AirMCU AIR32 Unlock — What Engineers Need to Know
The AirMCU AIR32 series (AIR32F103 family) can be unlocked in most cases when read-protection level 1 (RDP-1) is set. Our engineers use a combination of debug-interface exploitation and voltage-glitch techniques to recover firmware from protected AIR32 devices, typically within 5–10 working days at a starting cost of around $400. Authorization and proof of ownership are required before any work begins — see our NDA and IP-authorization policy for details.
What Is the AirMCU AIR32 and Why Does It Matter?
AirMCU (a brand of Luat / Air modules by Shanghai Hezhou Electronics) designed the AIR32F103 as a pin-compatible, higher-clock-rate alternative to the STM32F103. It runs an ARM Cortex-M3 core at up to 256 MHz, offers 128–256 KB of on-chip flash, and targets cost-sensitive IoT, industrial-control, and consumer-electronics designs. Because it is a near-drop-in replacement for the STM32F103, many production boards migrated to AIR32 to reduce BOM cost — and the original firmware source was sometimes lost in the transition.
The chip’s read-protection mechanism closely mirrors STMicroelectronics’ RDP scheme, but the silicon implementation differs in timing margins and boot-ROM behavior. Those differences create both opportunities and constraints during an unlock attempt.
How Does AIR32 Flash Protection Work?
The AIR32F103 implements two meaningful protection states:
- RDP Level 0 (unprotected): Flash is freely readable through SWD/JTAG. No unlock needed.
- RDP Level 1: Debug access is blocked; flash cannot be read externally. However, a mass-erase command can reset protection back to Level 0 — destroying the stored firmware. This is the state most production boards ship in.
Unlike STM32F1 parts that also support an RDP Level 2 (permanent, irreversible lock), the AIR32F103 datasheet does not define a true Level 2 state. In practice, some revisions allow the option-byte to be written to the Level-2 pattern, but silicon behavior varies by fab lot. We test each submitted device individually before committing to a full extraction attempt.
Protection-Related Option Bytes
| Option Byte | Address | Function |
|---|---|---|
| RDP | 0x1FFF F800 | Read-protection level (0xA5 = unprotected) |
| nRDP | 0x1FFF F801 | Complement of RDP byte |
| WRP0–WRP3 | 0x1FFF F808–F | Per-sector write-protect flags |
| USER | 0x1FFF F802 | Watchdog / stop / standby config |
Write-protect (WRP) bits do not block read access on their own but can complicate in-system patching techniques that some unlock methods rely on.
AirMCU AIR32 Unlock Techniques — Our Approach
Because the AIR32F103 shares architectural DNA with the STM32F1 but uses a different flash controller IP block, generic STM32 unlock scripts do not work out of the box. Our lab applies a tailored workflow:
- Non-invasive probe: We connect via SWD and attempt a low-level handshake to confirm the exact RDP state, silicon revision, and flash size.
- Voltage-glitch campaign: A precisely timed supply-voltage transient during the boot-ROM’s RDP-check routine can cause the protection flag to be misread. On AIR32 silicon, the effective glitch window is roughly 8–15 ns at the 256 MHz core clock — tighter than the ~20 ns window on a 72 MHz STM32F103.
- Firmware dump and verification: Once the debug port opens, flash contents are read out and CRC-verified against the on-chip checksum (if stored). We deliver a verified binary image.
If voltage glitching fails after a statistically meaningful number of attempts (typically 50,000+ iterations), we escalate to a semi-invasive approach — decapping the die and using UV or laser fault injection on the flash-sense amplifier. This raises cost but keeps success rates above 85 % for RDP-1 devices.
What Can Go Wrong
- Unmarked silicon revisions: Some AIR32F103 batches use a revised flash controller with tighter glitch tolerance. Initial probe identifies this; it adds 2–3 days.
- Damaged SWD pads: If the target board has severed or corroded debug traces, we rework connections directly to the die pads — possible but adds rework time.
- Encrypted application layer: Even after a successful flash readout, some firmware uses application-level AES encryption. We deliver the raw binary; decrypting an application-layer cipher is a separate engagement.
Cost and Turnaround for AIR32 Firmware Recovery
| Scenario | Typical Cost (USD) | Lead Time (working days) |
|---|---|---|
| RDP-1, standard glitch unlock | $400 – $650 | 5 – 8 |
| RDP-1, semi-invasive (decap + FIB/UV) | $900 – $1,500 | 8 – 15 |
| Unknown protection, feasibility study first | $0 (free assessment) + unlock fee | 2 – 3 (assessment) + unlock |
| Rush service (≤ 3 days) | +50 % surcharge | 3 |
We charge nothing for the initial feasibility check. If we determine the device cannot be unlocked — for example, a true Level-2 fuse blow on an unusual silicon revision — you pay nothing and get the device back.
Who Requests an AirMCU AIR32 Unlock?
Typical clients include hardware startups that outsourced firmware development and lost access to source code, contract manufacturers recovering a production image after a supplier dispute, and field-service teams maintaining legacy IoT gateways built on AIR32 modules. Authorization documentation (purchase orders, design files, or a signed declaration of ownership) is required before we begin.
How the AIR32 Compares to Similar Budget Cortex-M3 Parts
Engineers migrating between low-cost Cortex-M3 alternatives often ask how unlock difficulty compares. The table below summarizes key differences:
| MCU | Core / Max Clock | Flash Protection | Unlock Difficulty |
|---|---|---|---|
| AirMCU AIR32F103 | Cortex-M3 / 256 MHz | RDP-1 (RDP-2 uncertain) | Moderate |
| GigaDevice GD32F103 | Cortex-M3 / 108 MHz | SWD lock + OB protect | Moderate |
| Puya PY32F003 | Cortex-M0+ / 48 MHz | RDP-like single level | Low–Moderate |
| Nuvoton M051 | Cortex-M0 / 50 MHz | Security lock bit | Moderate |
If you also need to recover firmware from a GigaDevice GD32 protected device or a Puya PY32 series chip, we handle those with related but distinct workflows — glitch timing and boot-ROM entry sequences differ on each vendor’s silicon.
Deliverables You Receive
- Raw binary image (.bin): Byte-for-byte copy of the flash contents, verified by CRC.
- Intel HEX (.hex): Address-mapped format ready for re-programming via ST-Link, J-Link, or the AIR32 ISP bootloader.
- Option-byte dump: Full snapshot of RDP, WRP, and USER configuration so you can replicate the original protection settings on a new device.
- Technical report: Silicon revision, protection state found, method used, and any anomalies observed.
Authorization and Legal Requirements
We perform AIR32 unlock work only for the rightful IP owner or an authorized agent. Before starting, you will need to provide one of the following: a signed declaration of firmware ownership, original purchase documentation for the hardware and development, or a letter of authorization from the IP holder. All projects are covered by mutual NDA. For a full explanation of our compliance framework, visit our trust and authorization page.
Related MCU Unlock Services
Our lab supports a wide range of Cortex-M devices beyond the AIR32. If your product line spans multiple MCU vendors, these pages detail the specifics:
- Nuvoton M051 flash-lock removal — similar Cortex-M0 protection scheme
- Nordic nRF53 series unlock — dual-core Cortex-M33 with APPROTECT
- EFM32PG unlock and readout — Silicon Labs Cortex-M4 with Debug Lock
Can the AIR32F103 be unlocked without erasing the firmware?
Yes, in the vast majority of RDP-1 cases. Our glitch-based and semi-invasive methods bypass the read-protection check without triggering a mass erase, preserving the full flash image. If the device is in an unusual protection state that makes non-destructive readout impossible, we inform you before proceeding.
Is the AIR32 unlock process the same as STM32F103 unlock?
Not exactly. While the AIR32F103 is register-compatible with the STM32F103, its flash controller timing, boot-ROM behavior, and glitch-susceptibility window differ. Scripts and parameters tuned for genuine STM32 silicon will not produce reliable results on AIR32 — our tooling is calibrated specifically for each vendor’s implementation.
How do I know if my AIR32 chip has RDP Level 1 or Level 2?
Connect via SWD using an ST-Link or J-Link probe. If the debugger reports “cannot connect — access port locked,” the device is at least RDP-1. Distinguishing RDP-1 from a possible Level-2 state requires reading the option-byte area through our specialized low-level probe. We perform this check free of charge as part of our feasibility assessment.
What if my AIR32 firmware is also encrypted at the application level?
Flash-level unlock gives you the raw binary stored in memory. If the developer added AES or other software encryption on top, the extracted binary will contain ciphertext for those sections. We can assist with analysis, but application-layer decryption is quoted separately and depends on the encryption scheme used.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote