What Is CH573 Unlock and When Do You Need It?
CH573 unlock is the process of recovering firmware from a WCH CH573 microcontroller whose flash read-protection has been enabled. The CH573 is a 32-bit RISC-V BLE MCU with up to 512 KB flash and 32 KB SRAM, widely used in BLE peripherals, USB HID devices, and low-power IoT nodes. When the original source code is lost, the development team has moved on, or a legacy product needs maintenance, authorized firmware readout from a locked CH573 may be the only viable recovery path.
How Does WCH CH573 Flash Protection Work?
WCH implements a multi-level protection scheme across its CH57x family. Understanding these levels is critical before committing to a recovery project because the protection configuration directly determines feasibility and cost.
Protection Levels on the CH573
| Protection Level | Debug Access | Flash Read via ISP | Erase Allowed | Recovery Difficulty |
|---|---|---|---|---|
| Level 0 (None) | Full SWD/JTAG | Yes | Yes | Trivial — no unlock needed |
| Level 1 (Read-Protect) | Blocked | Blocked | Mass-erase only | Moderate — requires invasive or semi-invasive methods |
| Level 2 (Permanent Lock) | Permanently disabled | Permanently blocked | No | High — silicon-level attack required; success not guaranteed |
Most production CH573 parts ship at Level 1. At this level, the two-wire debug interface is disabled for read operations but the chip can still be mass-erased — meaning a standard debug probe cannot pull firmware without destroying it first. Level 2 is a one-time-programmable fuse that permanently disables all external access; it is less common but significantly harder to defeat.
Key Technical Details
- Core: RISC-V4A (QingKe V4A), up to 80 MHz
- Flash: 448 KB code flash + 32 KB data flash (some variants 512 KB total)
- Package: QFN28 (4 × 4 mm) — small die, tight bond-pad pitch
- Debug interface: Single-wire (SDI) proprietary; not standard JTAG/SWD
- Boot ROM: Built-in USB and UART ISP bootloader, locked behind protection bits
The proprietary single-wire debug interface is a WCH-specific design. Unlike ARM Cortex-M parts with well-documented SWD, the CH573 uses a QingKe-specific protocol, which limits the availability of off-the-shelf attack tooling. Our engineers maintain custom toolchains for the CH57x family precisely because generic approaches fail here.
Is CH573 Unlock Feasible for Your Part?
Feasibility depends on three variables: the protection level burned into your specific chip, the physical condition of the die, and whether the part has been exposed to prior decap or tampering attempts. Here is what we see in practice:
- Level 1 parts: High feasibility. Our lab has established repeatable semi-invasive techniques for the CH573’s Level 1 read-protection. Typical success rate exceeds 85 % across the CH57x family.
- Level 2 parts: Conditional feasibility. Silicon-level fault injection is required. Success depends on die revision and process node variance. We quote these on a case-by-case basis after initial inspection, and we are transparent when odds are low.
- Damaged or previously decapped parts: Feasibility drops sharply. If bond wires are severed or the flash array has been physically compromised, recovery may be impossible regardless of protection level.
We always run a low-cost feasibility assessment before committing to a full CH573 unlock engagement. If recovery is not viable, you pay only the assessment fee — no bait-and-switch.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCH573 Unlock Process: Step by Step
1. Intake and Authorization Verification
You submit the target CH573 device along with proof of ownership or authorization — a purchase order, design documentation, or a signed declaration. We operate under NDA and require this step for every IC unlock project. For details on our legal and ethical framework, see our authorization and NDA policy.
2. Non-Destructive Assessment
Our engineers connect to the CH573 via its USB ISP interface and the single-wire debug port to confirm the exact protection level and chip revision (mask set). This stage takes 1–2 working days and tells us which recovery path applies.
3. Recovery Execution
For Level 1 parts, we use a combination of voltage glitching on the power rail during the boot-ROM authentication window and proprietary protocol-level exploits against the QingKe debug interface. The CH573’s 40 nm process node gives us a workable fault-injection margin — not as forgiving as older 180 nm parts, but significantly more accessible than 28 nm or below.
For Level 2 parts, selective die decapsulation and micro-probing may be necessary. This requires chemical decap with fuming nitric acid, followed by focused-ion-beam (FIB) access to internal buses. The QFN28 package complicates handling, so we use custom jigs to maintain electrical contact during the procedure.
4. Verification and Delivery
Recovered firmware is verified by programming it onto a blank CH573 and confirming functional equivalence — peripheral initialization, BLE stack behavior, and USB enumeration are all checked. We deliver the binary (Intel HEX or raw BIN) along with a brief technical report.
Cost and Lead Time for CH573 Unlock
| Service Tier | Applicable Protection | Typical Cost Range (USD) | Lead Time (Working Days) |
|---|---|---|---|
| Feasibility Assessment | Any | $150 – $300 | 1 – 2 |
| Standard Recovery | Level 1 | $500 – $1,200 | 5 – 8 |
| Advanced Recovery | Level 2 / damaged | $1,500 – $3,500+ | 8 – 15 |
Pricing varies with flash size (a 512 KB readout takes longer to verify than 128 KB), the number of sample chips you can supply (we recommend sending at least two), and urgency. Rush service with a 3-day target is available for Level 1 parts at a 40 % surcharge.
What Can Go Wrong — Honest Caveats
We believe transparency builds trust, so here are the real failure modes:
- Die revision mismatch: WCH has shipped at least three mask revisions of the CH573. A technique proven on Rev A may need recalibration for Rev C. We adapt, but it can add 2–3 days.
- Glitch-window closure: Some late-revision CH573 parts have a tighter voltage-glitch tolerance window (under 8 ns), making fault injection unreliable. We disclose this during assessment.
- Encrypted application layer: Even after flash readout, if the original developer encrypted the application payload with an AES key stored in the data-flash OTP area, the recovered binary may require additional cryptanalysis to be useful.
- Single-sample risk: If you supply only one chip and the decap damages it, there is no second attempt. Always send a spare when possible.
CH573 vs. Related WCH Chips
The CH573 shares its protection architecture with several siblings. If your project involves a different WCH part, the techniques overlap significantly:
| Part | Core | Flash | BLE | Protection Similarity to CH573 |
|---|---|---|---|---|
| CH573 | RISC-V4A | 448 KB | BLE 4.2 | — |
| CH579 | ARM Cortex-M0 | 250 KB | BLE 4.2 | Similar ISP lock, different debug port |
| CH582 | RISC-V4A | 448 KB | BLE 5.3 | Near-identical protection scheme |
| CH592 | RISC-V4C | 512 KB | BLE 5.4 | Updated glitch hardening |
If you need firmware recovered from a WCH CH579, the process is closely related but uses ARM SWD rather than the QingKe single-wire interface, which changes the toolchain requirements.
Who Uses CH573 Unlock Services?
Our typical CH573 unlock clients fall into three categories:
- Hardware startups that outsourced firmware development and lost access when the contractor relationship ended. They own the IP but not the source files.
- Maintenance teams supporting fielded BLE products — medical peripherals, industrial sensors, consumer wearables — where the original firmware must be recovered to produce replacement boards.
- Engineering teams performing failure analysis or compliance testing on their own products, needing to verify that production firmware matches the golden binary.
In every case, proof of ownership or written authorization is required before we begin work.
Exploring Other MCU Unlock Services
If your project spans multiple microcontroller families, our lab handles a wide range of architectures. Engineers working with Nordic BLE SoCs can review our nRF53 series unlock capabilities. For Chinese-domestic RISC-V and ARM alternatives, we also support Puya PY32 flash recovery and MindMotion MM32 readout. Each family has distinct protection mechanisms, but our cross-platform experience means faster ramp-up and fewer surprises.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCan the CH573 be unlocked without destroying the chip?
For Level 1 protection, yes — our voltage-glitch and protocol-level techniques are non-destructive in most cases. The original chip remains functional after firmware extraction. Level 2 recovery typically requires decapsulation, which is destructive to the package but preserves the die for readout. We always clarify the expected outcome during the feasibility assessment.
How do I confirm my CH573’s protection level before sending it?
Connect the chip via USB to WCH’s ISPTool utility. If the tool reports “read-protected” and refuses to dump flash but allows mass-erase, the part is at Level 1. If even mass-erase is blocked and the debug interface returns no response at all, Level 2 is likely. You can also check the CFG_PROTECT register via the single-wire debug port if you have a WCH-Link probe.
Is CH573 unlock legal?
Firmware recovery is legal when performed on chips you own or are authorized to access. Common lawful scenarios include recovering your own lost source code, maintaining legacy products, and failure analysis. We require documented proof of ownership or a signed authorization letter before starting any project. Read more about our compliance and authorization requirements.
What files do I receive after a successful CH573 unlock?
You receive the full flash content as a raw binary (.bin) and Intel HEX (.hex) file, covering both code flash and data flash regions. We also provide a short technical report noting the chip revision, protection level encountered, and any anomalies observed during readout. If you need the firmware disassembled into RISC-V assembly, that is available as an add-on service.
What if the unlock attempt fails?
If recovery is not successful, you pay only the feasibility assessment fee — typically $150–$300. We do not charge the full recovery fee for failed attempts. We also return your chips (intact if the method was non-destructive) along with a written explanation of why recovery was not achievable, so you can make an informed decision about next steps.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote