What Does CH573 Crack Actually Involve?
CH573 crack refers to the authorized recovery of firmware from a WCH CH573 microcontroller whose code-read protection has been enabled. The CH573 is a RISC-V-based BLE 4.2 SoC with 512 KB of flash and 32 KB of SRAM, widely used in IoT peripherals, USB dongles, and low-power sensor nodes. WCH implements a three-tier protection model in the CH573’s option bytes, and the tier that was set at programming time dictates the difficulty—and sometimes the impossibility—of recovering the flash contents. Our lab handles authorized CH573 crack requests when clients can demonstrate ownership or IP rights, typically completing feasibility assessment within 2–4 working days.
CH573 Protection Levels Explained
WCH’s documentation defines three distinct code-protection states for the CH573. Understanding what each level does is essential before requesting any recovery service, because the technical approach—and the realistic outcome—differs sharply between them.
| Protection Level | Debug Access | Flash Read | Flash Write/Erase | Recovery Feasibility |
|---|---|---|---|---|
| Level 0 (None) | Open | Allowed | Allowed | Trivial — standard SWD/ISP readout |
| Level 1 (Read-Protect) | Restricted | Blocked via debug | Allowed after mass-erase | Moderate — side-channel or glitch techniques may succeed |
| Level 2 (Permanent Lock) | Disabled | Blocked | Blocked | Very difficult — invasive die-level work required; not always possible |
Most production CH573 units ship at Level 1. Level 2 is rare in the field because it is irreversible and prevents any future firmware updates, which makes it impractical for products that need OTA BLE stack patches.
Level 0 — No Protection
At Level 0 the two-wire debug interface (SWD-like, WCH’s proprietary variant) remains fully open. Firmware can be read out with WCH’s own WCHISPTool or a compatible RISC-V debugger in seconds. No “crack” is needed; this is a straightforward download. We still see Level 0 on engineering samples and early-run boards where protection was never enabled.
Level 1 — Read-Protect (Most Common)
Level 1 disables external read access through the debug port while keeping the bootloader’s mass-erase path alive. The intent is to let a manufacturer re-flash the chip without being able to extract existing code. From a recovery standpoint, Level 1 is the most frequently requested CH573 crack scenario. Techniques that have proven effective on similar WCH RISC-V parts include:
- Voltage glitching — precisely timed VCC transients during the boot-up protection-check window can cause the read-protect flag to be skipped, temporarily exposing flash contents.
- Electromagnetic fault injection (EMFI) — a focused EM pulse on the die during the option-byte validation cycle achieves a similar bypass without physical contact to power rails.
- Bootloader protocol exploitation — certain ISP command sequences, when combined with timing manipulation, have allowed partial or full readout on CH573 firmware revisions prior to mid-2023.
Success rates at Level 1 depend on the specific silicon revision (marked on the package date code) and the bootloader ROM version. Our engineers request a photo of the chip markings before quoting.
Level 2 — Permanent Lock
Level 2 blows a one-time-programmable (OTP) fuse that permanently disables all external access, including mass-erase. Recovery at this level requires decapsulation and direct die probing or FIB (focused ion beam) circuit editing—expensive, time-consuming, and not guaranteed. Turnaround can exceed 4–6 weeks, and we provide a feasibility report before committing resources.
How the CH573 Compares to Related WCH Parts
The CH573 shares its RISC-V core architecture and protection model with the CH579, though the CH579 adds Ethernet MAC and a slightly different option-byte layout. If you are working with the higher-integration variant, our CH579 firmware recovery guide covers the differences in protection implementation. The protection philosophy across WCH’s BLE line is consistent, but the bootloader ROM versions diverge, which means a glitch timing profile validated on the CH573 does not transfer directly to the CH579 without recalibration.
Our CH573 Crack Process — Step by Step
- Ownership verification — you provide proof of IP rights or a signed authorization letter. We do not proceed without it.
- Chip inspection — we photograph the package markings, identify the date code and silicon revision, and determine the protection level via a non-destructive ISP probe.
- Feasibility assessment (2–4 days) — based on the protection level and revision, we report the estimated success probability and cost range.
- Recovery attempt — for Level 1, our glitch/EMFI bench targets the protection-check window. For Level 2, we decapsulate under cleanroom conditions and proceed with microprobing.
- Verification & delivery — recovered firmware is verified against a CRC check (if the original CRC is known) and delivered as a .bin or .hex file under NDA.
Typical turnaround for a Level 1 CH573 crack is 5–10 working days from sample receipt. Level 2 cases are quoted individually.
What Can Go Wrong
Transparency matters more than marketing here. These are real failure modes we encounter:
- Newer silicon revisions patch known glitch vectors. WCH has tightened the boot-up timing window in post-2023 revisions, reducing the voltage-glitch success window from ~120 ns to under 40 ns on some lots.
- Decapsulation damage. The CH573’s die is relatively small (roughly 2.1 × 2.3 mm). Aggressive chemical decap or laser decap can destroy bond wires or passivation layers, making microprobing impossible.
- Encrypted flash contents. Some firmware developers enable an additional XOR or AES-based application-layer encryption on top of hardware protection. Even after a successful readout, the binary may require further reverse engineering to be useful.
- Bootloader ROM updates. WCH occasionally ships the same part number with a revised bootloader ROM that changes ISP command behavior, invalidating previously working protocol exploits.
We report all known caveats before you commit budget. If our assessment shows a low probability, we say so.
Authorization and Legal Framework
CH573 crack services are performed exclusively for authorized parties—original IP holders recovering lost source code, maintenance engineers supporting legacy products, or licensees with written permission. We require a signed declaration of ownership or authorization before any work begins, and all deliverables ship under NDA. This is consistent with how we handle sensitive recoveries across other RISC-V and ARM-based parts, including work on Nordic nRF53 protected devices and Renesas RA4 series MCUs.
Who Typically Needs CH573 Firmware Recovery?
The requests we see most often fall into three categories:
- Contract manufacturer disputes — an OEM’s CM holds the only programmed samples, and the OEM needs to recover their own firmware to switch production to a new facility.
- Legacy product maintenance — a BLE peripheral designed 3–5 years ago needs a stack update, but the original .hex file was lost and the developer is no longer available.
- Failure analysis — a batch of CH573-based boards is failing in the field, and the engineer needs to compare the flashed binary against the known-good release to rule out a programming error.
Related Chip Families We Support
If your project involves multiple MCU types across a single product line, our lab covers a broad range of protection schemes. Engineers working with Chinese-domestic RISC-V and ARM parts often also need recovery on Nations Tech N32 microcontrollers or MindMotion MM32 devices, both of which use different but conceptually similar tiered protection. For Nuvoton 8051-core parts found on the same boards as CH573 BLE modules, see our coverage of Nuvoton ML51 code protection.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCan the CH573 be read out if only Level 1 protection is set?
In most cases, yes. Level 1 on the CH573 blocks debug-port reads but does not disable the bootloader or blow OTP fuses. Voltage glitching and EMFI techniques have demonstrated reliable bypass on pre-2023 silicon revisions. Post-2023 revisions are harder but not necessarily impossible—our feasibility check determines viability for your specific chip lot.
How long does a CH573 crack take?
Feasibility assessment takes 2–4 working days after we receive the sample. If Level 1 recovery is approved, the actual extraction typically completes within 5–10 working days. Level 2 (permanent lock) cases require decapsulation and can take 4–6 weeks, with no guarantee of success.
Is CH573 firmware recovery legal?
Firmware recovery is legal when performed for the rightful IP owner or an authorized party. We require proof of ownership or a signed authorization letter before starting work. All results are delivered under NDA. We do not assist with extracting third-party proprietary code for unauthorized duplication.
What file format is the recovered firmware delivered in?
We deliver the raw binary as a .bin file and, on request, an Intel .hex file. If the original project used WCH’s MounRiver Studio toolchain, we can also provide a flashable image compatible with WCHISPTool. Disassembly or source-code reconstruction is a separate service quoted on request.
Does the chip survive the recovery process?
At Level 1, non-invasive techniques (glitching, EMFI) leave the chip fully functional. At Level 2, decapsulation is destructive—the chip cannot be reused. We always confirm the approach and its consequences during the feasibility phase so you can plan accordingly.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote