How Much Does Firmware Extraction Cost?
Firmware extraction cost typically ranges from $200 to $5,000+ per device, depending on three variables: the target IC’s protection scheme, the memory technology involved, and whether the chip can survive the process intact. Unprotected serial EEPROMs like a 24C64 or 93C56 sit at the low end—often $200–$500—while a locked Cortex-M4 MCU with multi-level read-protection can push past $3,000. Below, our engineers break down exactly what drives the price, what’s realistic, and where projects stall.
What Determines Firmware Extraction Cost?
1. Protection Level of the Target IC
This single factor accounts for the widest cost swing. Chips fall into roughly four tiers:
| Protection Tier | Examples | Typical Cost Range | Success Likelihood |
|---|---|---|---|
| No protection / OTP fuse not set | AT24C512, W25Q64, M95080 | $200 – $500 | >98 % |
| Software read-protect (RDP Level 1, CRP1) | STM32F1xx, GD32E230, LPC1xxx | $500 – $1,500 | 85–95 % |
| Hardware fuse / advanced RDP (Level 2, APPROTECT) | STM32WB55, nRF52840, EFM32PG | $1,500 – $4,000 | 50–80 % |
| Secure-boot / encrypted flash / TrustZone | SAME54 (TrustZone), newer Nordic parts | $3,000 – $8,000+ | Case-by-case |
A chip like the Winbond W25Q64 stores firmware in external SPI flash with no on-die code-read protection, so extraction is a straightforward SOIC-8 clip-and-read operation. Compare that to the nRF52840, where Nordic’s APPROTECT mechanism requires a voltage-glitch or debug-port exploit—raising both engineering hours and firmware extraction cost substantially.
2. Memory Type and Package
Serial EEPROMs (I²C, SPI, Microwire) are the least expensive to read. Standard SOIC-8 or TSSOP packages allow in-circuit or socket-based readout in minutes. BGA-packaged NOR flash or stacked-die MCUs may need reballing or decapsulation, adding $150–$400 in preparation alone.
3. Chip Condition and Sample Count
Invasive techniques—decapsulation, micro-probing, FIB editing—carry a non-zero risk of destroying the die. If you supply only one sample and it fails, recovery is impossible. We recommend providing at least two units for any MCU with Level 2 or higher protection. Extra samples don’t double the cost; they typically add 15–25 % to cover additional prep.
4. Output Format and Verification
Most clients need a raw binary (.bin) or Intel HEX file. If you also need a disassembled listing, annotated memory map, or verification burn onto a blank chip, expect a $100–$300 add-on depending on firmware size (common range: 32 KB – 2 MB).
Firmware Extraction Cost by Chip Family
The table below reflects starting prices our lab quotes for authorized firmware recovery. Actual quotes depend on batch size, protection state, and chip revision.
| Chip / Family | Architecture | Starting Price | Turnaround (Working Days) |
|---|---|---|---|
| 24C64 / 24C256 EEPROM | I²C serial | $200 | 2–3 |
| 93C56 EEPROM | Microwire serial | $200 | 2–3 |
| AT24C512 | I²C serial | $250 | 2–4 |
| M95080 (SPI EEPROM) | SPI serial | $200 | 2–3 |
| W25Q64 (SPI Flash) | SPI NOR | $250 | 2–4 |
| SST25VF series | SPI NOR | $250 | 2–4 |
| GD32E230 | Cortex-M23 | $600 | 5–10 |
| EFM32G / EFM32HG | Cortex-M0+ | $700 | 5–12 |
| SAMD10 / SAMD20 | Cortex-M0+ | $600 | 5–10 |
| STM32WB55 | Cortex-M4 + M0+ (BLE) | $1,500 | 10–20 |
| nRF52840 | Cortex-M4F (BLE) | $1,800 | 10–25 |
| SAME54 | Cortex-M4F (TrustZone) | $2,500 | 15–30 |
| XC866 (8051-based) | 8-bit proprietary | $800 | 7–14 |
For Infineon’s legacy XC866 microcontroller, the proprietary flash-lock mechanism requires a family-specific attack vector that differs from standard ARM read-protection—hence the moderate cost despite an 8-bit core.
What Affects Turnaround Time?
- Queue depth: Standard queue is first-come, first-served. Rush service (1–3 day turnaround on EEPROM reads) is available at 1.5× the standard rate.
- Feasibility study: For locked MCUs, we often run a paid feasibility assessment ($100–$300, credited toward the full job) before committing to extraction. This takes 3–5 working days.
- Decapsulation scheduling: Acid decap or laser decap slots are batched weekly. If your chip needs physical die access, add 3–7 days for scheduling alone.
- Shipping: International sample shipping adds 3–7 days each way. We accept DHL, FedEx, and UPS with declared-value customs documentation.
When Firmware Extraction Fails—and What It Costs You
Not every extraction succeeds. Chips with RDP Level 2 set (STM32 families), blown JTAG fuses, or encrypted secure-boot chains may resist all known non-invasive and semi-invasive attacks. In those cases:
- The feasibility fee is non-refundable—it covers real lab time.
- If we proceed to a full attempt and the chip is destroyed without successful readout, the extraction fee is partially refundable (typically 40–60 %, depending on the agreed terms).
- We document every step and share a technical report explaining why the extraction was not possible, which is useful if you need to justify re-design or re-sourcing decisions.
Silicon Foundry-level attacks (FIB circuit editing, ROM readout via electron-beam probing) exist but push costs to $10,000–$50,000 and are outside our standard service scope. We can refer vetted partners for those edge cases.
Authorization and Legal Requirements
All firmware extraction work at our lab requires proof of ownership or written authorization from the IP holder. This is not optional. You will need to sign an NDA and provide documentation such as a purchase order, design-origin letter, or OEM authorization before we begin. Sensitive projects involving EFM32-series chips—like the EFM32PG—or BLE-enabled MCUs receive additional handling protocols to protect your data in transit and at rest.
How to Reduce Your Firmware Extraction Cost
- Identify the exact chip first. A clear part number and revision (e.g., STM32WB55CEU6 Rev Y) lets us quote accurately without a paid identification step.
- Send multiple samples. Two or three units lower per-unit risk and let us attempt non-destructive methods first.
- Bundle with related services. If you also need PCB cloning, schematic capture, or BOM extraction from the same board, bundled projects receive a 10–20 % discount on the firmware portion.
- Choose standard turnaround. Rush fees add 50 % on average. If your timeline allows 10–15 working days, you save meaningfully.
- Share existing documentation. Datasheets, schematics, or partial code you already possess reduce our reverse-engineering hours.
Getting a Quote for Your Project
Every firmware extraction cost quote starts with the chip part number, the quantity of samples you can supply, and the protection state if known. Upload your board photos or chip markings through our secure portal, and our engineers will return a binding quote within 1–2 working days for standard memory devices or a feasibility proposal within 3–5 days for protected MCUs.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewIs firmware extraction the same as IC unlock?
They overlap but aren’t identical. IC unlock refers specifically to bypassing a microcontroller’s code-read protection so the firmware can be read out. Firmware extraction is the broader term: it includes reading unprotected EEPROMs, flash chips, and locked MCUs alike. Cost for a simple EEPROM read starts around $200, while a full IC unlock on a protected MCU starts at $500–$1,500+.
Can you extract firmware without destroying the chip?
For unprotected serial memory (I²C/SPI EEPROMs, SPI NOR flash), extraction is entirely non-destructive—we clip onto the package or use a socket adapter. For MCUs with software-level read protection, non-invasive glitch or debug exploits often succeed without damage. Hardware-fused or decapped chips carry a 5–20 % destruction risk depending on the technique. We always attempt non-destructive methods first.
What file formats do you deliver?
Standard deliverables include raw binary (.bin), Intel HEX (.hex), or Motorola S-record (.srec). For EEPROM data we can also provide a CSV dump with address-byte mapping. Annotated disassembly listings are available as an add-on for ARM Cortex-M and 8051 architectures.
Do you offer a feasibility assessment before committing?
Yes. For any chip with known or suspected read protection, we offer a paid feasibility study ($100–$300) that evaluates the protection state, identifies the most promising attack vector, and estimates success probability. The fee is credited in full toward the extraction if you proceed. Turnaround for the assessment is 3–5 working days.
How do I prove ownership for authorization?
Acceptable documentation includes original purchase invoices, a signed letter on company letterhead stating you are the design owner or authorized agent, or an OEM authorization letter. We also require a signed NDA before any work begins. If you’re recovering firmware from your own legacy product for re-manufacture or repair, a brief project description usually suffices alongside proof of purchase.
Related chip-level extraction services:
- 24C64 EEPROM readout — one of the most common low-cost extraction targets
- STM32WB55 firmware recovery — dual-core BLE MCU with RDP protection
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote