• Raw binary (.bin) — byte-for-byte flash image, including option bytes and any user-data area.
• Intel HEX (.hex) — address-annotated format ready for WCH’s WCHISPTool or third-party programmers.
• Disassembly listing — optional RISC-V disassembly with symbol-table reconstruction (additional fee; useful for porting or debugging).
• Option-byte map — documented protection and boot-config state so you can reproduce or modify the configuration on new parts.

All files are delivered encrypted via our secure portal. We retain no copies after the agreed retention window (default 30 days) unless you request archival.

CH32X vs. Other WCH Families

WCH produces several RISC-V MCU families. The CH32X series sits between the ultra-low-cost CH32V003 and the wireless-enabled CH573/CH579 lines. Protection mechanisms differ enough that techniques proven on one family don’t always transfer directly.

If your target is actually a CH573 with BLE firmware or a CH579 with Ethernet connectivity, the unlock approach and pricing will differ. Confirm the exact part marking before requesting a quote—WCH’s naming can be confusing across product lines.

Authorization and Legal Requirements

CH32X unlock is performed exclusively for authorized parties. Before we begin, you must provide one of the following:

• Proof of IP ownership (design files, purchase orders for the original development).
• Written authorization from the IP holder (e.g., a client letter or license agreement).
• Evidence of legitimate maintenance need (end-of-life product support, warranty obligation).

All work is covered by our mutual NDA. We do not assist with circumventing third-party protections for the purpose of cloning or pirating proprietary firmware.

Common Failure Modes and Honest Caveats

Not every CH32X unlock succeeds. Transparency about limitations saves both parties time:

• Damaged bond wires — If the chip was subjected to ESD or overcurrent, internal connections may be severed, making even invasive reads impossible.
• Custom-mask variants — Some OEMs order CH32X parts with modified boot ROMs. These require fresh reverse engineering of the boot sequence, adding 5–10 days.
• Encrypted application payloads — Even after a successful flash dump, if the firmware itself encrypts its payload with a key derived from the unique device ID, the binary may not be directly reusable on a different chip without key reconstruction.
• Silicon revision changes — WCH has released multiple die revisions of the CH32X035. A technique that works on Rev. A may need recalibration for Rev. C. We track revision differences, but new steppings occasionally require R&D time.

Our feasibility evaluation catches most of these issues before you commit budget. We recommend starting there if you’re uncertain about the chip’s condition.

Related MCU Unlock Services

Engineers working with Chinese-domestic RISC-V and ARM MCUs often need unlock services across multiple vendor families. Our lab handles a wide range of parts beyond WCH, including Puya PY32 flash recovery, AirMCU AIR32 firmware extraction, and MindMotion MM32 readout protection bypass. For Nordic Semiconductor designs, we also cover the nRF53 APPROTECT unlock path.

Related reading

• Oct 2026NXP LPC11 Unlock | Feasibility, Cost & Lead Time
• Oct 2026Zilog IC Unlock | Families We Can Read & Recover
• Oct 2026TI CC2540 Crack | Protection Levels & Recovery