Unlockable chip list

Complete Unlockable Chip List for Authorized Firmware Recovery

Our unlockable chip list covers more than 40 microcontroller and memory IC families across 15 vendors. Each entry reflects lab-verified results — not theoretical claims. If your chip appears in the “High” success column, we can typically deliver a binary readout within 5–10 working days. If it falls in the “Evaluate” column, we need the physical device for a no-cost feasibility check before committing. This page is the fastest way to determine whether your authorized recovery project is viable before you ship a single sample.

How to Use This Unlockable Chip List

Find your chip vendor in the tables below, then locate the specific family or part number. Each row tells you three things: the protection mechanism the silicon uses, our current success category (High / Moderate / Evaluate / Not Feasible), and the typical turnaround once we accept the job. “High” means ≥90 % historical success across multiple samples. “Moderate” sits between 60–89 %. “Evaluate” means results depend on the specific revision, fuse configuration, or batch — we need your device on our bench first.

All IC unlock work requires proof of ownership or written authorization. We operate under NDA and refuse jobs that lack legitimate documentation.

Microcontroller Families — Unlock Feasibility Table

EEPROM and Serial Flash — Readout Feasibility

Memory-only ICs are generally easier to read than microcontrollers because they lack execute-in-place code protection. However, some devices use write-protect registers, OTP zones, or password-locked sectors that complicate extraction. The table below covers the serial EEPROM and SPI/NOR flash families we handle most often.

What Determines Whether a Chip Is Unlockable?

Three factors control feasibility more than anything else: the protection architecture, the silicon revision, and the physical condition of the die. Our engineers evaluate each one before committing to a job.

Protection Architecture

Single-level read-out protection (like STM8 ROP Level 1 or NXP CRP Level 1) is almost always recoverable using non-invasive or semi-invasive techniques. Multi-level schemes — STM32 RDP Level 2, NXP CRP Level 3, or hardware-rooted TrustZone — permanently disable debug interfaces and may require micro-probing or UV fault injection, which drops success rates below 50 % and raises cost significantly.

Silicon Revision

Vendors patch vulnerabilities between die revisions. An STM32F1 Rev Z may respond to a glitching vector that Rev Y has hardened against. We maintain a revision-specific database, but new revisions occasionally appear in the field before we can characterize them — hence the “Evaluate” category.

Physical Condition

Chips pulled from fire-damaged, water-damaged, or heavily corroded boards can still be candidates, but bond-wire integrity and passivation layer condition affect micro-probing yield. If the die is cracked, success drops to near zero. We photograph every device under a stereo microscope before starting invasive work.

Chips We Cannot Currently Unlock

Transparency matters. The following families are either not feasible with current techniques or carry success rates too low to justify quoting at a fixed price:

• STM32 with RDP Level 2 confirmed — debug port permanently disabled by fuse blow; requires die-level attack with no guaranteed outcome.
• NXP LPC with CRP Level 3 — mass-erase-only recovery; firmware cannot be read.
• Infineon AURIX TC2xx / TC3xx — HSM-based protection with hardware key store; no known non-destructive vector.
• Renesas RH850 with ICU-S — secure hardware module; not currently in our capability set.
• Any chip with active secure-boot chain and encrypted flash — even if the debug port is recovered, the binary is encrypted at rest and useless without the key.

If your part falls into this category, we will tell you during the free feasibility evaluation rather than accepting the job and failing silently.

Our Evaluation and Readout Process

1. Intake: You submit the part number, package marking photo, and proof of ownership. We cross-reference our unlockable chip list and reply within one business day with a preliminary assessment.
2. Feasibility check (if needed): For “Evaluate” parts, ship us 1–2 samples. We perform non-destructive probing at no charge and report back within 3–5 days.
3. Readout: Once confirmed feasible, we extract the firmware binary (Intel HEX, Motorola S-record, or raw BIN — your choice). Typical turnaround: 5–15 working days depending on complexity.
4. Verification: We program the extracted binary onto a blank device of the same part number and verify functional equivalence before delivery.

[pcb_cta type=”feasibility”]

Authorization and Legal Requirements

Every project requires a signed declaration of ownership or a letter of authorization from the IP holder. We will not proceed without this documentation. Our NDA covers all project data, extracted binaries, and communication records. For more detail on how we handle IP protection and compliance, see our trust and authorization policy.

Frequently Asked Questions

[pcb_cta type=”quote”]

{
“@context”: “https://schema.org”,
“@type”: “Service”,
“name”: “IC Unlock / Chip Firmware Recovery”,
“url”: “https://pcb-copy.com/unlockable-chip-list/”,
“provider”: {
“@type”: “Organization”,
“name”: “PCB-Copy.com”
},
“description”: “Authorized firmware extraction and chip readout service covering 40+ MCU and memory IC families. Free feasibility evaluation for unlisted parts.”,
“serviceType”: “IC Unlock and Firmware Recovery”
}

{
“@context”: “https://schema.org”,
“@type”: “BreadcrumbList”,
“itemListElement”: [
{“@type”: “ListItem”, “position”: 1, “name”: “Home”, “item”: “https://pcb-copy.com/”},
{“@type”: “ListItem”, “position”: 2, “name”: “Unlockable Chip List”, “item”: “https://pcb-copy.com/unlockable-chip-list/”}
]
}

{
“@context”: “https://schema.org”,
“@type”: “FAQPage”,
“mainEntity”: [
{
“@type”: “Question”,
“name”: “Is this unlockable chip list exhaustive?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “No. We update it quarterly as we verify new families and silicon revisions. If your specific part number is not listed, submit a feasibility request with the full marking — our lab may already have data on it.”
}
},
{
“@type”: “Question”,
“name”: “What does Evaluate mean for my project timeline?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “It means we need the physical device before we can commit to a success rate or fixed price. The evaluation takes 3–5 working days and is free of charge. Total project time is typically 10–20 working days.”
}
},
{
“@type”: “Question”,
“name”: “Can you read a chip that has been desoldered or damaged?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “Desoldered chips are fine. Damaged chips depend on the failure mode. Cracked dies are almost never recoverable, but corroded packages may still yield firmware if the die is intact.”
}
},
{
“@type”: “Question”,
“name”: “How do EEPROM reads differ from MCU firmware extraction?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “EEPROMs store data and typically lack code-protection fuses, making readout a standard bus transaction that is fast and inexpensive. MCU extraction must bypass active protection circuits, increasing cost and turnaround.”
}
},
{
“@type”: “Question”,
“name”: “Do you offer bulk pricing for production-volume readouts?”,
“acceptedAnswer”: {
“@type”: “Answer”,
“text”: “Yes. For batches of 10+ identical ICs, per-unit cost drops 20–40% because setup and characterization are amortized. Contact us with your volume and part number for a custom quote.”
}
}
]
}