COB Chip Recovery: Can Firmware Be Read From a Blob IC?

COB chip recovery is usually possible: the black epoxy blob is a package, not a protection mechanism, and removing it exposes the same silicon you would find inside a QFP part. What decides the outcome is that the die underneath carries no part marking, no date code and often no vendor logo – the lab has to identify the chip before any read attempt is worth making.

Chip-on-board is the cheapest way to mount a die in volume, so it dominates toys, appliances, power tools, multimeters and motor controllers – products whose documentation disappears first. When the design house has closed, the blob is the only surviving copy of the firmware.

COB chip recovery is usually possible: the black epoxy blob is a package, not a protection mechanism, and removing it exposes the same silicon you would find inside a QFP part. What decides the outcome is that the die underneath carries no part marking, no date code and often no vendor logo - the lab has to identify the chip before any read attempt is worth making.Chip-on-board is the cheapest way to mount a die in volume, so it dominates toys, appliances, power tools, multimeters and motor controllers - products whose documentation disappears first. When the design house has closed, the blob is the only surviving copy of the firmware.
COB chip recovery is usually possible: the black epoxy blob is a package, not a protection mechanism, and removing it exposes the same silicon you would find inside a QFP part. What decides the outcome is that the die underneath carries no part marking, no date code and often no vendor logo – the lab has to identify the chip before any read attempt is worth making.
Chip-on-board is the cheapest way to mount a die in volume, so it dominates toys, appliances, power tools, multimeters and motor controllers – products whose documentation disappears first. When the design house has closed, the blob is the only surviving copy of the firmware.

What Is Actually Under the Blob

A COB module holds a bare die bonded straight to the PCB: die-attach adhesive, 18–50 µm gold or aluminium wire to the board pads, then a dispensed epoxy glob. No leadframe, no cavity, no marking step.

Property Packaged MCU COB module
Identification Laser marking, date code None; house mask code at best
Die access Open the package Remove the glob from the board
Bond wires Gold or copper, enclosed 18–50 µm Au or Al, exposed

Why Identification Comes Before Extraction

Four observations narrow the field before anything is opened: bond-pad count and footprint, a crystal rather than an internal RC oscillator, power and ground routing, and which buses the die drives. A 28-pad die driving an LCD differs sharply from a 64-pad part with an external memory bus.

House-masked ASICs are the hard case: metering dies such as the FS9721 and ES51922 families are custom silicon with no public instruction set, so the realistic deliverable is a description of behaviour, pinout and timing rather than a binary.

How Access and Reading Work

Glob removal is matched to the epoxy chemistry and wire material. Copper bond wire reacts with the reagents that dissolve epoxy, so the process window is narrower than with gold: two modules that look identical outside carry different risk.

Once the die is exposed and identified, recovery becomes a matter of reading the program memory under whatever protection is active:

  • No protection — direct access; the limit is mechanical.
  • Readout protection, level 1 — downgrading forces a mass erase, so readout protection levels apply on a blob exactly as on a leaded part.
  • OTP fuse or encrypted flash — semi-invasive extraction territory: lower yield and a real chance of a no.

What Decides Whether It Works

Five factors separate a clean job from a wasted one: whether the die is identified to family and revision, whether bond wires survive removal, the protection state, the program memory type, and how many identical boards you can supply. Outcomes fall into four classes: full image with checksum; partial image with documented gaps; behavioural description; not feasible — stated before work starts, which is still an answer.

Because IC decapsulation consumes the unit it opens, send two boards where possible.

FAQ

Can a blob chip be read without removing the epoxy?

Rarely. The array and any test pads sit under the glob, so in-circuit work captures behaviour but not memory contents. Plan on physical access.

Does removing the glob destroy the chip?

The die usually survives; the assembly does not. The module cannot be reflowed back onto the board, so budget for losing that unit.

Is COB recovery more expensive than a packaged part?

Generally yes, and the premium is labour: identification hours plus a narrower process window. A marked package often goes straight to extraction.

Next Step

If a board carries a blob and its firmware is the only asset you still have, send the pad count, a module photo and what the device does – usually enough to say whether recovery is realistic. Work runs only on hardware you own or are authorised in writing to service, so contact us with the details.