A typical IC decryption project runs 3 to 15 working days from authorization to verified delivery, and 15 to 40 when the die must be opened and probed. The clock does not start when the chip arrives. It starts when ownership is confirmed, and it is driven less by the read itself than by the protection class and the samples you can supply.
For a team planning downtime or a last-time-buy decision, the schedule matters more than the price.
The Five Stages Behind Any Quoted Lead Time
| Stage | What happens | Working days |
|---|---|---|
| Feasibility | Part number, date code and marking checked against known silicon revisions | 1–2 |
| Authorization | Ownership evidence or signed authorization; mutual NDA | 1–2 |
| Inspection | Marking, package and die revision confirmed | 1–3 |
| Extraction | Method dependent (see below) | 2–25 |
| Verification | Binary, address map, checksum report and option bytes | 1–2 |
Only extraction scales with difficulty, so a quote that collapses everything into one figure hides the stage you control. Authorization is not paperwork either: readout applies only to hardware you own or are authorised in writing to service.
Method Class Drives the Longest Stage
| Approach | What it involves | Samples | Working days |
|---|---|---|---|
| Non-invasive | Debug port or bootloader access, or a controlled power event | 1 | 2–8 |
| Semi-invasive | Package opened, die accessed optically | 1–2 | 5–15 |
| Invasive | Die prepared and instrumented for direct contact | 2–5 | 15–40 |
Every escalation costs calendar days and samples, so labs escalate only as far as the data requires and treat IC decapsulation as a stage, not an opening move. Protection sets the entry point — MCU readout protection at a single lock bit never reaches probing, while a shielded device is scheduled for the invasive tier from day one. Parts that resist semi-invasive extraction are quoted at that tier immediately.
Five Things That Quietly Add a Week
- One sample only. Probing consumes parts, so spares mean retries.
- Markings that do not match. Sanded or re-marked dies must be identified first.
- An unlisted silicon revision. A solved family can shift behaviour after a die shrink.
- Encrypted program memory. The read can succeed and still return ciphertext.
- Shipping and customs. Transit and clearance can outlast the engineering.
Physically compromised parts need a damage assessment first: sometimes the question is whether you can recover firmware from a damaged part at all.
What “Finished” Has to Mean
A shortened timeline is worthless if the binary is wrong. Completion means a read-consistency check, the option bytes and fuse state recovered with the code, and a functional test on a blank part where practical. A schedule with no room for that is optimistic, not fast.
Compressing the Calendar Without Cutting Corners
Three levers belong to the buyer: order feasibility before shipping, send two or three identical units including one working board, and state the deadline and its reason so urgency lands on the stage that is late.
FAQ
How long does chip decryption take for a standard MCU?
Well-characterised 8-bit and low-end 32-bit parts usually land between 3 and 15 working days. The spread is the point: a PIC16 with one code-protect bit and a Cortex-M4 with encrypted flash can differ by weeks.
Can a project be rushed?
Rush terms compress queue time and inspection, not research. A revision the lab has never solved cannot be accelerated by working nights.
Does a longer timeline mean a higher price?
Both follow method class and sample count, so slow projects usually cost more. A credible lab separates feasibility from extraction because the honest answer may be no.
Plan the Schedule Before You Ship
Send the part number, the marking and a photo of the package. We will return a feasibility opinion, the method class your part falls into, and a working-day estimate before anything ships — start with a feasibility assessment or request a free assessment directly.