What Is an IC Decipher Service?
An IC decipher service is a specialized engineering process that recovers firmware from microcontrollers whose read-protection fuses or encryption have been enabled. When a chip’s code-protect bits are set, standard programmers return all 0xFF or 0x00—making the stored program inaccessible through normal JTAG, SWD, or ISP interfaces. Our engineers use a combination of semi-invasive and non-invasive techniques to bypass these protections and deliver the original binary as a verified .hex or .bin file. This is authorized recovery work performed under NDA for clients who own the IP or need legacy maintenance on their own hardware.
Why Firmware Becomes Inaccessible
Chip manufacturers implement protection to prevent casual copying. Understanding the mechanism matters because it determines the deciphering approach, timeline, and cost.
| Protection Type | How It Works | Common Families | Decipher Difficulty |
|---|---|---|---|
| Security fuse bit | A one-time-programmable fuse disables external read | PIC16/18, ATmega, AT89C | Low–Medium |
| Read-protection level (RDP) | Multi-level lock (Level 0/1/2) blocks debug port | STM32F1/F4, GD32, NXP LPC | Medium–High |
| Code-guard / Secure Boot | Encrypted flash with key stored in OTP | dsPIC33, TI C2000, Renesas RX | High |
| EEPROM lock bits | Separate lock register protects data memory | Atmel AT24Cxx, Microchip 93LCxx | Low |
| CPLD bitstream encryption | AES-encrypted configuration stream | Altera MAX II, Xilinx XC9500 | Medium–High |
Security-fuse-based protection on 8-bit parts is the most commonly deciphered category. Level-2 RDP on newer Cortex-M4 devices is significantly harder and may require die-level techniques. We assess every chip individually before quoting—no blanket promises.
How Our IC Decipher Process Works
Step 1 — Free Feasibility Evaluation
Send us the chip part number (full marking, including revision letter), a photo of the package, and a brief description of why you need the firmware. Our team cross-references the device against an internal database of 4,000+ previously analyzed MCUs and returns a feasibility assessment—typically within one business day. There is no charge and no obligation at this stage.
Step 2 — Ship the Target IC
If feasibility is confirmed, ship one or more sample chips. We recommend sending at least two units: one for primary work and one as a backup in case the die is damaged during decapsulation. Shipping via DHL or FedEx with declared value keeps transit under five days for most international origins.
Step 3 — Deciphering and Readout
Our engineers select the appropriate attack vector. For fuse-locked 8-bit MCUs (PIC, AVR, 8051 variants), non-invasive voltage-glitch or UV-exposure methods are attempted first because they leave the die intact. Semi-invasive methods—microprobing after chemical or laser decapsulation—are used when non-invasive routes fail or when the protection is multi-layered. The extracted binary is read out via a calibrated programmer and saved in Intel HEX or raw BIN format.
Step 4 — Verification
We program the extracted file into a blank chip of the same part number and compare functional behavior against the original. If you supply a reference schematic or test procedure, we can perform application-level verification as well. Checksum and byte-count reports are included with every delivery.
Step 5 — Secure Delivery
The firmware file is delivered via encrypted link or secure email. All working samples and intermediate data are destroyed or returned per your NDA terms. Typical end-to-end turnaround is 5–15 working days, depending on chip complexity.
Which Chips Can Be Deciphered?
No lab can honestly claim 100% success across every silicon revision. Here is a realistic breakdown of what our IC decipher service covers and where the boundaries are.
| MCU Family | Typical Success Rate | Turnaround (Working Days) | Notes |
|---|---|---|---|
| Microchip PIC10/12/16/18 | 95%+ | 5–8 | Most fuse-locked variants recoverable |
| Atmel/Microchip ATmega / ATtiny | 90%+ | 5–10 | Newer ATmega4809 series harder |
| STC / AT89S / AT89C (8051) | 95%+ | 3–7 | Mature techniques, high yield |
| STM32F0/F1/F2 (RDP Level 1) | 85–90% | 7–12 | RDP Level 2 requires case-by-case eval |
| STM32F4/F7/H7 (RDP Level 2) | 50–70% | 10–20 | Die-level work; higher cost |
| NXP LPC1100/1300/1700 | 80–90% | 7–12 | CRP levels 1–3 vary in difficulty |
| TI MSP430 (JTAG fuse) | 85%+ | 7–10 | Fuse-blown BSL variants included |
| Renesas RL78 / RX | 70–85% | 10–15 | ID-code-locked parts need extra steps |
| Freescale/NXP MC9S08/12 | 85%+ | 7–10 | Backdoor key recovery often viable |
If your target device is not listed, submit it for evaluation. We regularly add new families—our engineers have deciphered over 4,000 unique part numbers to date. For EEPROM and serial-flash devices, our EEPROM readout service covers I²C and SPI memory ICs specifically.
IC Decipher vs. Related Services
Terminology in this field is inconsistent. Here is how our IC decipher service relates to other offerings you may encounter.
- IC decipher / IC unlock — Same core process: bypass read protection and extract firmware. “Decipher” emphasizes the decoding of protection; “unlock” emphasizes restoring access. Our IC unlock and firmware recovery hub covers the full range.
- Code extraction — Broader term that includes reading unprotected chips. When the chip is locked, code extraction requires deciphering first. See our dedicated code extraction service page for details.
- Read-protection bypass — Specifically targets the RDP/CRP mechanism. Relevant for STM32 and NXP parts where multi-level locks are the primary barrier. More on this at our read-protection bypass overview.
- Chip cloning — A downstream step: after deciphering, the firmware is programmed into a blank replacement IC. Deciphering is the prerequisite.
What You Receive
- Firmware file in Intel HEX (.hex) and/or raw binary (.bin) format
- Fuse/configuration-bit dump (where applicable)
- EEPROM data dump (if the chip has separate EEPROM and it was populated)
- Verification report: checksum, file size, and functional-test notes
- Optional: programmed replacement chip for immediate drop-in use
Authorization and Legal Framework
We perform IC decipher work exclusively for authorized purposes: recovering firmware from your own products, maintaining legacy equipment you own, or supporting R&D on prototypes your company designed. Every project begins with a signed NDA and a declaration of ownership or authorized use. We reserve the right to decline any request that does not meet these criteria. For full details on our compliance approach, see our trust and authorization policy.
Pricing Signals
Exact pricing depends on the chip family, protection level, and quantity. As a general guide:
| Category | Starting Price (USD) | Typical Range |
|---|---|---|
| 8-bit fuse-locked (PIC/AVR/8051) | $150 | $150–$500 |
| 16-bit MCU (MSP430, dsPIC) | $300 | $300–$800 |
| 32-bit Cortex-M (RDP L1) | $500 | $500–$1,500 |
| 32-bit Cortex-M (RDP L2 / advanced) | $1,000 | $1,000–$3,000+ |
| CPLD / FPGA bitstream | $800 | $800–$2,500 |
No fee is charged if the decipher attempt fails. You pay only for a successful, verified readout.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
How long does an IC decipher service typically take?
Most 8-bit and 16-bit MCUs are completed in 5–10 working days. Complex 32-bit devices with Level 2 read protection may require 10–20 working days. We confirm the expected timeline during the free feasibility evaluation before you ship any parts.
Will the original chip be destroyed during deciphering?
Non-invasive methods (voltage glitching, UV exposure) leave the die intact. Semi-invasive methods that require decapsulation will destroy the package, though the die itself may survive. We always recommend sending a backup chip. If the original must be preserved, let us know—we will restrict our approach accordingly, though this may reduce the success probability.
Can you decipher a chip if I only have the assembled PCB?
Yes. Our technicians can desolder the target IC from your board using hot-air rework, perform the readout, and either resolder or replace it. Board-level handling adds 1–2 days and a small surcharge. For broader firmware recovery from assembled boards, our firmware recovery service covers the full workflow.
Is IC deciphering legal?
Recovering firmware from a chip you own or are authorized to maintain is legal in most jurisdictions under repair and interoperability provisions. We require proof of ownership or a letter of authorization before starting any project. Unauthorized duplication of third-party IP is outside the scope of our service.
What if the decipher attempt fails?
You pay nothing. We absorb the engineering time and return your chips. Failure is uncommon on well-characterized families (under 5% for 8-bit parts) but can happen with newer silicon revisions or parts with die-level countermeasures we have not previously encountered.
Related IC Recovery Services
- Break IC service with free feasibility check
- Code extraction from locked chips
- EEPROM readout for serial memory ICs
- Read-protection bypass for STM32 and NXP
- Firmware recovery from assembled boards
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote