NUC131 Unlock — Authorized Firmware Recovery for Nuvoton’s Cortex-M0 MCU
The Nuvoton NUC131 series is an ARM Cortex-M0-based microcontroller widely used in industrial control, USB peripherals, and motor-drive applications. When the original firmware source code is lost — or a legacy product needs maintenance — NUC131 unlock (flash readout) becomes the fastest path to recovering your own intellectual property. Our lab handles NUC131 firmware extraction under NDA with proof-of-ownership verification, typically delivering a verified binary within 5–8 working days.
What Flash Protection Does the NUC131 Use?
Nuvoton implements a security-lock mechanism on the NUC131 through its Config0 register and the Flash Access Protection (LOCK bit). When LOCK is set to 0, the chip blocks SWD/ICE debug access and prevents external read of the APROM and Data Flash regions. Key specifics:
- APROM size: 32 KB–64 KB depending on sub-variant (NUC131LC2AE, NUC131SD2AE, etc.).
- Data Flash: configurable up to 4 KB, shares the same protection domain.
- LDROM: 4 KB ISP loader region — separately lockable, sometimes left unprotected.
- Security lock granularity: whole-chip (no per-page lock bits like some STM32 families).
- Brown-out and tamper resets: Config0 bits can trigger mass-erase on voltage glitch detection, complicating non-invasive approaches.
Compared to higher-end Nuvoton M4 series (M480, M2354) that add XOM (eXecute-Only Memory) and Secure Boot, the NUC131’s protection is less layered. This makes recovery feasible in most cases — though the specific silicon revision and Config0 settings affect the technique our engineers choose.
How NUC131 Unlock Works in Practice
Step 1 — Feasibility Assessment
You submit the chip’s full part number (e.g., NUC131SD2AE), a photo of the PCB, and proof of ownership. We identify the silicon revision, check the Config0 lock state via boundary-scan where possible, and confirm whether the brown-out-reset mass-erase trap is active. This assessment takes 1–2 working days and is free.
Step 2 — Extraction Technique Selection
Our lab uses a combination of approaches depending on the lock configuration:
| Technique | Applicable When | Risk to Chip |
|---|---|---|
| Debug-port reactivation (voltage-glitch / clock-fault) | LOCK bit set, no BOR mass-erase trap | Low — non-invasive |
| ISP protocol exploitation | LDROM ISP loader still accessible | None — non-destructive |
| Micro-probing (semi-invasive) | BOR trap active, all ports locked | Moderate — chip may be consumed |
Most NUC131 units we receive fall into the first category. The Cortex-M0 core’s simpler pipeline makes glitch timing more predictable than on M3/M4 targets, and our success rate on NUC131 specifically sits above the average for Nuvoton parts.
Step 3 — Verification and Delivery
After extraction we deliver the APROM binary (.bin), a Data Flash dump if present, and — where requested — a disassembly listing annotated with vector-table and peripheral-register references. We verify the dump by re-programming a blank NUC131 and confirming functional equivalence on your target hardware or a test jig.
NUC131 Unlock Cost and Turnaround
| Service Tier | Includes | Typical Cost (USD) | Turnaround |
|---|---|---|---|
| Standard extraction | APROM + Data Flash binary | $400 – $700 | 5–8 working days |
| Extraction + annotation | Binary + disassembly listing + vector-table map | $600 – $1,000 | 7–12 working days |
| Rush (priority queue) | Binary, expedited | +40–60 % surcharge | 3–4 working days |
Pricing varies with the specific sub-variant, lock configuration, and whether semi-invasive methods are needed. If the chip must be consumed during micro-probing, we ask you to supply 2–3 sample units. Shipping costs for international orders are separate; we accept DHL, FedEx, and SF Express.
NUC131 Sub-Variants and Unlock Differences
Nuvoton ships the NUC131 in several packages and flash densities. Not all behave identically under attack:
| Part Number | Flash (KB) | Package | Notes |
|---|---|---|---|
| NUC131LC2AE | 32 | LQFP-48 | Most common in USB HID devices; typically non-invasive unlock |
| NUC131SD2AE | 64 | LQFP-64 | Used in motor drives; sometimes BOR trap enabled |
| NUC131SC2AE | 32 | LQFP-64 | Similar to LC2AE but with extra GPIO — same flash protection |
If you are unsure which variant you have, send us a clear photo of the chip marking. We can cross-reference Nuvoton’s part-number decoder and confirm before you ship hardware.
Authorization and Legal Requirements
We perform NUC131 unlock only for the rightful IP owner or an authorized agent. Before work begins you must provide one of the following:
- Original design documentation or purchase records for the product containing the NUC131.
- A signed letter of authorization from the IP holder.
- Evidence of a legitimate maintenance, repair, or end-of-life recovery scenario.
All projects are covered by a mutual NDA. We do not retain copies of extracted firmware after delivery. For a full explanation of our compliance framework, see our authorization and trust policy.
When NUC131 Unlock May Not Succeed
Transparency matters more than a sales pitch. There are scenarios where recovery is impractical:
- Physically damaged flash array: if the die has been scratched, overheated beyond 300 °C, or chemically damaged, data integrity is compromised.
- Custom Nuvoton secure-boot OTP fuses: rare on NUC131 but possible on custom-mask versions — these can block all known non-invasive vectors.
- Encrypted application payloads: we can extract the raw binary, but if the firmware itself encrypts its working data with a key derived at runtime, the binary alone may not be directly reusable without reverse-engineering the key schedule.
Our free feasibility check catches these issues before you commit budget.
Related Nuvoton and ARM Cortex-M0 Unlock Services
If your project involves multiple chip families on the same board, we handle those in parallel. Engineers working with GD32E230 firmware recovery often find the Cortex-M0 extraction workflow similar to NUC131. For designs pairing an MCU with external serial EEPROM, our 24C64 readout service and W25Q64 SPI flash unlock cover the most common companion memory ICs.
Microchip SAM-family projects share a comparable Cortex-M0+ protection model — see our pages on SAMD20 unlock and EFM32HG recovery for side-by-side comparison.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can the NUC131 be unlocked without destroying the chip?
In most cases, yes. When the Config0 LOCK bit is set but the brown-out mass-erase trap is inactive, our non-invasive glitch technique recovers the firmware without physical damage. We confirm the approach during the free feasibility check before any work begins.
How many sample chips do I need to send?
For standard non-invasive extraction, one unit is sufficient. If semi-invasive micro-probing is required — typically only when BOR traps are active — we recommend sending 2–3 units because the process may consume the first sample during calibration.
Is the extracted binary a direct .bin I can re-flash?
Yes. We deliver a raw binary image that maps directly to the NUC131 APROM address space (starting at 0x0000_0000). You can re-program it via Nuvoton’s Nu-Link or any standard SWD programmer. Data Flash contents are provided as a separate file at the correct offset.
Do you also recover the LDROM bootloader?
If the LDROM is populated and its own lock bit is set, we extract it as part of the standard service at no extra charge. Many NUC131 designs leave the LDROM either empty or unlocked, in which case it can be read directly through the ISP interface.
What if I only need the firmware for a one-time board repair?
That is one of the most common use cases. We provide the binary under NDA for your internal maintenance use. You are responsible for ensuring the re-programmed unit is used within the scope of your original product license.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote