An IC unlock service recovers the firmware stored inside a code-protected integrated circuit — typically a microcontroller, DSP, or flash memory — when the original source code is unavailable. Our engineers use vendor-specific techniques (glitching, UV exposure, micro-probing, debug-port exploitation) to read out the binary, verify its integrity with checksums, and deliver a clean HEX or BIN file. The service is restricted to authorized owners recovering their own intellectual property or maintaining hardware they have legal rights to.
Why Engineers Need an IC Unlock Service
Code protection exists for good reason: it stops casual readout of proprietary firmware. But protection also locks out the rightful owner when circumstances change. The three scenarios we see most often account for roughly 85 % of incoming requests.
- Lost source code. A developer leaves, a hard drive fails, or a repository is corrupted. The only surviving copy of the firmware sits inside a production chip with read protection enabled.
- End-of-life parts. The MCU is discontinued. You hold stock of blank replacements but need the binary to program them. Without the original HEX file, your production line stops.
- Legacy maintenance. Equipment built 10–20 years ago still runs. When a board fails, the replacement chip must carry the same firmware — and the OEM no longer exists or no longer supports the product.
In every case, the chip’s lock bits or read-protection fuses block a standard JTAG/SWD/ICSP read. That is where a professional IC unlock service fills the gap.
How Our IC Unlock Process Works
Step 1 — Feasibility Assessment
You send us the chip’s part number (full marking, including revision suffix) and a brief description of the project context. Our team cross-references the device against our internal database of protection mechanisms and known attack vectors. Within 1–2 working days we reply with a feasibility rating: high, moderate, low, or not feasible. There is no charge for this step.
Step 2 — Authorization & NDA
Before any work begins, we require written proof of ownership or authorization — a purchase order, design-rights letter, or equivalent. We execute a mutual NDA that covers the firmware binary, schematics, and any related documentation. This step protects both parties and is non-negotiable. For details on our legal and ethical framework, see our security fuse recovery guidelines, which outline the same authorization protocol.
Step 3 — Chip Preparation
Depending on the technique required, the chip may be desoldered from the board and decapsulated (chemical or mechanical lid removal) to expose the die. For non-invasive methods — voltage glitching, cold-boot attacks, debug-port reactivation — the chip can sometimes remain on the PCB.
Step 4 — Firmware Extraction
Our engineers apply the appropriate method for the specific protection level. Techniques vary widely by vendor:
| Vendor / Family | Typical Protection | Primary Unlock Approach | Estimated Success Range |
|---|---|---|---|
| STM32 (ST) | RDP Level 1 | Voltage glitch on BOOT0 / debug reactivation | High (most F0/F1/F4 parts) |
| STM32 RDP Level 2 | Permanent lock | Micro-probing / FIB (costly, case-by-case) | Low–Moderate |
| PIC16 / PIC18 (Microchip) | CP bit, code-protect fuse | UV erase window exploit / glitch | High |
| dsPIC30 / dsPIC33 | General Segment code protect | ICSP timing exploit / partial erase | Moderate–High |
| AVR (ATmega, ATtiny) | Lock bits LB1/LB2 | High-voltage parallel read / glitch | High |
| MSP430 (TI) | JTAG fuse (blown) | BSL password brute / side-channel | Moderate |
| Renesas RX / RL78 | ID code authentication | Glitch + debug re-entry | Moderate |
| NXP LPC / Kinetis | CRP Levels 1–3 | ISP exploit (CRP1/2); invasive (CRP3) | High (CRP1/2), Low (CRP3) |
| Freescale HC08 / S12 | Backdoor key / security byte | Bus timing analysis / UV | High |
| Infineon XC800 / XMC | Flash protection / user password | Vendor-specific debug exploit | Moderate |
This table is a summary. Our full supported IC list covers 4,000+ part numbers across more than 20 vendor families with per-device feasibility notes.
Step 5 — Verification & Delivery
After extraction, we verify the binary against the chip’s reported flash size and compute CRC-32 and MD5 checksums. If the chip was non-destructively read, we reprogram a blank sample and confirm functional equivalence on a test jig. Deliverables arrive as a verified HEX or BIN file over encrypted transfer.
What Protection Levels Can Be Bypassed?
Not every locked chip can be read. Honesty here saves you time and money. Protection mechanisms fall into three practical tiers:
- Tier 1 — Software fuses / single-level lock. Most 8-bit and many 16/32-bit MCUs. Success rate is typically above 90 %. Turnaround: 5–8 working days. Examples: PIC16F, ATmega328, STM32F103 RDP1, LPC1768 CRP1.
- Tier 2 — Multi-level or hardware-backed protection. Requires invasive prep or advanced glitching. Success rate 50–80 % depending on silicon revision. Turnaround: 8–15 working days. Examples: dsPIC33EP, MSP430F5xx blown JTAG fuse, STM8S with ROP enabled.
- Tier 3 — Permanent or cryptographic lock. Some devices implement irreversible fuse blow or on-die encryption that makes non-destructive readout impossible with current techniques. We will tell you upfront if your chip falls here. Examples: STM32 RDP Level 2, NXP CRP Level 3 (newer revisions), certain Renesas RH850 variants.
If your device sits in Tier 3, we can still sometimes recover partial data or assist with a bootloader recovery approach that extracts the boot region separately from the locked application space.
Supported Chip Vendors and Families
We maintain active tooling and expertise for the following vendor ecosystems. Each link leads to a dedicated page with family-specific protection details and feasibility notes:
- STMicroelectronics IC unlock — STM32, STM8, SPC5
- Microchip IC unlock — PIC10/12/16/18/24, dsPIC30/33
- Atmel / Microchip AVR unlock — ATmega, ATtiny, AT91SAM
- NXP IC unlock — LPC, Kinetis, i.MX RT
- Renesas IC unlock — RX, RL78, V850, RH850
- Infineon IC unlock — XC800, XMC, TriCore
- Texas Instruments — MSP430, C2000, Tiva-C
- Freescale (now NXP) — HC08, HC12, S12, ColdFire
If your chip isn’t listed, submit it for a free feasibility check — we add new devices to our capability set regularly.
Turnaround, Pricing, and What Affects Cost
Pricing for an IC unlock service depends on three variables: the chip family, the protection tier, and whether invasive decapsulation is required. Below are representative ranges — not fixed quotes — to help you budget.
| Factor | Tier 1 (Software Lock) | Tier 2 (Hardware Lock) | Tier 3 (Permanent Lock) |
|---|---|---|---|
| Typical cost range (USD) | $200 – $800 | $800 – $2,500 | $2,500 – $6,000+ |
| Turnaround (working days) | 5 – 8 | 8 – 15 | 15 – 30 (if feasible) |
| Chip consumed? | Usually no | Sometimes | Often yes |
| Rush option available? | Yes (+30 %) | Case-by-case | Rarely |
We quote on a per-device basis after the feasibility assessment. If we cannot extract the firmware, you pay only a nominal evaluation fee (typically $50–$100) to cover lab time.
Deliverables You Receive
- Firmware binary — HEX (Intel HEX) or BIN format, your choice.
- Checksum report — CRC-32, MD5, SHA-256 of the extracted image.
- Memory map summary — start/end addresses, flash size, EEPROM section (if applicable).
- Fuse / configuration byte dump — so you can reprogram a blank chip with identical settings.
- Optional disassembly listing — annotated assembly output for further analysis (additional fee).
All files are delivered via encrypted file transfer. We retain no copies after 30 days unless you request archival.
Related Extraction Techniques
IC unlock is the umbrella term, but the specific method matters. Here is how the sub-services relate:
- Firmware recovery — the general process of obtaining a working binary from any locked or damaged device. Learn about our firmware recovery workflow.
- Code extraction — reading the application code region specifically, often paired with EEPROM data capture. Details on code extraction.
- Flash read — non-invasive readout of external or lightly-protected on-chip flash. See our flash read service page.
- Read protection bypass — targeted defeat of a specific RDP/CRP/lock-bit mechanism without full decapsulation.
- Microcontroller unlock — same outcome, narrower scope (MCUs only, not CPLDs or FPGAs).
When IC Unlock Is Not the Right Path
We turn down or redirect roughly 15 % of inquiries. Common reasons:
- No proof of ownership. We cannot proceed without authorization documentation. This is a hard requirement.
- Chip is Tier 3 with no known vector. We will not take your money for a guaranteed failure. We’ll suggest alternatives — sometimes a logic-analyzer capture of the chip’s bus during operation can reconstruct enough of the firmware to be useful.
- FPGA / CPLD bitstream. Bitstream extraction from Xilinx, Altera/Intel, or Lattice devices is a fundamentally different discipline. We handle some older CPLD families but do not offer general FPGA bitstream recovery.
- Encrypted external flash. If the MCU decrypts firmware on-the-fly from an external SPI flash using a device-unique key, reading the flash alone yields ciphertext. We may still help if the key is recoverable from the MCU.
How to Get Started
- Gather the chip’s full part number (e.g., STM32F103C8T6, PIC18F4550-I/PT) and any context about the protection level.
- Email or use our online form to submit a feasibility request — include a photo of the chip marking if possible.
- Receive our feasibility assessment within 1–2 working days.
- If feasible, sign the NDA, ship the chip (or the whole board), and we begin work.
- Receive your verified firmware file and checksum report.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewIs IC unlock legal?
Yes, when performed on chips you own or have documented authorization to access. Common legal bases include DMCA §1201(f) (interoperability), EU Directive 2009/24/EC (backup copies), and general property rights over hardware you purchased. We require written proof of ownership or authorization before starting any project and operate under mutual NDA. Unauthorized extraction of third-party IP is something we do not offer.
Will the chip be destroyed during IC unlock?
For Tier 1 (software-lock) devices, the chip is almost always preserved intact and returned functional. Tier 2 devices that require decapsulation are consumed in the process — the epoxy lid is chemically removed to access the die. We recommend sending at least two samples when possible so one can serve as a functional reference.
What if you cannot extract the firmware?
If our feasibility assessment rates the job as viable and we still fail, you pay only the evaluation fee ($50–$100). We will provide a written technical explanation of why extraction was not possible, which can help you evaluate alternative recovery paths such as bus sniffing or clean-room reimplementation.
How do you verify the extracted firmware is correct?
We compute CRC-32, MD5, and SHA-256 checksums of the raw binary. When the chip survives extraction, we program a blank device with the recovered image and perform a functional comparison — power-up behavior, peripheral initialization, communication-bus responses — against the original. For consumed chips, we cross-check flash size, vector table structure, and known peripheral register patterns.
Can you unlock a chip that is still soldered to the board?
For non-invasive methods (glitching, debug reactivation), yes — we can sometimes work with the chip on-board if you ship the entire PCB. For invasive methods requiring decapsulation, the chip must be desoldered first. Our lab handles desoldering with hot-air rework stations to minimize pad damage.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote