APM32E103 Unlock — What You Need to Know First
The APM32E103 is Geehy Semiconductor’s Cortex-M3 microcontroller, widely used as a drop-in alternative to the STM32F103 in industrial control, motor drives, and consumer electronics. When firmware must be recovered from a read-protected APM32E103, our engineers evaluate the specific protection level, silicon revision, and flash size before committing to a method. APM32E103 unlock is feasible in most cases, but the outcome depends on variables that generic promises cannot cover.
This page explains Geehy’s protection architecture on the APM32E103, what recovery actually involves, realistic cost brackets, expected turnaround, and the authorization requirements we enforce on every engagement.
How Does the APM32E103 Protect Its Firmware?
Geehy’s APM32E103 borrows heavily from the STM32F1xx protection model but is not an exact silicon clone. Key differences in the option-byte layout and flash controller behavior mean that STM32-specific attack vectors do not always transfer directly. Here is what the APM32E103 offers:
| Protection Feature | APM32E103 Implementation | Recovery Impact |
|---|---|---|
| Read-Out Protection (RDP) Level 0 | No protection — flash readable via SWD/JTAG | Trivial readout, no unlock needed |
| RDP Level 1 | Flash read blocked via debug interface; SRAM execution still possible; mass-erase unprotects | Recoverable — non-invasive or semi-invasive methods; high success rate |
| RDP Level 2 (where implemented) | Debug interface permanently disabled; option bytes locked | Requires invasive techniques; success depends on silicon revision |
| Write Protection (WRP) | Per-page write lock via option bytes | Does not block read recovery directly but complicates certain glitch paths |
| Proprietary Boot Mode Lock | System bootloader access can be restricted | Eliminates UART/USB boot-based extraction; alternative entry needed |
Most APM32E103 devices we receive are set to RDP Level 1. At this level, our success rate on recent-revision silicon exceeds 90%. Level 2, when Geehy has actually fused the debug port permanently, demands more advanced work — sometimes including die-level analysis and probing — and success is evaluated case by case.
Why the APM32E103 Is Not Just “Another STM32 Clone”
Engineers sometimes assume that because Geehy markets APM32E103 as pin-compatible with the STM32F103, the same unlock tooling applies. In practice, we have documented several differences that affect firmware recovery:
- Flash controller timing: The APM32E103’s internal flash runs at up to 120 MHz (vs. 72 MHz on STM32F103). Voltage-glitch windows are narrower, requiring tighter fault-injection calibration.
- Option-byte CRC: Geehy adds a secondary validation check on option bytes that is absent in ST’s F1 series. Incorrectly patched option bytes trigger a hard-lock rather than a graceful fallback.
- Silicon revisions: We have seen at least three distinct die revisions (identifiable via DBGMCU_IDCODE). Revision C silicon closes a boot-ROM vulnerability present in Revisions A and B.
- SRAM size variation: The APM32E103xE offers 128 KB SRAM — double the STM32F103xE — which changes payload staging strategies during semi-invasive recovery.
These nuances are why we maintain a dedicated test bench for Geehy parts, separate from our STM32 workflow. If you are working with a GD32 part instead of an APM32, the protection model diverges even further.
APM32E103 Unlock Process — Step by Step
1. Feasibility Assessment (Day 1–2)
You ship the target device or a populated board. Our engineers identify the exact part number (APM32E103VET6, APM32E103RCT6, etc.), read the silicon revision via SWD probe, and determine the active protection level. We report back with a go/no-go recommendation and a firm quote.
2. Non-Invasive Extraction Attempt
For RDP Level 1 devices, we attempt protocol-level exploits first — debug-port glitching, bootloader command sequences, and voltage fault injection on the VDD rail. These methods preserve the original device intact and typically complete within 2–4 working days.
3. Semi-Invasive / Invasive Escalation
If non-invasive methods fail (roughly 10–15% of Level 1 cases, most Level 2 cases), we escalate to decapsulation and micro-probing. The chip package is chemically opened, and direct contact is made with internal bus lines. This adds 3–5 working days and carries a risk of device destruction — we always discuss this before proceeding.
4. Firmware Verification and Delivery
Recovered firmware is delivered as a raw binary (.bin) and Intel HEX (.hex). We verify the dump by comparing CRC32 checksums across two independent reads. Where possible, we also perform a functional re-flash onto a blank APM32E103 to confirm the image boots correctly.
Cost and Turnaround for APM32E103 Unlock
| Scenario | Typical Cost (USD) | Turnaround (Working Days) | Notes |
|---|---|---|---|
| RDP Level 1, Rev A/B silicon | $400 – $700 | 5 – 7 | High success rate; non-invasive |
| RDP Level 1, Rev C silicon | $600 – $1,000 | 7 – 10 | Tighter glitch window; may require semi-invasive |
| RDP Level 2 | $1,200 – $2,500+ | 10 – 20 | Invasive; success not guaranteed; quote after assessment |
| Feasibility assessment only | $0 – $150 | 1 – 2 | Refundable against full engagement |
Pricing depends on flash density (64 KB vs. 256 KB vs. 512 KB), package type (LQFP-48/64/100/144), and whether you need just the binary or a full annotated disassembly. Rush service (≤3 days for Level 1) is available at a 40% surcharge.
Who Needs APM32E103 Firmware Recovery?
Every APM32E103 unlock engagement we accept requires proof of authorization. Typical legitimate scenarios include:
- Original equipment manufacturers who lost source code after a contractor relationship ended and need to recover firmware they own.
- Maintenance teams supporting legacy industrial equipment where the APM32E103 has failed and a replacement must be programmed with identical firmware.
- Product redesign projects migrating from APM32E103 to a newer Geehy or ST part and needing the existing binary as a reference baseline.
- Quality assurance labs verifying that production firmware matches the approved golden image.
We require a signed declaration of ownership or authorization before work begins, and every project is covered by NDA. Read more about our authorization and IP-protection policies if you have compliance questions.
How Does APM32E103 Compare to Other Unlock Targets?
If you work across multiple MCU families, this comparison may help set expectations:
| MCU Family | Protection Complexity | Typical Cost Range | Notes |
|---|---|---|---|
| APM32E103 (Geehy) | Medium | $400 – $2,500 | STM32F1-like but with proprietary quirks |
| STM32F072 (ST) | Medium | $400 – $1,500 | STM32F072 unlock details |
| PIC12F675 (Microchip) | Low–Medium | $300 – $800 | PIC12F675 code-protect recovery |
| MSP430 (TI) | Medium–High | $500 – $2,000 | MSP430 JTAG fuse extraction |
| STM32H750 (ST) | High | $1,000 – $3,000+ | TrustZone adds significant complexity |
The APM32E103 sits in a mid-complexity bracket — easier than modern STM32H7 or Kinetis parts, but harder than legacy 8-bit PICs because of the Cortex-M3 debug authentication handshake.
What Can Go Wrong?
Transparency matters more than a sales pitch. Here are real failure modes we have encountered on APM32E103 recovery:
- Blown debug fuse on Rev C: If RDP Level 2 is set on Revision C silicon and the JTAG/SWD port is permanently disabled at the fuse level, non-invasive recovery is impossible. Invasive methods succeed roughly 60–70% of the time.
- Corrupted flash from prior attempts: Clients who have already attempted mass-erase or voltage-glitch methods without proper equipment sometimes corrupt the flash contents irreversibly. Ship the device to us before experimenting.
- Package damage during decapsulation: LQFP-144 packages are more fragile than LQFP-64 during chemical decap. We mitigate this with controlled acid exposure, but a small percentage of devices (~5%) sustain bond-wire damage.
- Encrypted application layer: Even after flash readout, some firmware images are AES-encrypted at the application level. We recover the raw binary but cannot decrypt proprietary application-layer encryption without the key.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewIs APM32E103 unlock legal?
Recovering firmware from a microcontroller you own or are authorized to access is legal in most jurisdictions. We require signed proof of ownership or a letter of authorization before starting any APM32E103 unlock project. All work is performed under NDA. We do not assist with unauthorized access to third-party intellectual property.
Can you unlock an APM32E103 without destroying the chip?
In most RDP Level 1 cases, yes. Non-invasive voltage-glitch and debug-protocol methods leave the device fully functional. If escalation to invasive (decapsulation) techniques is required — common with RDP Level 2 — the chip is consumed in the process. We always confirm this risk with you before proceeding.
How do I ship my APM32E103 device for unlock?
Ship either the bare IC in an anti-static tube or the populated PCB in ESD-safe packaging. Include a brief description of the protection level if known, the target part number, and your authorization documentation. We accept shipments worldwide via DHL, FedEx, and UPS with tracking. Typical inbound transit adds 2–4 days to the total project timeline.
What if my APM32E103 firmware is application-layer encrypted?
We extract the raw flash contents — including any encrypted payload — and deliver the complete binary image. Application-level decryption requires the original AES or proprietary key, which is outside the scope of a standard unlock engagement. We can advise on next steps if you hold the key material.
Do you also handle APM32F103 or APM32F003 parts?
Yes. The APM32F103 shares most of the APM32E103’s protection architecture and is handled with the same tooling. The APM32F003 (Cortex-M0+) uses a simpler protection model and is generally easier and less expensive to recover. Contact us with your specific part number for a tailored quote.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote