M95080 Unlock — What You Need to Know First
The M95080 is an 8-Kbit (1 KB) serial EEPROM from STMicroelectronics that communicates over a standard SPI bus. Unlike microcontrollers with fuse-based code-protection or encrypted flash, the M95080 relies on a hardware write-protect (WP) pin and a software Block Protect (BP0/BP1) register to guard stored data. An M95080 unlock is therefore a fundamentally different task from cracking a protected MCU — and, in most scenarios, considerably more straightforward.
Our engineers routinely recover data from write-protected M95080 chips for clients who need to restore legacy firmware, duplicate configuration data for authorized board clones, or archive production parameters before an end-of-life transition. Below we break down exactly what “unlock” means for this device, what it costs, and how long it takes.
How Does the M95080 Protect Its Data?
Understanding the protection scheme is the first step toward a realistic feasibility assessment. The M95080 offers three layers of defense — none of which involve encryption:
| Protection Layer | Mechanism | Effect on Readout |
|---|---|---|
| Write-Protect Pin (WP̅) | Hardware pin held low to block writes to the Status Register | Does not prevent read operations |
| Block Protect Bits (BP0, BP1) | Software-configurable bits in the Status Register that lock upper, lower, or all memory quarters against writes | Does not prevent read operations |
| Status Register Write Disable (SRWD) | When set with WP̅ low, the Status Register itself becomes read-only | Does not prevent read operations |
Key takeaway: the M95080’s protections are write-oriented. The READ instruction (opcode 0x03) is always available regardless of the BP bit settings. True “unlock” work on this device usually means one of two things:
- Data readout — extracting the full 1 KB contents when the chip is soldered to a board and the SPI bus is shared or inaccessible.
- Write-protection removal — clearing the BP bits and SRWD so the EEPROM can be reprogrammed, which requires controlling the WP̅ pin and issuing a Write Status Register (WRSR) command.
When Is M95080 Unlock Actually Challenging?
While the chip itself does not block reads, real-world recovery is not always plug-and-play. Situations our lab encounters regularly include:
Bus Contention on a Populated Board
The M95080 often shares an SPI bus with other peripherals or a host MCU. Reading in-circuit without desoldering can produce corrupt data if the host drives the bus simultaneously. Our engineers isolate the chip electrically — either by holding the MCU in reset or by carefully lifting the CS̅ line — before initiating a clean SPI read at 5 MHz or 10 MHz, depending on the supply voltage (2.5 V–5.5 V operating range).
Damaged or Corroded Packages
In legacy equipment — industrial controllers, medical instruments, automotive ECUs — the SOIC-8 or TSSOP-8 package may be corroded or the bond wires degraded. If standard SPI communication fails, we can attempt a lower-speed read (down to DC for the M95080’s static CMOS design) or, in extreme cases, perform a die-level probe.
Companion MCU Holds the Real Protection
Sometimes the M95080 stores calibration or configuration data that only makes sense when paired with firmware locked inside a companion microcontroller. In these cases, the EEPROM readout is trivial, but the full recovery project also involves unlocking the companion MCU — such as an MSP430F4 — to obtain the firmware that interprets the EEPROM contents.
Our M95080 Unlock Process
- Feasibility review (free): You send us the board or the chip, along with proof of ownership. We identify the exact M95080 variant (M95080-WMN6P, M95080-RMN6P, etc.) and confirm the SPI interface is intact.
- Electrical isolation: If in-circuit, we isolate the EEPROM from bus contention using test clips or targeted desoldering.
- SPI readout: We perform a full 1,024-byte read using a calibrated SPI programmer at the correct voltage and clock speed. We read twice and compare checksums to guarantee data integrity.
- Write-protection clearance (if needed): We assert WP̅ high, issue WREN, then WRSR with BP0 = BP1 = SRWD = 0, unlocking the entire memory for future writes.
- Delivery: You receive a binary dump (.bin / .hex) and, if requested, a reprogrammed replacement chip or the original chip resoldered to your board.
Authorization is required at step 1. We operate under NDA and only work with device owners, authorized representatives, or parties with documented IP rights.
Cost and Turnaround for M95080 Unlock
| Scenario | Typical Cost (USD) | Turnaround (Working Days) |
|---|---|---|
| Standalone chip readout (desoldered, good condition) | $150 – $250 | 1 – 2 |
| In-circuit readout from populated board | $200 – $400 | 2 – 3 |
| Readout + write-protection removal + reprogram | $250 – $450 | 2 – 3 |
| Damaged package / die-level recovery | $500 – $900+ | 5 – 10 |
Pricing depends on board complexity, chip condition, and whether companion IC work is needed. We provide a firm quote after the free feasibility check — no surprises.
M95080 vs. Other EEPROM & MCU Unlocks
Clients sometimes confuse EEPROM data extraction with MCU code-protection bypass. The difference matters for budget and expectations:
| Device | Type | Protection Level | Unlock Complexity |
|---|---|---|---|
| M95080 | SPI EEPROM | Write-protect only | Low |
| PIC16F15 series | 8-bit MCU | Code-protect fuse (CP) | Medium |
| EFM32PG series | 32-bit ARM MCU | Debug lock + AAP | Medium–High |
| STM32MP1 series | MPU (Cortex-A + M) | Secure boot, OTP fuses, TrustZone | High |
Because the M95080 lacks encryption and read-lock fuses, its unlock success rate in our lab exceeds 95 % for chips in normal operating condition. The remaining 5 % typically involves physical damage, not a protection barrier.
Common Applications Where M95080 Unlock Is Needed
- Industrial PLCs and HMIs: Configuration and calibration tables stored in the EEPROM need recovery after a processor failure.
- Automotive ECUs: Immobilizer codes or tuning maps held in SPI EEPROMs alongside a locked MCU.
- Medical devices: Serialization and calibration constants required for a board-level repair when the OEM no longer supports the product.
- Consumer electronics: MAC addresses, serial numbers, or boot parameters that must be preserved during a board swap.
What Can Go Wrong — Honest Caveats
We believe in setting realistic expectations:
- If the SPI bus was driven above the M95080’s absolute maximum rating (7 V on any pin), internal latch-up may have corrupted cells permanently.
- Data retention is rated at 40 years at 55 °C, but chips stored in harsh environments for decades may exhibit bit-rot. We can read what remains, but cannot reconstruct lost bits.
- The M95080 supports 4 million write/erase cycles. Heavily cycled devices may have marginal cells that read differently at varying supply voltages; we test at multiple Vcc levels to capture the most reliable snapshot.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Is the M95080 read-protected like a microcontroller?
No. The M95080’s protection scheme only prevents writes to selected memory blocks. The SPI READ command works regardless of the Block Protect bit settings. The main challenge is electrical access — isolating the chip on a shared bus — not defeating cryptographic protection.
Can I read the M95080 myself with a standard SPI programmer?
In principle, yes — if you can cleanly access the SPI lines (CS̅, SCK, SI, SO) and supply the correct voltage. Tools like the CH341A or a Dediprog SF100 work. However, in-circuit reads on populated boards often fail due to bus contention, and incorrect voltage levels can damage the chip. Our lab service eliminates that risk.
Do I need to prove ownership for an M95080 unlock?
Yes. We require proof that you own the device, the product it’s part of, or have written authorization from the IP holder. This applies to all IC data-recovery services we offer. The work is performed under NDA.
What file format will I receive?
We deliver a raw binary (.bin) file of the full 1,024-byte memory contents. Intel HEX (.hex) or Motorola S-Record (.srec) formats are available on request at no extra charge.
What if my board also has a locked MCU alongside the M95080?
We handle both in a single project. For example, if a locked AT32F403 MCU sits on the same board, we can assess feasibility for both chips simultaneously, often reducing total turnaround compared to separate engagements.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewRelated IC Unlock Services
If you are working with other protected devices alongside the M95080, explore these related assessments:
- PIC18FK unlock feasibility — Microchip 8-bit MCU with enhanced code protection
- RP2040 data recovery — Raspberry Pi dual-core Cortex-M0+ with SPI flash boot
- SAMD10 unlock assessment — Microchip SAM D10 ARM Cortex-M0+ with NVM security
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote