SAML21 Unlock: What You Need to Know Before Submitting a Chip
SAML21 unlock is feasible on most ATSAML21 variants when the chip’s security bit (BOOTPROT / Security Bit in NVM User Row) is the primary protection mechanism. Our engineers recover firmware from locked SAML21 devices for authorized owners—typically for legacy product maintenance, prototype recovery, or second-source qualification. Success rates range from roughly 70–85 % depending on the specific part number, silicon revision, and whether additional Secure Boot features have been activated. Below we break down exactly what determines feasibility, what it costs, and how long it takes.
How Does the SAML21 Protect Its Flash?
The ATSAML21 family (ATSAML21E/G/J series) is built on an ARM Cortex-M0+ core with up to 256 KB of flash. Microchip implements several protection layers that directly affect unlock difficulty:
| Protection Feature | Location | Effect on Unlock |
|---|---|---|
| Security Bit (SECBIT) | NVM User Row, bit 2 | Disables external debugger (SWD) access to flash. Primary barrier—most unlock requests involve only this bit. |
| BOOTPROT Fuse | NVM User Row, bits 0–2 | Write-protects the bootloader region (0–32 KB selectable). Does not block readout by itself but complicates partial-flash recovery. |
| Region Lock Bits | NVM User Row | Per-region write/erase protection for up to 16 flash regions. Affects in-system modification but not external readout once SECBIT is handled. |
| Chip Erase on Tamper | RTC Tamper Detection | If enabled, a tamper event triggers full flash erase. Must be accounted for in the physical approach—adds risk. |
| TrustZone-M (SAML21 Rev B+) | SAU / IDAU | Later revisions introduced basic secure/non-secure partitioning. When active, recovery complexity increases significantly. |
Most production boards in the field use SECBIT alone. When TrustZone or tamper-erase is layered on top, we still evaluate the chip but quote a lower success probability and a longer timeline.
Which SAML21 Variants Can Be Unlocked?
The ATSAML21 family spans three pin-count tiers—E (32-pin), G (48-pin), and J (64-pin)—with flash sizes of 128 KB or 256 KB. From a security standpoint, the important differentiator is silicon revision, not package:
- Rev A (early production): SECBIT-only protection. Highest success rate—our lab consistently recovers firmware from these parts.
- Rev B and later: Added TrustZone-lite and improved tamper features. Still recoverable in many configurations, but we require a feasibility check before quoting.
- SAML21 with custom bootloader + SECBIT: Common in IoT sensor nodes. Recovery is typically straightforward because the application region is not additionally encrypted.
If you are unsure of your chip’s revision, send us the full part marking (e.g., ATSAML21J18B-MUT) and we can identify the silicon revision and protection capabilities before you ship the device.
Our SAML21 Unlock Process Step by Step
1. Feasibility Assessment (Free)
You provide the part number, a photo of the chip marking, and a brief description of what protection was enabled. We cross-reference our internal database of previously attempted SAML21 variants and return a feasibility estimate within 1–2 business days. No cost, no obligation.
2. Authorization & NDA
We require proof of ownership or written authorization before proceeding. This may be a purchase order for the original product, design files showing you are the IP holder, or a signed declaration. We execute a mutual NDA covering all firmware data. For details on our authorization policy, see our IP protection and trust framework.
3. Chip-Level Analysis
Our engineers examine the device under controlled conditions. For SECBIT-only SAML21 parts, the approach targets the NVM controller interface and debug access port. We do not use bulk decapping as a first resort—non-invasive and semi-invasive methods are attempted first to preserve the chip for reuse when possible.
4. Firmware Extraction & Verification
Recovered data is verified against known flash structure (vector table at 0x00000000, application entry, NVMCTRL regions). We deliver a raw binary (.bin) and Intel HEX (.hex) file. If you need a disassembly listing for Cortex-M0+ code review, that is available as an add-on.
5. Delivery
Files are transferred via encrypted channel. The original chip is returned to you along with a brief technical report noting the protection state encountered and any anomalies.
What Does SAML21 Unlock Cost?
Pricing depends on protection complexity and whether the chip can be recovered non-destructively. Here are realistic ranges:
| Scenario | Typical Cost (USD) | Turnaround (Working Days) |
|---|---|---|
| SECBIT only, Rev A, 128 KB flash | $400–$600 | 5–7 |
| SECBIT only, Rev A/B, 256 KB flash | $500–$800 | 5–10 |
| SECBIT + BOOTPROT + Region Locks | $600–$1,000 | 7–12 |
| SECBIT + TrustZone / Tamper-erase active | $900–$1,500+ | 10–20 (feasibility-dependent) |
We charge nothing if the attempt fails. A 50 % deposit is required at confirmation; the balance is due only upon successful delivery of verified firmware.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewHow Does SAML21 Compare to Similar MCUs?
Engineers often ask how the SAML21 stacks up against other low-power ARM parts they might also need recovered. Here is a quick comparison with families we work on regularly:
| MCU Family | Core | Primary Protection | Relative Unlock Difficulty |
|---|---|---|---|
| ATSAML21 | Cortex-M0+ | SECBIT + optional TrustZone | Moderate |
| ATSAME54 | Cortex-M4F | SECBIT + TrustZone-M + Secure Boot | High |
| RP2040 | Dual Cortex-M0+ | OTP boot flags, no on-chip flash | Low–Moderate |
| STM32MP1 | Cortex-A7 + M4 | OTP fuses + OP-TEE | High |
| PIC16F18 | 8-bit PIC | Code-protect bits | Low |
If you need firmware recovered from an ATSAME54 with its stronger Secure Boot chain, or from a simpler PIC16F18 with code-protect fuses, we handle those families with dedicated workflows. For dual-core designs like the RP2040 where flash is external, the approach differs substantially from the SAML21’s on-die NVM.
Common Failure Modes and Honest Caveats
Not every SAML21 unlock succeeds. Transparency matters more than a sales pitch:
- Tamper-erase triggered: If the RTC tamper detection is configured to erase flash on physical intrusion, and the detection circuit is still powered, the firmware can be destroyed before extraction completes. We mitigate this with power-sequencing techniques, but it is not always avoidable.
- Corrupted flash: Chips pulled from field-failed boards sometimes have partially corrupted NVM. We can still read the data, but the resulting binary may not be fully functional without reconstruction work.
- Encrypted application payloads: Even after SECBIT bypass, if the application itself stores encrypted data (e.g., AES-128 keys in a secure element), the raw binary is readable but the encrypted blobs remain opaque without the key.
- Custom silicon revisions: A small number of SAML21 devices in automotive or medical modules carry Microchip custom masks. These may behave differently from catalog parts and require extra evaluation time.
We always disclose these risks during the feasibility stage so you can make an informed decision before spending money.
Who Typically Needs SAML21 Firmware Recovery?
Most of our SAML21 unlock clients fall into three categories:
- IoT device manufacturers who lost source code or build artifacts after a developer departure and need to recover firmware from a production unit to continue maintenance.
- Contract electronics manufacturers (CEMs) supporting end-of-life products where the original design house is defunct and the OEM customer needs continued supply.
- Hardware security auditors performing authorized penetration testing on their own products to validate that SECBIT and TrustZone configurations meet their threat model.
In every case, authorization documentation is required before we begin work.
Related Microchip and ARM Cortex-M0+ Unlock Services
Beyond the SAML21, our lab regularly works on adjacent MCU families. If your design uses multiple controller types, we can often bundle recovery work to reduce total cost and turnaround. Engineers working with Chinese-domestic ARM alternatives may also find our AT32F403 flash readout service or MM32F103 unlock capability relevant, as these parts share similar Cortex-M debug architectures.
Is SAML21 unlock legal?
Firmware recovery is legal when performed on devices you own or are authorized to access. We require proof of ownership or a signed authorization letter before starting any work. Our process is designed for legitimate use cases: recovering your own IP, maintaining legacy products, or conducting authorized security audits. We do not assist with unauthorized copying of third-party intellectual property.
Can the SAML21 chip be reused after unlock?
In most SECBIT-only cases, yes. Non-invasive and semi-invasive approaches preserve the die. If decapping is required (rare for SAML21), the chip is typically consumed. We will tell you upfront whether reuse is expected for your specific variant.
What files do I receive after SAML21 firmware extraction?
Standard delivery includes a raw binary (.bin) and Intel HEX (.hex) covering the full flash range (up to 256 KB). Optional add-ons include a Cortex-M0+ disassembly listing (.asm/.lst) and a flash memory map showing BOOTPROT, application, and data regions.
How do I know which SAML21 revision I have?
The full part marking on the chip package includes the revision letter. For example, ATSAML21J18B-MUT indicates Rev B. If the marking is unreadable, send us a clear photo and we can usually identify the revision from date codes and lot numbers.
What if my SAML21 unlock attempt fails?
You pay nothing. Our policy is no-success-no-fee. The 50 % deposit is fully refundable if we cannot deliver verified firmware. We will also provide a brief report explaining why the attempt did not succeed, which can be useful if you pursue alternative recovery paths.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote