How Much Does IC Unlock Actually Cost?
IC unlock price typically falls between $150 and $15,000+ per device, depending on the chip’s protection level, package style, and the extraction technique required. Simple EEPROM reads on parts like the 24C64 can land under $300, while a multilayer-fuse ARM Cortex-M with RDP Level 2 may push past $8,000—or require a destructive decap that adds another $2,000–$5,000 in lab costs. The range is wide because no two chips defend their firmware the same way.
Six Factors That Determine Your IC Unlock Price
When our engineers quote a job, they evaluate six variables. Understanding them helps you anticipate costs before you submit a sample.
| Factor | Low-Cost End | High-Cost End |
|---|---|---|
| Protection scheme | Software lock bits, no tamper detect | Hardware fuses, encrypted boot, RDP Level 2, TrustZone |
| Package type | DIP / SOIC — easy probe access | BGA / WLCSP — requires decap or micro-probing |
| Process node | ≥ 180 nm — larger features, established attack paths | ≤ 40 nm — tighter geometry, fewer proven methods |
| Flash / memory size | ≤ 64 KB — fast readout | ≥ 1 MB — longer extraction, more verification passes |
| Chip availability (spare samples) | Client sends 2–3 spares for process calibration | Only one sample exists — zero margin for error |
| Turnaround requirement | Standard 10–20 working days | Rush 3–5 days — premium of 30–80% |
Protection Scheme Is the Biggest Price Driver
A chip secured with a single OTP lock bit can often be bypassed with a voltage-glitch or UV-erase approach in under a day of lab time. That keeps the IC unlock price near the floor. Contrast that with a device like the Nordic nRF52840, which uses ARM CryptoCell-310 and an APPROTECT mechanism—extracting firmware demands specialized fault-injection hardware and multiple calibration runs, pushing costs above $5,000.
Package and Process Node
Micro-probing a 0.18 µm SOIC-packaged MCU is routine. The same task on a 28 nm WLCSP part requires FIB (focused ion beam) circuit editing at $200–$600 per hour of beam time. Our lab budgets 4–12 FIB hours for complex jobs, which alone can add $2,400–$7,200 to the quote.
Sample Availability
When a client ships three identical ICs, we calibrate glitch parameters on sacrificial units, protecting the “golden” sample. When only one chip exists—common in legacy equipment recovery—we proceed more conservatively, adding time and cost. Expect a 20–40% premium for single-sample jobs.
IC Unlock Price Ranges by Chip Family
The table below reflects real quote ranges from our lab over the past 24 months. These are starting points, not guarantees; every job gets a formal feasibility assessment first.
| Chip Family / Type | Typical Price Range (USD) | Typical Turnaround |
|---|---|---|
| Serial EEPROM (24Cxx, 93Cxx, M95xxx) | $150 – $500 | 3 – 7 days |
| SPI Flash (W25Qxx, SST25VF, AT25xxx) | $200 – $600 | 3 – 7 days |
| 8-bit MCU (PIC16/18, ATmega, STC) | $300 – $1,500 | 5 – 12 days |
| Infineon XC800 series (e.g., XC866) | $500 – $2,000 | 7 – 15 days |
| ARM Cortex-M0/M0+ (GD32E230, SAMD10, EFM32HG) | $600 – $3,000 | 7 – 15 days |
| ARM Cortex-M3/M4 (STM32F1/F4, EFM32PG/G) | $800 – $5,000 | 10 – 20 days |
| BLE / Wireless SoC (nRF52840, STM32WB55) | $2,000 – $8,000 | 15 – 25 days |
| High-security MCU (RDP2, TrustZone, encrypted OTP) | $5,000 – $15,000+ | 20 – 40 days |
For a deeper breakdown of how microcontroller families compare, see our guide on why MCU unlock costs differ so much across vendors.
What’s Included in the Quoted Price?
A standard IC unlock engagement from our lab delivers:
- Feasibility assessment — free or low-cost evaluation of the chip’s protection before committing.
- Firmware binary readout — raw .bin or .hex file extracted from the target device.
- Verification report — checksum comparison and, where possible, functional validation on a blank sample.
- NDA coverage — all work performed under a mutual non-disclosure agreement.
Optional add-ons that affect total project cost include disassembly/annotation of the extracted code, netlist recovery from the host PCB (netlist extraction pricing details), and full board cloning if the goal is to reproduce the entire assembly (factors that shape PCB duplication cost).
Why Some Quotes Come Back as “Not Feasible”
Honesty matters more than revenue. Roughly 8–12% of the chips submitted to our lab receive a “not feasible at reasonable cost” verdict. Common reasons:
- The device uses one-time-programmable anti-tamper fuses that physically destroy readout paths when tripped.
- On-chip encrypted storage where the key is derived from a PUF (physically unclonable function) unique to that die.
- Package damage during desoldering that severed bond wires before the chip reached our bench.
We communicate this during feasibility—before you pay for the full extraction—so your budget is protected.
How to Get an Accurate IC Unlock Price Estimate
Speed up your quote by providing:
- Chip part number and revision — markings on the package top, including date codes.
- Number of available samples — more spares = lower risk premium.
- Desired deliverable — binary only, annotated disassembly, or full board clone.
- Proof of ownership or authorization — required for every engagement. This can be a purchase record, design ownership declaration, or a letter from the IP holder.
- Turnaround preference — standard vs. rush.
Submit these details through our quote form and expect a preliminary estimate within one business day.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewReal-World Pricing Examples
EEPROM Read: 24C64 on a Legacy Motor Controller
A European repair shop needed configuration data from a 24C64 EEPROM on a discontinued servo drive. The chip had no write-protection set—our engineer read the full 8 KB via I²C in under an hour. Final cost: $180, delivered in 3 working days.
Cortex-M4 Glitch Attack: EFM32PG on Industrial Sensor
An OEM lost source code for a Silicon Labs EFM32PG-based vibration sensor. The chip had Debug Lock set. Voltage-glitch fault injection required 6 hours of calibration across two spare samples before a clean 256 KB binary was captured from the third. Final cost: $2,800, 12 working days.
BLE SoC: STM32WB55 on a Medical Peripheral
A firmware recovery on an STM32WB55 dual-core BLE module with RDP Level 1. The extraction required both the M4 application core and the M0+ wireless stack. Decap was not needed, but the dual-core readout and verification added complexity. Final cost: $4,200, 18 working days.
Authorization and Legal Requirements
Every IC unlock job in our lab requires documented authorization. We perform firmware extraction only for rightful IP owners, authorized repair facilities, and licensees with written permission. Before work begins, clients sign an NDA and provide proof of ownership. This protects both parties and keeps the engagement legally defensible under trade-secret and IP statutes worldwide.
Frequently Asked Questions About IC Unlock Price
Can I get an IC unlock price without sending the chip first?
Yes. Send us the chip part number, package markings, and a photo of the IC. We can provide a preliminary price range based on known protection schemes for that family. A binding quote follows after physical inspection of your sample.
Is there a fee if the unlock attempt fails?
Feasibility assessment is free or charged at a nominal flat rate (typically $50–$100). If we determine the chip cannot be unlocked, you pay only the assessment fee—not the full extraction price. We never charge for work we cannot deliver.
Why is the price for my ARM chip so much higher than an EEPROM?
EEPROMs rarely have active security—readout is a direct memory dump. ARM Cortex-M devices implement multi-level read-out protection (RDP), debug authentication, and sometimes hardware encryption. Bypassing these defenses requires specialized fault-injection equipment and significantly more engineering time, which drives the IC unlock price up.
Does rush service affect the IC unlock price?
Yes. Rush orders (3–5 working days instead of the standard 10–20) carry a 30–80% surcharge depending on chip complexity. The premium covers dedicated bench time and priority scheduling in our lab queue.
Do you offer volume discounts for multiple identical chips?
When you need the same firmware extracted from a batch of identical ICs—common in field-return analysis—the per-unit price drops significantly after the first successful extraction, because the attack parameters are already calibrated. Typical batch discounts range from 20–50% per additional unit.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote