CH579 Unlock: Authorized Firmware Recovery for WCH’s BLE RISC-V MCU
The CH579 is a 32-bit RISC-V microcontroller from Nanjing Qinheng Microelectronics (WCH) featuring integrated BLE 4.2, USB host/device, and Ethernet MAC — commonly deployed in IoT gateways, BLE bridges, and industrial sensor nodes. CH579 unlock refers to the authorized extraction of flash firmware from a read-protected CH579 when the original source code or binary has been lost. Our engineers have recovered CH579 firmware for clients who lost build environments, need to maintain legacy products, or must verify production binaries against a golden reference. Success depends on the specific protection bits set and the silicon revision of the target device.
What Protection Does the CH579 Use?
WCH implements a multi-level code-readout protection (CRP) scheme across its CH57x/CH58x family. The CH579 specifically offers:
- Level 0 (No Protection): Flash is fully readable via SWD/ISP. No unlock procedure required — a straight readout takes minutes.
- Level 1 (Read-Protect Enabled): The debug interface is locked and ISP readback is disabled, but the bootloader and certain JTAG-level operations remain partially accessible. This is the most common protection level we encounter on fielded CH579 devices.
- Level 2 (Permanent Lock): Debug port is permanently disabled, and bootloader readback is fused off. Recovery at this level requires invasive techniques — decapping and micro-probing — with significantly higher cost and lower success probability.
Unlike some STM32-class chips that use a single RDP byte, WCH stores protection configuration in a dedicated option-byte area backed by an internal OTP fuse on higher-level locks. The distinction matters: Level 1 is reversible in most silicon revisions (pre-2023 masks), while Level 2 on newer masks may involve one-time-programmable fuses that cannot be reset non-destructively.
Realistic Success Rates by Protection Level
| Protection Level | Technique Category | Estimated Success Rate | Typical Cost Range (USD) | Turnaround |
|---|---|---|---|---|
| Level 0 | Direct ISP/SWD readout | > 99 % | $100 – $200 | 1 – 2 days |
| Level 1 | Non-invasive / semi-invasive | 85 – 95 % | $400 – $900 | 5 – 10 working days |
| Level 2 | Invasive (decap + micro-probe) | 40 – 70 % | $1,500 – $3,500 | 15 – 25 working days |
These ranges reflect our lab data across the CH57x/CH58x family. Actual cost depends on the quantity of sample devices you can supply (we typically request 2–3 units for Level 1, 3–5 for Level 2), the flash size variant (256 KB vs. 512 KB), and whether you need a verified binary or a full annotated disassembly.
Why Silicon Revision Matters
WCH has iterated the CH579 die at least twice since its initial release. Early revisions (date codes before 2022-Q3) have a known vulnerability in the debug-port lockout logic that allows Level 1 bypass without physical die access. Later revisions patched this path, pushing Level 1 recovery toward semi-invasive methods — still feasible, but requiring FIB (Focused Ion Beam) or laser fault injection in some cases. We identify the revision from the package markings before quoting, so you know exactly which approach applies to your batch.
How the CH579 Unlock Process Works
Step 1 — Feasibility Assessment
You ship us 1–2 sample devices (or the complete PCB). We identify the exact part number (CH579M, CH579F, etc.), read the package date code, and probe the debug port to confirm the active protection level. This assessment is free; you pay nothing if we determine recovery is not viable.
Step 2 — Technique Selection
Based on the protection level and silicon revision, our engineers select the optimal attack vector. For Level 1 on older masks, this is typically a voltage-glitch or timing-based bypass on the SWD handshake. For Level 1 on newer masks or Level 2, we move to decapping under controlled acid etch and optical/SEM inspection before micro-probing the flash bus.
Step 3 — Firmware Extraction & Verification
We read out the full flash contents (including the BLE stack area if applicable), perform a CRC-32 integrity check, and compare against a second independent readout to ensure bit-perfect accuracy. The delivered file is a standard Intel HEX or raw binary.
Step 4 — Delivery & Documentation
You receive the firmware binary, a brief technical report noting the protection level encountered and the method used, and — if requested — a flash memory map showing code, BLE stack, and user-data partitions.
CH579 vs. Related WCH and Domestic-Vendor MCUs
Engineers working with Chinese-domestic RISC-V and ARM MCUs often need unlock services across multiple vendor families. The CH579’s protection architecture shares conceptual similarities with several peers, though implementation details differ significantly.
| MCU Family | Vendor | Core | Protection Levels | Relative Unlock Difficulty |
|---|---|---|---|---|
| CH579 | WCH | RISC-V | 3 (L0/L1/L2) | Moderate |
| GD32F series | GigaDevice | ARM Cortex-M | 2–3 | Moderate–High |
| PY32F series | Puya | ARM Cortex-M0+ | 2 | Low–Moderate |
| MM32 series | MindMotion | ARM Cortex-M | 2 | Moderate |
| N32G series | Nations Tech | ARM Cortex-M4 | 3 | High |
If your product uses a GigaDevice GD32 with similar read protection, the extraction approach overlaps in tooling but diverges at the protocol level. Likewise, Puya PY32 unlock tends to be simpler because Puya’s protection is less granular than WCH’s three-tier scheme.
For projects involving MindMotion MM32 firmware recovery or Nations N32 chip decryption, we often handle these alongside CH579 work in the same engagement, reducing per-device cost when multiple MCU types are involved.
Authorization and Legal Requirements
We perform CH579 unlock exclusively for authorized parties — original equipment designers, IP holders, or maintenance engineers with documented proof of ownership. Before work begins, you sign an NDA and provide one of the following:
- Purchase order or invoice for the original CH579-based product development
- Company letterhead authorization from the IP holder
- Evidence of design ownership (schematics, BOM, or original project files)
This policy protects both parties and ensures compliance with applicable IP law. We decline requests that lack clear authorization documentation.
When CH579 Unlock Makes Business Sense
Common scenarios where CH579 firmware recovery is the right call:
- Lost source code: The original developer left or the repository was corrupted. You need the production binary to continue manufacturing.
- Legacy product maintenance: The CH579-based device is in the field, the firmware needs a minor patch, but no build environment exists.
- Production verification: You suspect a contract manufacturer altered the firmware. A golden-reference readout lets you do a byte-level comparison.
- Second-source qualification: Migrating from CH579 to CH582 or CH592 and need the original binary as a baseline for porting.
Deliverable Formats
| Deliverable | Format | Included by Default |
|---|---|---|
| Raw firmware binary | .bin / .hex | Yes |
| Flash memory map | PDF diagram | Yes |
| Technical report | Yes | |
| Annotated disassembly | .asm / .lst | On request (+$200–$400) |
| BLE stack partition dump | .bin | On request (no extra charge) |
Frequently Asked Questions About CH579 Unlock
Can you unlock a CH579 without destroying the chip?
For Level 0 and most Level 1 protections, yes — the chip remains fully functional after firmware extraction. Level 2 recovery often requires decapping, which is destructive to the package but not always to the die. We always attempt non-destructive methods first and will not proceed to invasive techniques without your explicit approval.
How many sample CH579 chips do I need to send?
We recommend 2–3 units for Level 1 attempts and 3–5 units for Level 2. One unit is consumed during initial probing and technique calibration; the remaining units are used for the actual extraction and verification pass. If you only have one device, we can still attempt recovery but cannot guarantee a second verification readout.
Does CH579 unlock also recover the BLE stack firmware?
Yes. The CH579 stores the BLE stack in a dedicated flash partition (typically the upper 128 KB on the 512 KB variant). Our readout captures the entire flash address space, including the BLE stack, user application, and any data stored in the info-page area.
Is CH579 unlock legal?
Firmware recovery is legal when performed for the authorized IP owner or with their documented consent — for example, recovering your own production firmware after source-code loss. We require proof of ownership before starting any work. Unauthorized extraction of third-party IP is something we do not offer.
What if my CH579 has a custom bootloader?
Custom bootloaders that replace WCH’s default ISP loader can complicate Level 1 bypass techniques that rely on bootloader interaction. In such cases we shift to direct debug-port or semi-invasive methods. The presence of a custom bootloader does not prevent recovery — it simply changes the optimal attack path, and we adjust our quote accordingly.
Related IC Unlock Services
Working with other MCU families alongside the CH579? Explore feasibility pages for chips our engineers handle regularly:
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote