What Does MCU Unlock Cost in Practice?
MCU unlock cost typically falls between $150 and $15,000 per device, with most common 8-bit and 32-bit microcontrollers landing in the $300–$3,000 range. The price depends on the chip family, the type and generation of read protection, whether the extraction is invasive or non-invasive, and how many sample devices the lab needs to consume during development. A simple EEPROM readout may cost a fraction of what a glitch-attack on a Cortex-M4 with RDP Level 2 demands.
Why MCU Unlock Prices Vary So Widely
Engineers often ask why two quotes for seemingly similar chips can differ by 10×. The answer sits in the silicon itself and the labor required to defeat its protections. Below are the concrete factors our lab evaluates before quoting.
1. Protection Scheme and Security Level
Every MCU vendor implements code-read protection differently. An STM32F1 with RDP Level 1 can often be bypassed through a well-documented voltage-glitch attack in under a day of bench time. An STM32MP1 with TrustZone and secure boot requires weeks of reverse engineering on the die level — if it is feasible at all. Microchip PIC devices use configuration-word fuse bits; some families like the PIC16F15 series have relatively straightforward fuse structures, while newer PIC18FK parts incorporate enhanced code protection that resists older UV-erase techniques.
As a rule: the newer the protection generation, the higher the MCU unlock cost.
2. Die Process Node and Package Type
Invasive attacks — microprobing, FIB circuit editing, laser fault injection — require decapsulating the chip and working directly on the die. A 180 nm process with wide metal traces is far more accessible than a 40 nm node where interconnects are buried under multiple metal layers. BGA and WLCSP packages add decapsulation complexity compared to QFP or DIP parts. Each step that demands more precision under the microscope adds cost.
3. Flash / Memory Size
Larger flash arrays do not always cost more to unlock — the protection bypass is the expensive part, not the data dump itself. However, on chips where the extraction is done bit-by-bit via microprobing (e.g., certain OTP PROMs), a 512 KB device takes meaningfully longer than a 32 KB one. For serial EEPROMs like the AT24C512, the readout itself is trivial once the write-protect or password lock is handled.
4. Sample Consumption
Non-invasive methods (glitching, debug-port exploits, side-channel analysis) are typically non-destructive — one or two samples suffice. Invasive methods may consume 3–10 devices during process development: decapsulation can fail, probes can slip, and each attempt destroys the part. If you only have one irreplaceable sample, the lab must work far more conservatively, which increases both risk and cost.
5. Prior Art and Lab Experience
If our engineers have already developed a working attack path for a chip family, the marginal cost of repeating it on your specific part number drops dramatically. A first-of-family engagement on a GD32E230 (a GigaDevice Cortex-M23 part) required significant R&D. Subsequent GD32E-series jobs reuse that research, cutting the price by 40–60%.
MCU Unlock Cost by Chip Category
| Chip Category | Typical Protection | Typical Cost Range (USD) | Typical Turnaround |
|---|---|---|---|
| Serial EEPROM (24Cxx, 93Cxx, M95xxx) | Write-protect pin / password | $150 – $500 | 1 – 5 working days |
| Serial Flash (SST25VF, W25Q, MX25L) | Status-register lock bits | $200 – $800 | 2 – 7 working days |
| 8-bit MCU (PIC16F, ATmega, STM8) | Fuse / config-word CRP | $300 – $1,500 | 3 – 10 working days |
| 16-bit MCU (MSP430, dsPIC) | JTAG fuse / BSL password | $500 – $2,500 | 5 – 15 working days |
| 32-bit Cortex-M (STM32, GD32, SAM) | RDP / Security bit / TrustZone | $800 – $6,000 | 5 – 30 working days |
| High-security / multi-core (STM32MP, i.MX) | Secure boot + encrypted storage | $3,000 – $15,000+ | 20 – 60+ working days |
These ranges assume authorized recovery of firmware you own. Actual quotes depend on the exact part number, protection configuration, and sample availability.
What Drives Cost Down?
- Batch jobs: Unlocking 20 units of the same MCU is cheaper per-unit than a single piece because setup and attack-path development are amortized.
- Providing datasheets and schematics: Anything that reduces reverse-engineering time on the board level saves money.
- Common families: Widely deployed parts like MSP430F2 or PIC16F have well-established attack paths, so R&D cost is minimal.
- Sufficient samples: Sending 5–10 spare devices lets the lab work faster without the overhead of extreme caution on each attempt.
What Drives Cost Up?
- Single irreplaceable sample: The lab must add margin for risk, and may need custom fixturing to avoid damage.
- Newer protection revisions: A chip’s Rev. B silicon may patch the glitch vulnerability that worked on Rev. A — requiring a fresh attack path.
- Encrypted flash: Some MCUs (e.g., certain STM32L4+ and STM32MP1 parts) encrypt flash contents at rest. Even after bypassing read protection, the data must be decrypted, which may or may not be feasible.
- Rush turnaround: Expedited service (under 5 working days on a complex part) typically adds a 30–50% surcharge.
How We Quote MCU Unlock Cost
Our process is straightforward and designed to prevent surprises:
- Feasibility review (free): You submit the chip part number, package marking, protection status (if known), and quantity. We respond within 1–2 business days with a feasibility assessment.
- Firm quote: If feasible, you receive a fixed-price quote covering the extraction, verification, and delivery of the binary. No hidden hourly charges.
- Authorization check: We require proof of device ownership or written authorization before starting work. This protects both parties and is non-negotiable.
- Extraction and verification: We perform the unlock, verify the dump against a checksum or functional test (when possible), and deliver the binary file.
- Payment on success: For most standard jobs, final payment is due only after successful extraction. High-R&D engagements may require a partial upfront deposit to cover lab consumables.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewReal-World MCU Unlock Cost Examples
To give concrete context, here are anonymized recent engagements:
| Chip | Protection | Samples Provided | Final Cost | Turnaround |
|---|---|---|---|---|
| PIC16F1847 | CP bit set | 5 | $400 | 4 days |
| STM32F103C8 | RDP Level 1 | 3 | $900 | 6 days |
| MSP430F449 | JTAG fuse blown | 2 | $1,200 | 8 days |
| GD32F303VET6 | SWD lock + RDP | 8 | $2,800 | 18 days |
| SAMD21G18A | Security bit | 4 | $1,600 | 12 days |
Every engagement is unique. The numbers above reflect the specific revision, lot, and protection state of each device at the time of service.
Authorization and Legal Requirements
MCU unlock is a legitimate engineering service used for firmware recovery on your own products, legacy maintenance, second-sourcing of components you designed, and failure analysis. We require documented proof of ownership or authorization for every job. Work is performed under NDA, and we do not retain copies of extracted firmware after delivery. If you have questions about the legal framework, review our authorization and trust policies before submitting a request.
Frequently Asked Questions About MCU Unlock Cost
Is there a minimum charge for MCU unlock?
Yes. Even simple EEPROM readouts carry a minimum bench fee of approximately $150, which covers device handling, verification, and secure file delivery. Most MCU jobs start at $300 due to the additional protection-bypass work involved.
Do I pay if the unlock attempt fails?
For standard-feasibility jobs, no — you pay only on successful extraction. For high-risk or first-of-family R&D engagements, a partial deposit (typically 20–30% of the quote) may be required to cover consumed samples and lab time. This is always disclosed upfront in the quote.
Can I reduce MCU unlock cost by providing more samples?
Absolutely. Providing 5–10 spare devices lets the lab iterate faster on invasive approaches and reduces the per-unit risk premium. For non-invasive methods the benefit is smaller but still helps — a backup device eliminates the single-point-of-failure surcharge.
Why is a 32-bit Cortex-M chip more expensive to unlock than an 8-bit PIC?
Cortex-M devices typically use multi-level read-out protection (e.g., STM32 RDP Level 1/2), smaller process nodes, and more complex debug-port security. These require advanced fault-injection setups or even die-level intervention, while many 8-bit PICs can be handled with established fuse-reset techniques developed over two decades.
How long does a typical MCU unlock take?
Simple EEPROM and 8-bit MCU jobs finish in 1–7 working days. Mid-complexity 32-bit parts take 5–20 days. High-security or first-of-family parts can require 30–60+ days of R&D. Rush service is available for most categories at an additional fee.
Related Chip Unlock Services
- SAMD20 firmware recovery — Microchip Cortex-M0+ with security-bit bypass
- MSP430F4 series unlock — TI 16-bit MCU JTAG fuse recovery
- 93C56 EEPROM readout — Microwire serial EEPROM data extraction
- SST25VF flash unlock — SPI flash status-register lock removal
- EFM32G unlock — Silicon Labs Cortex-M3 debug lock bypass
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote