AirMCU AIR32 Crack — What Is Actually Possible?
The AirMCU AIR32 crack refers to authorized firmware readout from the AIR32F103 series — a Cortex-M4 MCU produced by Luat (合宙) that is pin- and register-compatible with STM32F103 but runs at up to 256 MHz with 256 KB Flash and 96 KB SRAM. Because AIR32 borrows the STM32-style RDP (Read-out Protection) architecture, its protection levels follow a similar three-tier model. Whether recovery succeeds depends entirely on which RDP level was set at production time and whether the option bytes remain intact.
AIR32F103 Protection Level Overview
AirMCU documents three discrete protection states in the AIR32F103 reference manual. Each level restricts a different combination of debug, SRAM boot, and Flash read access. The table below summarizes what each level permits and blocks.
| Protection Level | RDP Byte Value | SWD / JTAG Access | Flash Read via Debug | SRAM Boot Read-back | Recovery Feasibility |
|---|---|---|---|---|---|
| Level 0 (No Protection) | 0xA5 | Full | Allowed | Allowed | Trivial — direct read |
| Level 1 (Read Protection) | Any value ≠ 0xA5, ≠ 0xCC | Limited | Blocked | Blocked while Flash selected | Moderate — technique-dependent |
| Level 2 (Permanent) | 0xCC | Fully disabled | Blocked | Blocked | Extremely difficult; not guaranteed |
Most production AIR32 boards ship at Level 1. Level 2 is rare in the field because it is irreversible — even the manufacturer cannot downgrade it. Our engineers see Level 2 on fewer than 5% of AIR32 samples submitted for recovery.
How Does AIR32 RDP Differ from STM32F103?
Although the register map looks familiar, the AIR32F103 silicon is not a literal STM32 die. Key differences that affect an AirMCU AIR32 crack attempt include:
- Flash controller timing: AIR32 runs its internal Flash at higher clock speeds (up to 256 MHz vs. 72 MHz). Glitch-based attacks must account for tighter timing windows — typically 2–4 ns margins instead of 8–12 ns on genuine STM32F103.
- Option-byte layout: The option-byte block sits at the same base address (0x1FFF F800) but the complementary-byte validation logic has subtle errata in early silicon revisions (pre-2022 lots). This can actually make Level 1 recovery easier on those batches.
- Boot ROM: The built-in bootloader supports UART (USART1) and, on some packages, USB DFU. The bootloader respects RDP — it will not dump Flash at Level 1 — but the handshake sequence is a potential side-channel vector our lab exploits under controlled conditions.
- Die markings: Some AIR32F103 chips are re-marked. Confirming the actual die before committing to a technique saves time and cost. We decap a sample when the lot code is ambiguous.
Level 1 Recovery: Our Typical Approach
For Level 1 AIR32 parts, our engineers follow a multi-step protocol:
- Option-byte inspection — Read the option bytes via SWD to confirm the exact RDP value and verify no write-protection (WRP) bits are additionally set on specific Flash pages.
- Voltage-glitch profiling — Using a sub-nanosecond pulse injector on VDD during the RDP-check window of the boot sequence, we attempt to force the Flash controller into an unprotected state. Success rate on AIR32 Level 1 is historically above 80% in our lab, though each batch may require re-calibration.
- Firmware dump and verification — Once access is obtained, the full 256 KB Flash image is read out, CRC-checked against the internal checksum (if the application stores one), and delivered as a binary (.bin) and Intel HEX (.hex) file.
- Option-byte restoration — The chip is returned to its original RDP state so the client can re-deploy it if needed.
Turnaround for Level 1 AIR32 firmware recovery is typically 5–8 working days from sample receipt, assuming no re-marking surprises.
Level 2 Reality Check
Level 2 permanently disables the debug port at the hardware level. On genuine STM32F103 parts, Level 2 is considered uncrackable without invasive die-level techniques (FIB, laser fault injection). The AIR32 die is different, and our lab has had partial success on specific early-revision lots using UV exposure combined with micro-probing. However, we do not guarantee Level 2 recovery and will always run a free feasibility assessment before quoting. If our analysis shows the protection is intact and the die revision is hardened, we will tell you upfront rather than waste your budget.
What You Receive After a Successful AIR32 Crack
| Deliverable | Format | Notes |
|---|---|---|
| Full Flash image | .bin + .hex | Byte-for-byte copy, 256 KB max |
| Option-byte dump | .txt | RDP, WRP, watchdog, nRST config |
| SRAM snapshot (if requested) | .bin | Captured at reset vector entry |
| Disassembly listing (optional add-on) | .asm / .elf | Cortex-M4 Thumb-2 disassembly with vector table annotation |
All files are delivered encrypted via our NDA-protected portal. We retain no copies after 30 days unless the client requests archival.
Authorization and Legal Requirements
We perform AirMCU AIR32 crack services only for authorized parties — original firmware owners recovering lost source, OEMs maintaining legacy products, or engineers with documented proof of IP ownership. Every engagement begins with an NDA and a signed authorization form. If you are unsure whether your use case qualifies, contact us for a confidential review before shipping any samples.
How AIR32 Compares to Other Budget Cortex-M MCUs
The AIR32F103 competes with several low-cost Cortex-M parts that share similar protection architectures. If your project involves multiple MCU families, these references may help:
- Puya PY32 protection and recovery details — another ultra-low-cost Cortex-M0+ with a simpler two-level RDP scheme.
- Bouffalo BL602 crack considerations — a RISC-V + Wi-Fi combo chip with eFuse-based protection, very different attack surface.
- Nuvoton M051 firmware recovery — Cortex-M0 with flash lock bits; moderate difficulty at Level 1.
- Renesas RA2 series unlock notes — Cortex-M23 with TrustZone-lite, a step up in protection complexity.
Frequently Asked Questions
Can the AIR32F103 be read out if only Level 1 RDP is set?
In most cases, yes. Level 1 on the AIR32 blocks debug-port Flash reads but does not disable the debug port entirely. Our voltage-glitch technique bypasses the RDP check during the boot sequence. Success depends on the specific silicon revision and batch, which is why we run a feasibility check on every sample before committing to a full extraction.
How much does an AirMCU AIR32 crack cost?
Pricing depends on the confirmed protection level. Level 0 (unprotected) readout starts at approximately $150 for the service and verification. Level 1 recovery typically ranges from $400–$900 depending on batch complexity. Level 2 attempts, when feasible, are quoted individually after lab analysis. The initial feasibility evaluation is free.
Is the AIR32F103 truly identical to the STM32F103?
No. The AIR32F103 is pin-compatible and largely register-compatible, but it uses a different die manufactured on a different process node. It runs at up to 256 MHz (vs. 72 MHz), has 96 KB SRAM (vs. 20 KB), and its Flash controller has distinct timing characteristics. These differences directly affect which physical attack techniques work, so STM32-specific tools and scripts often need modification for AIR32.
Do I need to send the physical chip or can you work from a board?
We accept both loose chips and populated PCBs. If sending a complete board, ensure the SWD pins (SWDIO, SWCLK, GND, VDD) are accessible or document their test-point locations. We will not desolder the chip unless invasive analysis is required and you have approved it.
What if my chip turns out to be a re-marked STM32?
We verify the die identity before starting any extraction. If the part is actually an STM32F103 rather than a genuine AIR32, we will notify you and adjust the technique and quote accordingly. Re-marked parts are common in the budget MCU supply chain, and our decap inspection catches them early.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote