What Is Firmware and Hardware Reverse Engineering?
Firmware and hardware reverse engineering is the systematic process of recovering both the physical design data (schematic, Gerber, BOM) and the embedded software (firmware binary, configuration data) from an existing electronic assembly. The hardware side uses optical scanning, X-ray imaging, and electrical probing to reconstruct every copper layer, component placement, and net connection. The firmware side reads out the binary stored in microcontrollers, EEPROMs, or flash ICs — then disassembles or decompiles it so the logic can be understood, ported, or maintained. Together, these two halves give you everything needed to replicate, repair, or redesign a board that has no surviving documentation.
Why You Need Both Halves — Not Just One
Hardware-only recovery gives you a bare PCB you can fabricate, but without firmware the board is inert. Firmware-only extraction gives you code with no target to run on if the original board fails. Treating them as a single engagement eliminates version-mismatch risk and cuts overall turnaround by 30–40 % compared to splitting the work across two vendors.
Common Scenarios That Demand the Full Package
- Legacy equipment support — the OEM is defunct, spares are unavailable, and you need both a replacement board and its operating code. This is common in CNC drives and legacy controller systems.
- Product redesign — migrating a proven design to a new MCU family while preserving behavioral parity requires understanding both the circuit and the control algorithms.
- Failure analysis — determining whether a field failure is a hardware fault or a firmware bug requires correlated access to both domains.
- Authorized cloning — reproducing your own proprietary board for a second-source production run, including all programmed ICs.
How Firmware and Hardware Reverse Engineering Works — Step by Step
Phase 1: Incoming Inspection & Feasibility
Our engineers photograph the board under magnification, catalog every IC marking, and run a preliminary continuity check. For firmware, we identify programmable devices — MCU, CPLD, serial flash, EEPROM — and assess read-protection status. Feasibility turnaround is typically 1–2 working days. If a chip’s fuse bits are locked, we state the realistic unlock probability before you commit.
Phase 2: Physical Board Recovery (Hardware)
The board is optically scanned at 1200+ DPI per layer. Multi-layer boards (4–16+ layers) undergo controlled delamination or micro-sectioning to expose inner copper. X-ray imaging resolves BGA pad connections and buried vias. From this data, our CAD team rebuilds the schematic and Gerber files in Altium or KiCad, then performs a netlist-vs-board audit to catch every discrepancy.
Typical tolerances: trace/space accuracy ±0.5 mil (0.0127 mm) for standard boards, ±1.0 mil for aged or corroded specimens. Impedance-critical nets are annotated with measured stackup data so the fabricator can match the original Dk/Df profile.
Phase 3: Firmware Extraction
Depending on the device, extraction follows one of several paths:
| Device Type | Method | Typical Success Window |
|---|---|---|
| Unprotected MCU (e.g., ATmega with no lock bits) | ISP / JTAG / SWD direct read | > 99 % |
| Protected MCU (e.g., STM32 RDP Level 1) | Glitch attack / debug-port exploit | 85–95 % depending on silicon revision |
| Protected MCU (RDP Level 2, PIC CRP3) | Decap + micro-probing / UV / FIB | 40–75 %, case-dependent |
| Serial Flash / EEPROM (25-series, 24Cxx) | In-circuit or socket read | > 99 % |
| CPLD / small FPGA (non-encrypted bitstream) | JTAG readback | ~90 % |
| FPGA with AES-encrypted bitstream | Generally not feasible without key | < 5 % |
All firmware work requires proof of ownership or written authorization. We operate under NDA, and every engagement is documented for IP compliance — see our full-service reverse engineering overview for process and legal details.
Phase 4: Firmware Analysis & Documentation
Raw binary is disassembled (ARM Cortex via Ghidra/IDA, 8051 via dedicated toolchains) and annotated with peripheral-register mappings derived from the recovered schematic. We deliver a commented assembly listing or, where feasible, a pseudo-C reconstruction. Configuration tables (calibration constants, PID coefficients, communication baud rates) are extracted into a separate reference document.
Phase 5: Verification & Deliverables
A newly fabricated board is assembled and programmed with the recovered firmware. Functional testing confirms power-on behavior, communication interfaces (UART, SPI, CAN, Ethernet), and actuator outputs match the original. Only after this bench verification do we release final files.
Deliverable Formats at a Glance
| Deliverable | Format | Included By Default |
|---|---|---|
| Schematic | Altium .SchDoc / KiCad .kicad_sch / PDF | Yes |
| Gerber files | RS-274X + drill (Excellon) | Yes |
| Bill of Materials | .xlsx with MPN, value, package, alternates | Yes |
| Firmware binary | .hex / .bin / .s19 | Yes |
| Disassembly listing | Annotated .asm / .c pseudo-code + PDF | On request |
| Pick-and-place data | .csv (centroid + rotation) | Yes |
| Stackup & impedance notes | PDF + fabrication notes | For ≥ 4-layer boards |
Turnaround, Pricing Signals, and What Affects Both
A combined firmware and hardware reverse engineering engagement on a 4-layer board with one unprotected MCU typically runs 10–15 working days. Complex projects — 8+ layers, multiple protected ICs, BGA-dense layouts — can extend to 20–30 working days.
Pricing depends on layer count, board area, component density, and firmware protection level. A straightforward 2-layer board with a serial-flash read starts around $600–$900 for the full package. A 10-layer industrial controller with a protected ARM Cortex MCU and CPLD bitstream can reach $3,000–$6,000+. We provide a binding quote after the feasibility assessment — no surprises.
Industry Applications
Firmware and hardware reverse engineering serves nearly every sector where embedded electronics age out of vendor support:
- Automotive — recovering ECU firmware and board layouts for discontinued engine or body controllers. Our automotive ECU reverse engineering guide covers protocol-specific challenges like CAN-FD and LIN.
- Industrial automation — restoring CNC controller boards and PLC I/O modules where a single failed card halts a production line.
- Marine & agriculture — salt-corroded boards on vessels or field equipment often need both physical repair data and firmware recovery for agricultural control systems that run proprietary calibration tables.
- Consumer & appliance — reproducing control boards for product lines still in warranty but past the OEM’s component lifecycle.
What Can Go Wrong — Honest Constraints
No responsible provider promises 100 % success on every chip. Here are the realistic failure modes our engineers encounter:
- Irreversible read protection — some MCUs (e.g., STM32 RDP Level 2, Renesas RH850 with ICU-S) permanently disable debug access. Decap micro-probing may still recover data, but success rates drop below 50 % and cost rises significantly.
- Corroded or delaminated inner layers — boards exposed to moisture or thermal cycling can lose copper continuity on inner layers, requiring interpolation from partial data. We flag every interpolated net in the deliverables.
- Encrypted FPGA bitstreams — Xilinx and Intel FPGAs with AES-256 key storage in battery-backed SRAM are effectively unrecoverable if the key is lost.
- One-time-programmable (OTP) fuses — certain security fuses cannot be reversed without destructive silicon analysis, which may render the original device unusable.
We communicate these risks during the feasibility phase so you can make an informed go/no-go decision before committing budget.
Frequently Asked Questions
Is firmware extraction legal?
Yes, when performed on devices you own or are authorized to service. Common lawful scenarios include legacy maintenance, second-source manufacturing of your own product, and failure analysis. We require proof of ownership or a signed authorization letter before starting any firmware work, and every project is covered by NDA.
Can you reverse engineer a board if the MCU is destroyed?
The hardware (schematic, Gerber, BOM) can still be fully recovered from the physical board. Firmware, however, must be read from a functioning or at least electrically intact IC. If you have a second unit — even a partially working one — we can often extract the binary from that sample while recovering the PCB data from the damaged board.
How do you handle boards with multiple programmable ICs?
Each programmable device is assessed individually during feasibility. A board might carry an ARM MCU, a serial flash holding configuration data, and a CPLD — each requires a different extraction method and may have a different protection level. We quote per-device and report per-device success probability.
What if I only need firmware, not the full board?
We offer standalone firmware extraction. However, having the recovered schematic dramatically speeds firmware analysis because peripheral mappings, clock trees, and I/O assignments are already documented. Bundling both typically saves 20–30 % over separate engagements.
Do you support boards from specific industries like elevators or semiconductors?
Yes. We regularly work on elevator control boards and semiconductor equipment PCB recovery projects, among many other verticals. Industry-specific safety standards (EN 81 for elevators, SEMI S2 for fab equipment) are noted in our deliverables where applicable.
Start Your Firmware and Hardware Reverse Engineering Project
Send us clear photos of both sides of your board plus any known IC part numbers. Our engineers will return a feasibility report — including firmware read-protection assessment — within 1–2 business days, at no cost.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote