Invasive vs Non-Invasive IC Unlock | Cost & Risk

When you need to recover firmware from a protected microcontroller or memory IC you legally own, the first engineering decision is whether to pursue an invasive vs non-invasive IC unlock. The two approaches differ dramatically in cost, chip-survival rate, turnaround time, and applicable chip families. Choosing wrong can destroy the only sample you have or waste weeks on a method that was never viable for that specific protection scheme.

Invasive IC unlock physically opens the chip package and directly accesses the silicon die—using chemical decapping, micro-probing, or laser techniques. Non-invasive IC unlock exploits electrical, timing, or protocol-level weaknesses in the chip’s security without removing the package. Each has clear strengths and hard limits. Below, our engineers break down both paths with real numbers so you can make an informed decision before committing a sample.

What Is Non-Invasive IC Unlock?

Non-invasive methods keep the chip package intact. The IC remains functional after the procedure, which means the same sample can be retested, reprogrammed, or returned to a working board. Common non-invasive techniques include:

• Voltage glitching / power analysis: Injecting precisely timed voltage spikes (typically 3–50 ns pulses) during boot or security-check routines to bypass read-protection fuses.
• Debug-port exploitation: Using JTAG, SWD, or proprietary debug interfaces with modified command sequences that circumvent lock bits—effective on certain STM32, GD32, and Microchip SAM families.
• Protocol-level readout: For serial EEPROMs and SPI flash (24Cxx, 93Cxx, W25Qxx, SST25VF series), the “protection” is often a software write-protect or OTP bit that can be cleared or bypassed through specific command sequences without touching the die.
• UV exposure (semi-invasive edge case): Older OTP MCUs with windowed packages or thin-mold compounds can have fuse bits reset with controlled UV light. This sits on the boundary between non-invasive and semi-invasive.

Non-invasive IC unlock is the default first choice whenever the chip’s protection architecture has a known electrical weakness. For serial EEPROMs like the 24C256 or SPI flash like the W25Q64, non-invasive readout is almost always sufficient because these devices rely on simple lock registers rather than hardware-fused encryption.

What Is Invasive IC Unlock?

Invasive IC unlock requires physically exposing the silicon die. The package is removed—usually by chemical decapping with fuming nitric acid (HNO₃) or sulfuric acid (H₂SO₄) at 80–120 °C—to access bond pads, fuse arrays, or memory cells directly. From there, engineers may:

• Micro-probe the memory bus: Using tungsten needle probes (tip radius ≤ 1 µm) on a probe station to read data lines while the chip executes.
• Laser fault injection (LFI): A focused infrared laser (1064 nm typical) targets specific transistors to flip security bits or bypass read-protection logic.
• Focused Ion Beam (FIB) editing: Cutting or reconnecting metal traces on the die to disable protection circuits—used on high-security MCUs with active mesh shields.
• ROM / flash optical readout: For mask-ROM devices, imaging the die with a high-magnification optical or SEM microscope and reconstructing the bit pattern from cell geometry.

Invasive methods are necessary when the chip has robust hardware protection—encrypted flash, active tamper meshes, or blown eFuses that cannot be electrically reset. Chips like the nRF52840 with its APPROTECT mechanism or the STM32WB55 with dual-core security partitioning often require at least semi-invasive analysis to evaluate the protection level before a full invasive attempt.

Invasive vs Non-Invasive IC Unlock: Side-by-Side Comparison

When to Choose Non-Invasive Methods

Non-invasive IC unlock is the right starting point when:

• The chip is a serial EEPROM or SPI/I²C flash with register-based protection—devices like the 93C56, M95080, or AT24C-series parts.
• You have only one sample and cannot afford to lose it.
• The MCU uses a known-vulnerable read-protection level (e.g., STM32 RDP Level 1, GD32 SWD-lock without mass-erase enforcement).
• Budget is under $2,000 and turnaround must be under two weeks.
• The goal is full firmware extraction with the chip returned intact for reinstallation.

For many Microchip SAM-family devices—such as the SAMD20 or EFM32HG—non-invasive glitching on the SWD interface has a documented success path that our lab has validated across multiple silicon revisions.

When Invasive Methods Become Necessary

Invasive IC unlock is warranted when:

• The chip enforces RDP Level 2 (permanent, non-reversible lock) or equivalent hardware fuse—no electrical bypass exists.
• Encrypted flash is paired with a unique device key stored in OTP eFuses—reading the flash alone yields ciphertext without the key.
• Active tamper-detection meshes or voltage/frequency monitors immediately trigger memory wipe on any glitch attempt.
• The device is a mask-ROM part where the program is literally baked into the metal layers—there is no electrical read path at all.
• Non-invasive attempts have already been exhausted on a previous sample without success.

Chips at the 40 nm process node and below tend to have denser metal stacks (8–10 layers), making micro-probing significantly harder and increasing the need for FIB milling to reach target layers. This is a major cost driver: FIB time alone can run $300–$800 per hour, and complex edits may require 10–30 hours.

Cost Breakdown: What Drives the Price Difference?

Non-Invasive Cost Factors

Labor is the primary cost. A senior engineer spends 4–20 hours developing and executing a glitch attack or debug-port exploit. Equipment amortization is low because the tools (oscilloscopes, glitch boards, JTAG adapters) cost $5,000–$50,000 total—shared across hundreds of projects. Consumables are negligible.

Invasive Cost Factors

Equipment overhead is enormous. A FIB system costs $500,000–$2,000,000; a probe station with nanometer-precision stages runs $100,000–$400,000. Chemical decapping requires fume hoods, acid-resistant fixtures, and disposal compliance. Each failed attempt consumes a sample chip (replacement cost varies from $0.50 for a commodity EEPROM to $50+ for a BGA MCU). Multiple iteration cycles are common.

Typical Project Costs

Risk Assessment: What Can Go Wrong?

Non-Invasive Risks

• Mass-erase trigger: Some MCUs (e.g., STM32 at RDP Level 1) will erase all flash if the unlock sequence is detected as unauthorized. A failed glitch timing can trigger this, wiping the firmware permanently.
• Fuse escalation: Certain chips auto-promote to a higher protection level after a set number of failed debug attempts, locking out further non-invasive tries.
• Partial read: Voltage glitching may yield corrupted bytes. Without checksum verification, you may get a dump that looks complete but contains bit errors in 1–5% of addresses.

Invasive Risks

• Die damage during decapping: Over-etching with acid can dissolve bond wires or damage the top metal layer. Success rate for clean decaps on QFN/BGA packages is roughly 70–85%.
• Probe-induced shorts: Micro-probing on sub-micron features risks bridging adjacent traces, causing immediate die failure.
• Incomplete data: If the flash is encrypted and the key fuse is destroyed during decapping, the extracted data is useless without a separate key-recovery step.
• Irreversibility: Once the package is opened, the chip cannot be reused in production. Plan for this in your sample budget.

Our Engineers’ Decision Framework

At PCB-Copy.com, we follow a strict triage protocol for every IC unlock project that comes through our lab:

1. Identify the exact part number and silicon revision. Protection varies between revisions—an STM32F103C8 Rev Y behaves differently from Rev Z under glitch attacks.
2. Check our internal database of 2,000+ previously attempted chip families for known non-invasive paths.
3. Attempt non-invasive first on Sample #1 whenever a viable path exists. If it fails, the chip is typically still intact for a second attempt or escalation.
4. Escalate to invasive only with client approval, additional samples (minimum 2 spares), and signed proof of ownership / authorization.
5. Report honestly if neither method is likely to succeed. We decline projects where the expected success rate is below 40%—no point burning your budget and samples.

Authorization is mandatory for all IC unlock work. We require proof of design ownership, a signed NDA, and documented legitimate purpose before any project begins. Details on our verification process are available on our trust and authorization page.

{
“@context”: “https://schema.org”,
“@type”: “Article”,
“headline”: “Invasive vs Non-Invasive IC Unlock: Cost, Risk, and Decision Framework”,
“description”: “A detailed engineering comparison of invasive and non-invasive IC unlock methods, covering cost ranges, success rates, chip-survival risk, and decision criteria.”,
“url”: “https://pcb-copy.com/invasive-vs-non-invasive-ic-unlock/”,
“publisher”: {
“@type”: “Organization”,
“name”: “PCB-Copy.com”
}
}

Related reading

• Oct 2026ATSAM3 Unlock | Feasibility, Cost & Lead Time
• Oct 2026MSP430 IC Unlock | Which Families We Can Read
• Oct 2026AT90 Crack | Protection Levels & Firmware Recovery