MCU Firmware Recovery Service: Professional Firmware Extraction from 50+ Microcontroller Families
Introduction: The Software Brain Inside Every Circuit Board
PCB reverse engineering extracts the physical design of a circuit board — the Gerber files, schematic, and BOM. But the hardware is only half the story. Every modern electronic device runs software code stored in its microcontrollers. When that code is lost, corrupted, or locked behind read protection, the device becomes unmaintainable. This is where MCU firmware recovery comes in.
MCU firmware recovery is the process of extracting the software code — the firmware — stored in a microcontroller’s flash memory. Unlike programming (which writes new code to a chip), firmware recovery retrieves existing code. This service is a natural extension of our PCB reverse engineering capabilities: once we’ve extracted the hardware design from a board, we can also recover the software running on it — giving you a complete picture of your legacy equipment.
Whether the original developer is no longer available, the OEM has discontinued support, or the MCU is read-protected, we have the tools and techniques to recover the firmware and keep your systems operational.
Key Takeaways
- MCU firmware recovery extracts the binary code stored in a microcontroller’s flash memory when source code is unavailable
- We support extraction from 50+ MCU families: STM32, PIC, AVR, MSP430, NXP, Nordic, Espressif, and more
- Three-phase methodology: JTAG/SWD → glitching → chip-off handles both unlocked and read-protected MCUs
- Authorization is required: You must own the equipment or have OEM permission
- Full deliverables package: Raw binary dump, memory map, chip ID report, and extraction log
- IC decapsulation available as a last resort for fully locked MCUs
When Is MCU Firmware Recovery Needed?
Firmware recovery becomes necessary in several common scenarios:
1. Lost Source Code
Internal development teams change, repositories get corrupted, and companies get acquired. When the original firmware source code is no longer available but the hardware still exists, recovery is the only path forward for maintenance, modification, or replication.
2. OEM Refuses Support
For legacy equipment, OEMs often discontinue microcontrollers, refuse to provide firmware updates, or charge prohibitive prices for continued support. Firmware recovery lets you maintain and update the device independently.
3. Corrupted Firmware / Boot Failure
Power surges, firmware update failures, or memory errors can corrupt the MCU’s flash contents. Recovery extracts whatever readable code remains, which is often enough to restore functionality or create a patched version.
4. Read-Protected MCU
Modern microcontrollers include read protection — lock bits, RDP, code protect — to prevent unauthorized code extraction. When a device with an active read-protected MCU fails, standard programming tools cannot access the firmware. Our advanced techniques — glitching and chip-off — can bypass these protections.
5. Legacy Equipment End-of-Life
As equipment ages, replacement boards become unavailable. Recovering the firmware from an existing board allows you to clone it, fix it, or use the code as the foundation for a form-fit-function replacement.
6. Firmware Backup Before Modification
Before making hardware or software modifications to a device, having a backup of the original firmware is essential. If the modification fails, you can restore the original state.
7. Interoperability Research
Under DMCA Section 1201(f), reverse engineering for interoperability is legal in the United States. Researchers, security analysts, and independent repair technicians may need firmware access to understand how devices communicate and interact.
Supported MCU Families
We support firmware extraction from the majority of commercially available microcontroller families:
| MCU Family | Vendor | Typical Flash Size | Protection Mechanism | Recovery Difficulty |
|---|---|---|---|---|
| STM32 (F0/F1/F2/F3/F4/F7/H7/L0/L1/L4/L5/WB) | STMicroelectronics | 16 KB – 2 MB | RDP (Level 0/1/2) | Low – High |
| PIC10/12/16/18/24/32, dsPIC | Microchip | 1 KB – 2 MB | CP / CPP | Low – medium |
| ATmega / ATtiny | Microchip/Atmel | 1 KB – 256 KB | Lock Bits / Fuse Bits | Low |
| MSP430 (F1xx–F6xx, FRAM) | Texas Instruments | 16 KB – 512 KB | JTAG Lock / BSL Password | Medium |
| LPC11xx/13xx/17xx/40xx/54xxx | NXP | 16 KB – 512 KB | CRP (Level 1–3) | Medium – High |
| nRF51 / nRF52 | Nordic Semiconductor | 64 KB – 1 MB | APPROTECT | Medium |
| ESP32 / ESP8266 | Espressif | 1 MB – 4 MB | Flash Encryption | Medium |
| RX / RL78 / V850 | Renesas | 16 KB – 8 MB | Serial Programming Lock | Medium – High |
| PSoC 3/4/5/6 | Infineon/Cypress | 16 KB – 2 MB | Flash Protection | Medium |
For MCUs not listed above, contact us with the part number for an assessment.
Success rate varies by protection level: Unlocked MCUs have a 90%+ recovery rate. Read-protected MCUs require more advanced techniques with lower success rates. We assess each chip individually and inform you of the likelihood of success before starting work.
The Firmware Extraction Process
Our extraction follows a three-phase methodology. We always attempt the least destructive method first, escalating only when necessary.
Phase A — Non-Destructive Extraction (JTAG/SWD/ICSP)
Success rate: 70–90% | Turnaround: 5–15 business days
We connect directly to the MCU’s debug or programming interface:
- JTAG (IEEE 1149.1): Standard 20-pin boundary scan interface used by most ARM-based MCUs. Supports high-speed flash read via the ARM Debug Interface.
- SWD (Serial Wire Debug): ARM’s two-pin (SWDIO + SWCLK) alternative to JTAG, used on STM32, NXP LPC, Nordic nRF, and most modern ARM Cortex-M chips.
- ICSP (In-Circuit Serial Programming): Microchip’s 6-pin protocol for PIC microcontrollers.
- ISP (In-System Programming): Atmel’s protocol for AVR microcontrollers.
If the MCU is not read-protected, we can typically dump the entire flash memory within minutes to hours. This is the fastest and most reliable method. No damage to the chip or PCB.
Phase B — Semi-Destructive Extraction (Voltage Glitching / Bootloader Exploit)
Success rate: 30–50% | Turnaround: 10–15 business days
When JTAG/SWD is blocked by read protection:
- Voltage Glitching: We introduce carefully timed voltage perturbations on VCC (under-powering, over-powering, or voltage spikes) while the MCU is in a vulnerable state — during bootloader entry or an interrupt handler. This can cause the read protection check to misbehave momentarily, allowing flash read before the protection re-engages.
- Clock Glitching: Similar technique using timing perturbations on the clock line instead of power.
- Bootloader Exploit: Some MCUs expose a UART or SPI bootloader that can be triggered via specific pin sequences. If the bootloader lacks its own protection, firmware can be read through it.
These techniques are non-invasive — the chip remains physically intact. However, they require precise timing and may not work on all chips. There’s a small risk that the chip enters an unintended state.
Phase C — Destructive Extraction (Chip-Off / IC Decapsulation)
Success rate: 40–70% | Turnaround: 15–25 business days | Chip is destroyed
When Phase A and B both fail:
- The MCU is physically removed from the PCB (hot-plate rework or IR reflow)
- The chip’s plastic or QFN/QFP package is chemically or mechanically decapsulated to expose the silicon die
- A microprobe station is used to directly access the die’s flash memory cells
- The raw memory contents are extracted
This is our IC decapsulation service applied to microcontrollers. The original MCU is destroyed in the process. A replacement chip must be programmed with the recovered firmware for the device to function again.
Authorization Requirements
Before we begin any firmware recovery project, we require:
Proof of Ownership
An invoice, purchase order, equipment manifest, or similar document showing you own the device containing the MCU. For in-house equipment, a letter on company letterhead confirming ownership is sufficient.
Written Authorization Letter
If the MCU firmware belongs to a third party (e.g., an OEM’s board inside your equipment), you need a signed letter from the IP owner granting permission for firmware extraction. Our PCB reverse engineering authorization article provides a detailed template and legal framework.
Signed Service Agreement
Our standard NDA and service terms, which include confidentiality clauses and restrictions on how recovered firmware may be used.
For regulated industries — medical devices (FDA), automotive (IATF 16949), defense (ITAR), or aerospace — additional documentation may be required. We handle these cases on a per-project basis.
Deliverables
Upon successful firmware recovery, you will receive:
| Deliverable | Format | Description |
|---|---|---|
| Raw Firmware Binary | .bin / .hex | Complete flash memory contents as a raw binary file or Intel HEX format |
| Decoded Firmware | .elf / .axf (if symbols recoverable) | If the firmware contains embedded debug symbols, we extract them for easier analysis |
| Memory Map Report | Flash layout showing vector tables, memory regions, and where code/data is stored | |
| Chip ID Report | MCU part number, die revision, lot code, and flash size | |
| Extraction Log | TXT / PDF | Debug interface commands used, interface speed, and any notes on the extraction process |
| Authorization Documentation | Your submitted authorization materials (for your records) |
For encrypted MCUs where the flash is hardware-encrypted (e.g., STM32 with Flash Encryption enabled, ESP32 with Secure Boot), you will receive the encrypted binary with a detailed report explaining the encryption mechanism and limitations on further analysis.
Pricing and Turnaround
Turnaround Time
| Scenario | Typical Turnaround |
|---|---|
| Unlocked MCU, JTAG/SWD (Phase A) | 5–10 business days |
| Locked MCU, glitching attempt (Phase B) | 10–15 business days |
| IC Decapsulation required (Phase C) | 15–25 business days |
| Rush service (Phase A only) | 2–5 business days |
Initial assessment and quotation is provided within 1–2 business days of receiving the board or MCU details.
Pricing Factors
Pricing varies based on:
- MCU family: Different families require different tools and expertise
- Flash memory size: Larger memory means longer read times
- Protection level: Locked MCUs require Phase B or C techniques
- Extraction method: Phase A is base cost; Phase B adds a surcharge; Phase C adds significant cost
- Number of MCUs: Volume discounts available for 5+ identical units
- Urgency: Rush service adds a 50–100% surcharge
- Report complexity: Standard binary dump vs. full memory map + analysis
We provide a free initial assessment and a fixed-price quote before any work begins. There are no hidden fees — you approve the quote before we start.
Related Firmware Recovery Services
Our firmware recovery services cover the full spectrum from microcontroller firmware to external memory chips:
- STM32 firmware recovery — Most common 32-bit MCU family, detailed extraction guide
- PIC microcontroller code recovery — Microchip PIC series recovery capabilities
- AVR firmware recovery — ATmega and ATtiny series recovery
- EEPROM data recovery — External EEPROM memory extraction
- NAND flash data recovery — NAND-based storage chip recovery
- IC decapsulation service — Last-resort chip-level extraction
- Firmware backup legacy equipment — Complete firmware backup for end-of-life devices
- PCB reverse engineering services — Hardware layer upstream
Frequently Asked Questions
What is MCU firmware recovery?
MCU firmware recovery is the process of extracting the software code stored in a microcontroller’s flash memory when the original source code is lost, the MCU is locked, or firmware needs to be backed up. Unlike programming (which writes new code), firmware recovery retrieves existing code through JTAG/SWD interfaces, glitching techniques, or chip-off methods. It’s a natural extension of our PCB reverse engineering services.
Which MCU families can you recover firmware from?
We support extraction from STM32 (all series), PIC (PIC10–PIC32), AVR (ATmega/ATtiny), MSP430, NXP LPC, Nordic nRF, Espressif ESP, Renesas, and Cypress PSoC. Unlocked MCUs have a 90%+ recovery rate. Locked MCUs require more advanced techniques with lower success rates. Contact us with your specific MCU part number for an assessment.
How does the MCU firmware extraction process work?
Our firmware extraction follows three phases: Phase A (non-destructive JTAG/SWD extraction, 70–90% success), Phase B (voltage glitching or bootloader exploit, 30–50% success), and Phase C (chip-off and IC decapsulation, 40–70% success). We always attempt the least destructive method first.
What if the MCU is read-protected or encrypted?
Read-protected MCUs require Phase B (glitching) or Phase C (decapsulation) techniques. Encrypted MCUs may yield encrypted binaries that cannot be decoded without the key. We assess your specific MCU’s protection level during the initial assessment and recommend the appropriate approach.
Is MCU firmware recovery legal?
MCU firmware recovery is legal when you own the equipment, have OEM authorization, or are performing it for interoperability under DMCA 1201(f). Recovery for counterfeiting or unauthorized commercial reproduction is illegal. See our PCB reverse engineering authorization article for the full legal framework.
What authorization do I need to submit?
We require proof of ownership (invoice or manifest), a written authorization letter from the OEM/IP holder, and a signed service agreement. For regulated industries (defense, medical, automotive), additional documentation may be required.
How long does MCU firmware recovery take?
Standard turnaround ranges from 5–15 business days for Phase A, 10–15 days for Phase B, and 15–25 days for Phase C. Initial assessment and quotation is provided within 1–2 business days. Rush service is available.
How much does MCU firmware recovery cost?
Pricing depends on MCU family, flash size, protection level, extraction method, and urgency. We provide a free initial assessment and fixed-price quote before any work begins. Phase A is base cost; Phases B and C add surcharges. Volume discounts apply for 5+ units.
What deliverables will I receive after firmware extraction?
You will receive the raw firmware binary (.bin/.hex), decoded firmware with symbols if possible (.elf/.axf), a memory map report, chip ID report, extraction log, and your authorization documentation. For encrypted MCUs, you receive the encrypted binary with a detailed report.
Can you recover firmware from physically damaged MCUs or boards?
Yes, depending on damage extent. We can hot-plate rework MCUs to donor boards for extraction, or perform IC decapsulation if the die is intact. Completely destroyed dies cannot be recovered. Our X-ray PCB reverse engineering service can assess MCU condition non-destructively before submission.
Summary: Key Takeaways
- MCU firmware recovery extracts code from the flash memory of microcontrollers when source code is unavailable
- We support 50+ MCU families: STM32, PIC, AVR, MSP430, NXP, Nordic, Espressif, Renesas, Cypress PSoC, and more
- Three-phase extraction: Phase A (JTAG/SWD, 70–90%), Phase B (glitching, 30–50%), Phase C (decapsulation, 40–70%)
- Authorization required: Proof of ownership or OEM authorization letter before work begins
- Full deliverables package: Binary dump, memory map, chip ID, extraction log, authorization documentation
- IC decapsulation available: Last resort for fully locked or encrypted MCUs
- Free initial assessment: Send us the MCU part number for a likelihood-of-success evaluation
Need to Recover Firmware from a Locked or Legacy MCU?
Send us the PCB or MCU part number for a free initial assessment. We recover firmware from STM32, PIC, AVR, MSP430, and 50+ MCU families using JTAG, SWD, glitching, and chip-off methods. Authorization documentation required before work begins.
[Get a Free Assessment →]
MCU firmware recovery is the bridge between hardware reverse engineering and chip-level analysis. When the software running on a microcontroller is inaccessible — whether through lost source code, locked read protection, or OEM discontinuation — our service extracts it, analyzes it, and delivers it back to you, complete with the documentation needed to program replacement chips or continue development.
