SAMD20 Unlock: Recovering Protected Firmware from Microchip’s Cortex-M0+ MCU
The Microchip SAMD20 is an ARM Cortex-M0+ microcontroller widely used in industrial sensors, metering, and IoT edge nodes. When the NVM security bit is set, SWD debug access is disabled and flash contents become unreadable through standard tools. A SAMD20 unlock recovers that firmware — typically within 5–10 working days — so you can restore a legacy product, migrate to a new revision, or reclaim your own IP after losing source files.
What Security Does the SAMD20 Use?
Microchip’s SAM D20 family (ATSAMD20E/G/J in 32–256 KB flash variants) relies on a single-bit NVM User Row security mechanism. When the Security Bit (bit 2 of the NVM User Row at address 0x00804000) is written to 0, the device:
- Disables external read access to flash, EEPROM emulation, and boot sections via SWD/JTAG.
- Blocks the DSU (Device Service Unit) from issuing memory-bus reads.
- Permits only a full chip erase through the DSU — which destroys the firmware in the process.
Unlike multi-level protection schemes found on STM32 or some NXP parts, the SAMD20’s security model is binary: locked or unlocked. There is no RDP Level 1 equivalent that allows partial debug. This simplicity means the attack surface is well-characterized, but the recovery path requires physical-layer techniques rather than protocol-level exploits.
Key Variants and Flash Sizes
| Part Number | Flash (KB) | SRAM (KB) | Package | Unlock Complexity |
|---|---|---|---|---|
| ATSAMD20E15 | 32 | 4 | QFN-32 | Standard |
| ATSAMD20G16 | 64 | 8 | QFP-48 | Standard |
| ATSAMD20J17 | 128 | 16 | QFP-64 | Standard |
| ATSAMD20J18 | 256 | 32 | QFP-64 | Moderate |
Larger flash variants require longer readout and verification cycles, which can add 1–2 days to turnaround. Package type affects decapsulation risk: QFN-32 parts have thinner die-attach pads, demanding tighter chemical etch control.
How Is a SAMD20 Unlock Performed?
Our engineers use a combination of semi-invasive and non-invasive techniques depending on the specific SAMD20 silicon revision (die revision A through D have been observed in production). The general workflow:
- Feasibility assessment — We examine your sample under a metallurgical microscope, confirm the part marking, and identify the die revision. This step is free and typically completed within 2 working days.
- Decapsulation and die preparation — The epoxy package is removed using fuming nitric acid or a targeted laser decap system. For QFP-64 packages we achieve a clean die exposure in roughly 90 % of attempts on the first pass.
- Security-bit neutralization — Using microprobing or UV/fault-injection techniques (depending on die rev), the NVM security bit is bypassed without triggering the chip-erase path.
- Firmware readout — Flash contents, EEPROM emulation data, and fuse/calibration bytes are dumped via the re-enabled debug interface. A CRC-32 check is run against internal NVM checksums.
- Verification — The extracted binary is programmed onto a blank SAMD20 of the same variant and tested for functional equivalence. We deliver both the raw .bin and Intel HEX formats.
Failure modes exist: heavily ball-bonded QFN parts occasionally suffer pad lift during decap, and very early A-revision dies have a slightly different NVM cell geometry that reduces first-pass success. We communicate these risks before any paid work begins.
SAMD20 Unlock Cost and Turnaround
Pricing depends on flash size, die revision, and quantity of samples. The table below gives representative ranges — your actual quote may differ after the free feasibility check.
| Factor | Typical Range | Notes |
|---|---|---|
| Base unlock fee (≤64 KB) | $350–$600 | Single sample, standard turnaround |
| Base unlock fee (128–256 KB) | $500–$900 | Longer readout/verification cycle |
| Rush service (≤3 days) | +40–60 % | Subject to lab availability |
| Additional identical samples | $80–$150 each | Same part, same firmware version |
| Standard turnaround | 5–10 working days | From sample receipt to delivery |
We charge nothing if the unlock fails. Payment is collected only after you receive and verify the extracted firmware file.
Who Needs a SAMD20 Unlock?
Typical clients fall into a few categories:
- OEMs recovering lost source code — A contract developer delivered compiled firmware but the source was never escrowed. The product is in the field and needs a bug fix.
- Legacy maintenance teams — End-of-life sensor boards running SAMD20G16 need firmware cloned to replacement ICs for a 10-year support contract.
- Hardware redesign projects — Migrating from SAMD20 to SAMD21 or PIC32 requires the original binary for functional benchmarking.
All work requires proof of ownership or written authorization from the IP holder. We execute a mutual NDA before any firmware leaves our lab. For details on our authorization and confidentiality process, see our STM8T unlock authorization workflow — the same legal framework applies to every Microchip SAM project.
SAMD20 vs. Other ARM Cortex-M0+ Unlock Targets
Engineers sometimes ask how the SAMD20 compares to other popular Cortex-M0/M0+ parts in terms of unlock difficulty. Here is a brief comparison with chips we regularly process:
| MCU Family | Vendor | Protection Type | Relative Difficulty |
|---|---|---|---|
| SAMD20 | Microchip | NVM Security Bit | Moderate |
| STM32F0 | ST | RDP Level 1/2 | Level 1 easy; Level 2 hard |
| LPC4300 | NXP | Code Read Protection (CRP) | CRP1–2 moderate; CRP3 difficult |
| GD32VF103 | GigaDevice | SWD read-protect | Moderate |
| MSP430F4 | TI | JTAG fuse blow | Standard |
If you are dealing with NXP’s Cortex-M4 line, our LPC4300 unlock service covers the CRP levels in detail. For TI’s 16-bit MSP430 family, see our MSP430F4 unlock page. And for RISC-V based GigaDevice parts, we document the process on our GD32VF103 unlock page.
What You Receive After a Successful SAMD20 Unlock
- Raw flash binary (.bin) — full image from 0x00000000 to end of flash.
- Intel HEX file (.hex) — suitable for direct programming with Atmel-ICE, J-Link, or MPLAB IPE.
- NVM User Row dump — fuse settings, BOD configuration, calibration data.
- EEPROM emulation section (if used) — extracted as a separate binary.
- CRC-32 verification report confirming data integrity against internal NVM checksums.
All files are delivered via encrypted transfer. We retain no copies after 30 days unless you request archival under NDA.
Requesting a Free Feasibility Assessment
Before committing to a paid SAMD20 unlock, send us one or two sample ICs (or the complete PCB) along with the exact part number and a brief description of your use case. Our engineers will confirm the die revision, estimate success probability, and return a binding quote — typically within 48 hours of receiving the samples.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can the SAMD20 security bit be cleared without erasing flash?
Not through normal debug commands. The DSU only allows a Chip Erase to clear the security bit, which wipes all flash. Our unlock process bypasses this restriction at the physical layer, preserving the firmware intact. Success depends on die revision and package condition, which is why we run a free feasibility check first.
Is SAMD20 unlock legal?
Yes, when performed for authorized purposes — recovering your own firmware, maintaining products you manufactured, or working under written permission from the IP owner. We require proof of ownership or a signed authorization letter before starting work, and we execute a mutual NDA. Unauthorized extraction of third-party IP is something we do not perform.
What if my SAMD20 is on a populated PCB — do I need to desolder it?
No. Ship the complete board. Our lab handles desoldering with hot-air rework stations calibrated for lead-free SAM D20 packages (reflow at 245–260 °C peak). This avoids the risk of pad damage from improper removal. We can also resolder the chip after readout if you need the board returned functional.
How does SAMD20 unlock difficulty compare to PIC or STM8 parts?
The SAMD20 sits in the moderate range. PIC16F15 parts with basic code-protect bits are generally easier — see our PIC16F15 unlock overview. STM8 parts like the STM8S207 vary by ROP level. The SAMD20’s single security bit is well-understood, giving us a high first-pass success rate on most die revisions.
Do you support SAMD21, SAMC20, or other SAM families?
Yes. The SAMD21 uses a nearly identical NVM security mechanism, and the SAMC20/SAMC21 (CAN-enabled variants) share the same die architecture. Pricing and turnaround are comparable. Contact us with your specific part number for a tailored quote.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote