What Is CH643 Unlock and Is It Feasible?
CH643 unlock refers to the authorized extraction of firmware from a WCH CH643 microcontroller whose flash read-out protection (ROP) has been enabled. The CH643 is a RISC-V-based MCU from Nanjing Qinheng Microelectronics, commonly found in USB-PD controllers, LED drivers, and low-cost industrial I/O boards. Our engineers have successfully recovered firmware from multiple CH643 variants using non-invasive debug-interface techniques, with a typical turnaround of 3–5 working days and costs starting around USD 500.
CH643 Security Architecture: What You’re Up Against
Understanding the protection before requesting a CH643 unlock is critical. The CH643 shares much of its security model with other WCH RISC-V parts (CH32V series), but has its own quirks related to its smaller flash geometry and dedicated USB-PD peripheral.
Read-Out Protection Levels
| Protection Level | Debug Access | Flash Readback | Recovery Difficulty |
|---|---|---|---|
| Level 0 (Unprotected) | Full SWD/JTAG | Allowed | Trivial — standard read |
| Level 1 (ROP enabled) | Restricted | Blocked | Moderate — non-invasive methods available |
| Level 2 (Permanent lock) | Fully disabled | Blocked, debug fuses blown | High — may require semi-invasive or invasive approach |
Most CH643 devices in the field use Level 1 protection. WCH’s implementation ties flash readback lockout to a set of option bytes; the debug port remains partially accessible, which gives our team a viable entry path. Level 2 is less common on the CH643 because many designers rely on the default Level 1 and don’t bother with the permanent fuse blow.
Flash and Memory Layout
The CH643 typically integrates 64 KB of flash and 20 KB of SRAM. Its bootloader ROM is factory-programmed and supports UART-based ISP as well as USB download. The option-byte area at offset 0x1FFFF800 controls ROP configuration. When Level 1 is active, the bootloader will still accept erase commands but blocks read-back — a behavior our recovery process specifically accounts for.
How We Perform a CH643 Unlock
Every CH643 unlock engagement follows a structured workflow designed to protect the integrity of your firmware image and your IP rights.
Step 1 — Feasibility Assessment (Free)
You ship one or two sample devices (or a populated PCB). We identify the exact CH643 variant, determine the active ROP level, and confirm whether the debug interface responds. This stage takes 1–2 working days and costs nothing. If recovery isn’t feasible, we tell you upfront — no charge.
Step 2 — Protection Bypass
For Level 1 devices, our engineers use a proprietary non-invasive technique targeting the WCH debug protocol’s handshake sequence. This does not require decapping or FIB (focused ion beam) work. The chip remains physically intact and fully functional after extraction.
For Level 2 (rare on CH643), we may escalate to a semi-invasive approach involving glitch injection on the power rail during the boot sequence. Success rates for Level 2 are lower — roughly 60–75 % depending on silicon revision — and we quote these jobs on a case-by-case basis.
Step 3 — Firmware Dump and Verification
Once readback access is restored, we dump the full flash contents (up to 64 KB) plus option bytes. We then perform a CRC-32 check against a second independent read to confirm bit-for-bit consistency. You receive a verified Intel HEX or binary file.
Step 4 — Delivery and Confidentiality
Firmware files are delivered via encrypted transfer. Every project operates under NDA. We return your original sample devices along with the extracted data. Proof of ownership or written authorization from the IP holder is required before we begin — see our authorization and NDA policy for details.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCH643 Unlock Cost and Turnaround
| Scenario | Typical Cost (USD) | Turnaround | Notes |
|---|---|---|---|
| Level 0 (unprotected read) | 150–250 | 1–2 days | Standard dump, minimal effort |
| Level 1 (ROP bypass) | 500–900 | 3–5 working days | Non-invasive; most common scenario |
| Level 2 (permanent lock) | 1,200–2,500 | 7–15 working days | Semi-invasive; success not guaranteed — quoted per project |
| Rush service (Level 1) | +40 % surcharge | 1–2 working days | Subject to lab availability |
Pricing depends on the protection level, the quantity of unique firmware images needed, and whether the chip must be desoldered from a populated board. Volume discounts apply when you need identical firmware extracted from 5+ units for production recovery.
When Does CH643 Unlock Make Sense?
Not every situation warrants firmware extraction. Here are the most common legitimate use cases our clients bring to us:
- Lost source code: Original developer left, repo corrupted, or company acquisition without proper IP transfer.
- Legacy product maintenance: You need to patch or re-flash units in the field but the binary is gone.
- Second-source qualification: Verifying that a contract manufacturer programmed the correct firmware revision.
- Failure analysis: Reading back firmware from a failed unit to compare against the known-good image.
We do not perform CH643 unlock for the purpose of copying third-party proprietary firmware. Authorization documentation is a hard prerequisite.
CH643 vs. Other WCH RISC-V Parts
WCH produces several RISC-V MCU families. The CH643 shares silicon lineage with the CH32V series, but its protection implementation differs in option-byte layout and bootloader behavior. If your design also uses parts from other Chinese domestic vendors, we handle those too — for example, Artery AT32F403 firmware recovery and HDSC HC32F460 extraction follow similar non-invasive workflows adapted to each vendor’s debug protocol.
Cross-Vendor Comparison
| MCU | Vendor | Core | Typical ROP Levels | Non-Invasive Success Rate |
|---|---|---|---|---|
| CH643 | WCH | RISC-V | 0 / 1 / 2 | ~90 % (Level 1) |
| AT32F403 | Artery | Cortex-M4 | 0 / 1 | ~95 % |
| HC32F460 | HDSC | Cortex-M4 | 0 / 1 / 2 | ~85 % |
| STM32F072 | ST | Cortex-M0 | 0 / 1 / 2 | ~92 % |
| N32G45x | Nations | Cortex-M4 | 0 / 1 / 2 | ~88 % |
If you’re working with Nations Semi parts, our N32G45 unlock service covers the full family including N32G451, G452, G455, and G457 variants.
What Can Go Wrong
Transparency matters. Here are real failure modes we’ve encountered during CH643 unlock projects:
- Blown debug fuses (Level 2): If the OEM permanently disabled the debug port, non-invasive methods won’t work. We escalate to glitch-based techniques, but success isn’t certain.
- Corrupted flash: On aged or ESD-damaged units, the flash contents may read back with bit errors. We flag these with CRC mismatches and can attempt multiple reads to reconstruct a clean image.
- Custom bootloader overlay: Some CH643 designs replace the factory bootloader with a custom one that adds its own encryption layer. This requires additional reverse-engineering time and increases cost.
- Package damage during desoldering: QFN-packaged CH643 variants are sensitive to rework temperatures above 260 °C. We use low-profile hot-air profiles to minimize risk, but pad-lift on cheap 2-layer boards is an occasional issue.
Deliverables You Receive
| Deliverable | Format | Included |
|---|---|---|
| Full flash dump | .hex / .bin | Always |
| Option bytes | .hex / text report | Always |
| SRAM snapshot (if requested) | .bin | On request |
| CRC verification report | Always | |
| Re-programming support | WCHISPTool project file | On request |
If you also need the firmware disassembled or ported to a pin-compatible replacement MCU, we offer that as an add-on service. For broader board-level recovery — schematic extraction, Gerber generation, BOM reconstruction — see our full PCB reverse-engineering service.
Related IC Unlock Services
Many multi-MCU designs pair a WCH controller with an STM or PIC device. We routinely handle mixed-vendor boards in a single project. Explore related chip unlock pages:
Can the CH643 be unlocked without destroying the chip?
Yes. For Level 1 protection — the most common configuration — our non-invasive debug-port technique leaves the chip fully functional. The device can be re-used, re-programmed, or returned to service after extraction. Level 2 devices may require semi-invasive methods, but even those typically preserve the die.
Do I need to prove ownership before you start a CH643 unlock?
Absolutely. We require either proof of original purchase, a signed declaration of IP ownership, or written authorization from the rights holder. This protects both parties and ensures the work is legally defensible. Every engagement is covered by NDA.
How does CH643 ROP compare to STM32 RDP?
Both use a tiered model (Level 0/1/2), but WCH’s implementation on the CH643 has a narrower option-byte structure and a different bootloader handshake. In practice, CH643 Level 1 is slightly easier to bypass than STM32 RDP Level 1 because WCH’s debug protocol retains more functionality in the restricted state. Level 2 difficulty is comparable across both vendors.
What if my CH643 firmware is encrypted by a custom bootloader?
We can still extract the raw flash contents, but the binary will be encrypted. Decrypting it requires reverse-engineering the bootloader’s key schedule, which adds 5–10 working days and increases cost by roughly 40–60 %. We assess feasibility during the free evaluation stage.
Can you re-program a blank CH643 with the extracted firmware?
Yes. We can provide a WCHISPTool-compatible project file and program replacement CH643 devices for you, or supply the binary so your own production line can handle it. Volume programming pricing starts at USD 2 per unit for batches of 100+.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote