GD32 Unlock: Authorized Firmware Recovery for GigaDevice MCUs
GD32 unlock is the process of recovering firmware from read-protected GigaDevice GD32 microcontrollers — typically when the original source code has been lost, a key engineer has left the company, or a legacy product needs maintenance. Our engineers handle GD32 flash readout across the GD32F1, GD32F3, GD32F4, GD32E1, GD32E2, GD32E5, GD32L2, and GD32W5 families, with success rates that vary by silicon revision and protection configuration. Authorization and proof of IP ownership are required before any work begins.
What Protection Does the GD32 Use?
GigaDevice modeled the GD32 series closely on the ARM Cortex-M architecture and borrowed heavily from STMicroelectronics’ protection paradigm. Most GD32 parts implement a Security Protection (SPC) scheme with two or three levels:
| Protection Level | GD32 Designation | Effect | Unlock Feasibility |
|---|---|---|---|
| Level 0 | SPC OFF | Flash fully readable via SWD/JTAG | No unlock needed — direct readout |
| Level 1 | SPC Level 1 | Flash protected; debug access blocked; mass erase reverts to Level 0 | High — non-invasive or semi-invasive methods, 85–95% success on most series |
| Level 2 | SPC Level 2 (irreversible) | Debug permanently disabled; JTAG/SWD fuses blown; no mass-erase path | Low to moderate — requires invasive techniques; success depends on die revision |
Level 1 is by far the most common configuration we encounter. GigaDevice’s implementation of Level 1 shares structural similarities with STM32F0x2 readout protection, which means techniques proven on one platform often transfer — but GD32-specific silicon quirks require dedicated tooling and verification.
Which GD32 Series Can Be Unlocked?
Not every GD32 variant responds identically. Die shrinks, revised flash controllers, and newer security IP mean that a GD32F103 and a GD32E507 present very different challenges. Below is a practical breakdown by family.
GD32F1xx / GD32F3xx (Cortex-M3 / M4, 108–120 MHz)
These are the most widely deployed GD32 parts and the ones we see most often for firmware recovery. The flash controller in GD32F103 and GD32F303 parts uses a single-bank architecture with option bytes controlling SPC. At Level 1, our non-invasive approach succeeds on roughly 90% of samples, with the main failure mode being parts that have been UV-exposed or have corroded bond pads from harsh-environment deployment. Turnaround is typically 5–8 working days.
GD32F4xx (Cortex-M4, 200–240 MHz)
The GD32F4 series introduced dual-bank flash and a more robust option-byte locking mechanism. Level 1 unlock remains feasible but requires a different glitch timing window than the F1/F3 families. We see about 80–90% success here. Level 2 on the F4 is significantly harder — the fuse structure is tighter, and invasive work carries a 40–60% risk of destroying the die. We always recommend a feasibility evaluation before committing a GD32F450 or GD32F470 sample.
GD32E1xx / GD32E2xx / GD32E5xx (Cortex-M23 / M33)
GigaDevice’s “E” series targets IoT and industrial applications. The E1/E2 parts use a simplified SPC scheme similar to the F1, and unlock success rates are comparable at Level 1. The GD32E5 series, however, incorporates TrustZone-M with a secure/non-secure flash partition. If only the non-secure region is protected at Level 1, recovery is straightforward. If the secure partition is involved, the process becomes semi-invasive and the timeline extends to 10–15 days.
GD32W5xx (Wi-Fi SoC)
The GD32W515 integrates a Cortex-M33 core with on-chip Wi-Fi. Its security model includes an OTP key area and encrypted flash support. When AES-encrypted flash is enabled, a raw binary dump is insufficient — you also need the original key, which typically cannot be recovered non-invasively. For non-encrypted, SPC Level 1 configurations, unlock feasibility is moderate (70–80%).
GD32L2xx (Ultra-Low-Power)
The L2 family is relatively new. We have limited sample data, but early results on GD32L233 parts at SPC Level 1 show success rates around 75–85%. We continue to refine our tooling for this family and offer free feasibility assessments for L2 samples.
How Does the GD32 Unlock Process Work?
Every GD32 unlock engagement follows a structured workflow designed to protect both the client’s IP and the physical sample:
- Authorization verification — You provide proof of ownership or a signed authorization letter. We countersign an NDA. No exceptions.
- Feasibility assessment — We identify the exact part number, read the device ID and option bytes (where accessible), and determine the SPC level. This step is free and non-destructive.
- Technique selection — Based on the series, die revision, and protection level, our engineers select the appropriate method: non-invasive (protocol-level), semi-invasive (decapsulation + optical/electrical probing), or invasive (FIB or microprobing).
- Firmware extraction — The flash contents are read out and verified with a CRC/checksum against the device’s internal flash size register.
- Delivery — You receive a verified binary (.bin or .hex), along with option-byte configuration data and, where applicable, a disassembly map.
For clients who also need the broader board recovered, our STM32L1 unlock page describes a similar workflow — many GD32 boards are direct drop-in replacements for STM32 designs, and we frequently handle both MCU families on the same project.
Cost and Lead Time for GD32 Unlock
Pricing depends primarily on the protection level and the specific GD32 series. Here are realistic ranges based on recent project data:
| Scenario | Typical Cost (USD) | Lead Time (Working Days) |
|---|---|---|
| GD32F1/F3 — SPC Level 1 | $400 – $800 | 5 – 8 |
| GD32F4 — SPC Level 1 | $600 – $1,200 | 7 – 12 |
| GD32E1/E2 — SPC Level 1 | $400 – $900 | 5 – 10 |
| GD32E5 — SPC Level 1 (non-secure only) | $800 – $1,500 | 8 – 15 |
| GD32W5 — SPC Level 1, no encryption | $900 – $1,600 | 10 – 15 |
| Any GD32 — SPC Level 2 (invasive) | $2,000 – $5,000+ | 15 – 30 |
Level 2 jobs are quoted individually after the feasibility assessment because the risk of sample destruction is real. We charge only on success for Level 2 attempts, but clients must supply at least two samples.
GD32 vs. STM32: Does the STM32 Compatibility Help?
GigaDevice designed the GD32F103 as a pin-compatible, register-compatible alternative to the STM32F103. This means the flash controller registers, option-byte layout, and SWD interface are nearly identical. In practice, about 70% of the tooling we developed for STM32F0/F1/F3 readout protection bypass transfers directly to the equivalent GD32 part — but “nearly identical” is not “identical.” Differences in internal voltage regulators, flash wait states, and clock tree behavior mean that glitch parameters must be re-characterized per GD32 lot.
If you are working with other Chinese-designed ARM MCUs, our engineers also handle CH32 firmware recovery (WCH parts) and APM32 unlock (Geehy/Apex Microelectronics), both of which share the STM32-compatible lineage.
What Can Go Wrong?
Transparency matters. Here are the real failure modes we encounter during GD32 unlock:
- Die damage from prior attempts — If someone has already tried to decapsulate or probe the chip, bond wires or flash cells may be compromised. We see this in about 10% of samples that arrive from other labs.
- Newer silicon revisions — GigaDevice periodically updates the die without changing the part number. A GD32F103CBT6 manufactured in 2024 may have a different flash controller than one from 2019. We maintain a revision database, but occasionally a brand-new revision requires additional R&D time.
- Encrypted flash (GD32W5/E5) — If AES encryption is active, we can dump the ciphertext but not the plaintext without the key. We will tell you this upfront during feasibility.
- Counterfeit parts — The GD32F103 is one of the most counterfeited MCUs on the market. If the die inside is actually a remarked STM32 or a different GD32 variant, the unlock approach changes entirely. We always verify the die before proceeding.
When Should You Consider GD32 Unlock?
Common legitimate scenarios include recovering firmware from a discontinued product for which the original developer is unavailable, extracting code from a prototype when the repository was lost, or reading back production firmware to verify that a contract manufacturer programmed the correct version. If you are maintaining legacy equipment that uses GD32-based control boards, the same recovery workflow applies — similar to how engineers approach MSP430 firmware recovery for older TI-based designs.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions About GD32 Unlock
Is GD32 unlock legal?
Yes, when performed on firmware you own or are authorized to access. We require proof of IP ownership or a signed authorization letter before starting any GD32 unlock project. All work is covered by NDA. We do not assist with extracting third-party proprietary code without authorization.
Can you unlock a GD32 at SPC Level 2 without destroying the chip?
It depends on the specific series and die revision. Level 2 permanently disables the debug interface, so invasive techniques (decapsulation, microprobing, or FIB circuit editing) are required. These carry a 20–60% risk of sample destruction depending on the part. We recommend providing at least two identical samples for Level 2 attempts.
How do I know if my GD32 is at Level 1 or Level 2?
If you can still connect via SWD and the debugger reports “device is protected,” the part is almost certainly at Level 1. At Level 2, the SWD interface does not respond at all — the device ID cannot be read. Our free feasibility check confirms the exact protection state within 1–2 working days.
Do you need to remove the chip from the PCB?
For Level 1 non-invasive methods, the chip can sometimes remain on the board if the SWD pins are accessible. For semi-invasive or invasive work, we always desolder the MCU. We can reball and resolder it afterward if the board needs to remain functional.
What file format will I receive?
Standard deliverables include a raw .bin file and an Intel .hex file covering the full flash range. We also provide the option-byte dump and, on request, a basic disassembly listing with vector table annotation. For GD32 parts with separate SRAM-based bootloader regions, those sections are included as well.
Related MCU Unlock Services
If your project involves multiple MCU families or you are evaluating alternatives, these pages cover related chips our lab handles regularly:
- ESP32 firmware extraction — Espressif’s flash encryption and secure boot present a different challenge set.
- PIC18 code protection recovery — Microchip’s CP bits on 8-bit PIC parts.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote