nRF91 Crack | Protection Levels & Recovery Options

What Does an nRF91 Crack Actually Involve?

An nRF91 crack is the authorized recovery of firmware from Nordic Semiconductor’s nRF91 series system-in-package (SiP) — primarily the nRF9160 and nRF9161. These devices integrate an ARM Cortex-M33 core, LTE-M/NB-IoT modem, and GPS receiver into a single 10 × 16 mm package. Because the nRF91 relies on ARM TrustZone combined with Nordic’s hardware-level APPROTECT register, firmware readout requires a controlled, multi-stage process that respects the chip’s layered security architecture. Recovery is performed only for rightful IP owners — typically for legacy maintenance, lost source-code situations, or prototype migration.

nRF91 Protection Architecture: How Nordic Locks Firmware

Unlike simpler 8-bit MCUs with a single lock bit, the nRF91 family implements a defense-in-depth model. Understanding each layer is essential before evaluating whether an nRF91 crack is feasible for a given sample.

APPROTECT (Access Port Protection)

APPROTECT is a hardware register stored in the UICR (User Information Configuration Registers) region. When enabled, it disables the SWD/JTAG debug port entirely. On nRF91 devices manufactured after mid-2021, Nordic ships APPROTECT in a “hardware-enforced” variant that cannot be reversed by a simple UICR erase — a significant change from earlier nRF52-era behavior.

Secure and Non-Secure Partitioning (TrustZone)

The Cortex-M33 core divides memory into Secure and Non-Secure regions via the SAU (Security Attribution Unit) and the SPU (System Protection Unit, Nordic’s implementation). Firmware in the Secure partition — often the modem library and root-of-trust bootloader — is invisible to Non-Secure code. Any nRF91 crack must account for both partitions independently.

Modem Firmware Signing

The cellular modem runs its own signed firmware blob provided by Nordic. This blob is cryptographically verified at boot. It is not user-modifiable and is not typically the target of a recovery effort, but its presence affects the overall extraction workflow because modem updates can alter the flash layout.

When Is nRF91 Firmware Recovery Realistic?

Feasibility depends on which protections were enabled at production time. Our engineers evaluate each sample individually, but the general guidelines are:

• APPROTECT disabled or legacy-mode only: Firmware can typically be read out via SWD in 3–5 working days. Success rate is high.
• Hardware-enforced APPROTECT, no additional encryption: Physical-level techniques (voltage glitching, FIB probing) may allow debug port re-enable. Turnaround is 7–15 working days. Success is sample-dependent; we provide a feasibility assessment before committing.
• APPROTECT + TrustZone + encrypted storage: The most locked-down configuration. Secure-partition contents may be recoverable, but encrypted application data requires the original keys. If keys reside solely in the KMU, full plaintext recovery may not be possible — we will tell you this upfront.

We never guarantee 100 % success on hardware-enforced nRF91 configurations. Honest assessment before payment protects both sides. Submit your device details through our free IC feasibility check for a no-obligation evaluation.

nRF91 Crack Process — Step by Step

1. Ownership verification. You provide proof of IP ownership or authorization — purchase records, design files, corporate declaration. This step is mandatory.
2. Sample inspection. We identify the exact part marking (nRF9160-SICA, nRF9161-LACA, etc.), revision, and modem firmware version. Package markings sometimes encode the APPROTECT variant.
3. Non-invasive probe. We attempt SWD connection with a Segger J-Link or equivalent. If the debug port responds, we proceed directly to readout.
4. Invasive preparation (if needed). For hardware-enforced APPROTECT, the SiP package is carefully decapsulated. The nRF91’s wafer-level chip-scale modem die sits alongside the application processor die — both must be preserved.
5. Glitch / probe attack. Voltage-glitch injection or focused-ion-beam (FIB) micro-probing targets the APPROTECT enforcement path. This is the most time-sensitive step and may require multiple attempts.
6. Flash dump and partition mapping. Once the debug interface is re-enabled, we dump the full 1 MB flash (nRF9160) or 2 MB flash (nRF9161). Secure and Non-Secure partitions are mapped against the SPU configuration registers.
7. Verification. The extracted binary is loaded onto a blank nRF91 development kit and boot-tested. CRC checks confirm data integrity.

Key Differences: nRF9160 vs. nRF9161

The nRF9161’s larger flash means longer dump times and a wider address space to verify, but the primary difficulty increase comes from its exclusively hardware-enforced APPROTECT.

What You Receive After an nRF91 Crack

• Raw binary image (.bin / .hex) — full flash contents, sector-aligned.
• Partition map — Secure and Non-Secure boundaries, bootloader regions, modem firmware region markers.
• UICR register dump — including APPROTECT state, GPIO configuration, and HFXO settings.
• Verification report — CRC-32 checksums per sector, boot-test result on reference hardware.

How the nRF91 Compares to Other Protected MCUs

If you have worked with other locked microcontrollers, the nRF91’s protection sits in the upper tier of difficulty. For comparison, many 8-bit parts like the Microchip PIC16 family use single code-protect fuses that are well-understood. ARM Cortex-M0+ devices such as the Nuvoton M0516 offer moderate protection with fewer hardware enforcement layers. The nRF91 is closer in difficulty to locked Cortex-M4/M7 parts — though its SiP packaging adds a physical complexity layer that monolithic MCUs lack.

Similarly, Renesas RA-series chips implement TrustZone on Cortex-M33 cores. Our Renesas RA4 protection-level analysis covers a comparable architecture, and lessons from one family often inform approach on the other.

Authorization and Legal Requirements

Every nRF91 crack engagement requires documented proof of ownership or written authorization from the IP holder. We operate under NDA by default. This is not optional — it protects you, protects us, and ensures the work is defensible. Typical acceptable documentation includes original purchase orders, company letterhead authorization, or design-ownership declarations. Learn more about our compliance and authorization policies.

Common Failure Modes and Honest Caveats

• Die damage during decapsulation. The nRF91’s SiP contains multiple dies (application processor + modem) bonded to an internal substrate. Aggressive chemical decapsulation can sever bond wires. We use controlled acid-jet techniques, but the risk is non-zero — roughly 5–8 % of samples sustain partial damage.
• KMU-encrypted application data. If the developer stored AES-128/256 keys exclusively in the KMU and encrypted application data at rest, the raw flash dump will contain ciphertext. Without the key, decryption is not feasible through our process.
• Modem firmware version mismatch. Re-flashing a recovered image onto a different nRF91 with a different modem firmware version can cause boot failures. We document the original modem version so you can match it.

Pricing and Turnaround Signals

Exact pricing depends on the protection configuration and the number of samples. As a general reference:

We charge a non-refundable evaluation fee (typically $50–$150) that is credited toward the full project if we proceed. No readout, no full charge — that is our standard policy.

Related IC unlock resources:

• STM8L readout protection and recovery
• NXP Kinetis KV unlock feasibility and lead time

Related reading

• Oct 2026ATSAM3 Crack | Protection Levels & Firmware Recovery
• Oct 2026NXP IC Unlock | Families We Can Read & Recovery
• Oct 2026ATSAM3 Unlock | Feasibility, Cost & Lead Time