APM32F103 Unlock: What You Need to Know Before Submitting
The APM32F103 from Geehy Semiconductor is an ARM Cortex-M3 microcontroller widely used as a pin-compatible alternative to the STM32F103. APM32F103 unlock — authorized firmware readout from a read-protected device — is feasible on most variants thanks to well-understood protection architecture. Our engineers recover flash contents from Level 1 protected APM32F103 devices with a success rate above 85%, typically within 5–10 working days, at costs starting around $400. Below we cover the technical specifics, limitations, and what to prepare before requesting a feasibility evaluation.
How Does the APM32F103 Protect Its Firmware?
Geehy’s APM32F103 series implements a two-tier read-protection scheme in its option bytes, closely mirroring the STM32F1xx model but with implementation differences that matter during recovery:
| Protection Level | Option Byte Value (RDP) | Effect | Unlock Feasibility |
|---|---|---|---|
| Level 0 (unprotected) | 0xA5 | Full JTAG/SWD read access | No unlock needed — direct read |
| Level 1 | Any value ≠ 0xA5 and ≠ 0xCC | Flash read-out blocked via debug; flash erased if RDP reverted to Level 0 | High — 85%+ success |
| Level 2 | 0xCC | Debug interface permanently disabled; option bytes locked | Low — requires invasive techniques, case-by-case |
Most production APM32F103 boards ship at Level 1. This is the sweet spot for recovery: the debug port is restricted but not permanently fused. Level 2 is irreversible at the silicon level and demands die-level microprobing — success is not guaranteed and costs rise significantly.
APM32F103 vs. STM32F103: Protection Differences That Matter
While Geehy markets the APM32F103 as an STM32F103 drop-in replacement, the flash controller and option-byte handling are not identical at the register level. Key differences our team has documented:
- Flash wait-state timing: APM32F103 runs its flash at up to 96 MHz (vs. 72 MHz on STM32F103), altering glitch-timing windows.
- Boot ROM behavior: The system bootloader in APM32F103 has different entry conditions and UART handshake timing, affecting serial-based extraction paths.
- Option byte write sequence: Geehy uses a slightly different unlock/erase/program sequence in the FMC (Flash Memory Controller) compared to ST’s FPEC, meaning STM32-targeted tools often fail silently on APM32 parts.
These nuances are why generic “STM32 unlock” services frequently fail on APM32F103 devices. Our lab maintains Geehy-specific toolchains and has processed multiple APM32F1xx variants since 2022.
Which APM32F103 Variants Can Be Unlocked?
The APM32F103 family spans several flash/package combinations. Feasibility varies slightly by sub-variant:
| Part Number | Flash Size | Package | Level 1 Feasibility | Notes |
|---|---|---|---|---|
| APM32F103C8T6 | 64 KB | LQFP-48 | High | Most common variant we receive |
| APM32F103CBT6 | 128 KB | LQFP-48 | High | Larger flash, same protection scheme |
| APM32F103RCT6 | 256 KB | LQFP-64 | High | Dual-bank flash — recovery takes slightly longer |
| APM32F103RET6 | 512 KB | LQFP-64 | Moderate–High | Larger read window; occasional bank-boundary issues |
| APM32F103VET6 | 512 KB | LQFP-100 | Moderate–High | Same die as RET6, different pinout |
| APM32F103ZET6 | 512 KB | LQFP-144 | Moderate | Rare; requires additional verification passes |
If your specific part number is not listed, submit a feasibility request similar to the GD32E230 process — we evaluate every Geehy variant individually and report back within 1–2 business days.
APM32F103 Unlock Process: Step by Step
1. Authorization and Intake
We require proof of ownership or written authorization before starting any firmware recovery. This can be a purchase order, design documentation, or a signed declaration that you hold IP rights to the firmware. An NDA is executed before any binary is delivered.
2. Initial Assessment (1–2 Days)
Our engineers verify the exact part marking, confirm the RDP level via non-destructive SWD probing, and check for additional software-level protections (e.g., custom bootloader locks, encrypted payloads in flash). You receive a feasibility report with a quoted price and estimated timeline.
3. Firmware Extraction (3–7 Days)
For Level 1 devices, extraction uses proprietary non-invasive techniques targeting the APM32F103’s flash controller. The process is non-destructive — your chip remains functional after readout. For Level 2, invasive methods (decapsulation, microprobing) are discussed separately, and the chip is consumed in the process.
4. Verification and Delivery
Recovered firmware is verified against a CRC32 checksum of the original flash and, where possible, test-programmed onto a blank APM32F103 to confirm functional equivalence. Deliverables include the raw .bin or .hex file and a brief extraction report.
Cost and Turnaround for APM32F103 Unlock
| Scenario | Typical Cost (USD) | Turnaround (Working Days) |
|---|---|---|
| Level 1, 64–128 KB flash | $400 – $700 | 5 – 8 |
| Level 1, 256–512 KB flash | $600 – $1,000 | 7 – 10 |
| Level 2 (invasive) | $1,500 – $3,500+ | 15 – 25 |
| Rush service (Level 1 only) | +50% surcharge | 3 – 5 |
Pricing depends on flash size, protection level, and whether additional analysis (disassembly annotation, EEPROM companion reads) is requested. We quote firm prices after the initial assessment — no hidden fees.
What Can Go Wrong?
Transparency matters. Here are realistic failure modes we have encountered on APM32F103 recovery projects:
- Misidentified silicon: Some boards labeled “STM32F103” actually carry remarked APM32F103 dies (or vice versa). Misidentification leads to wrong extraction parameters. We always verify the die under magnification.
- Corrupted option bytes: Power interruption during a previous flash operation can leave option bytes in an indeterminate state, causing the RDP level to read inconsistently. Recovery is still possible but adds 2–3 days.
- Level 2 with no fallback: If the device is truly at Level 2, non-invasive methods will not work. Invasive success depends on die revision and process node — Geehy’s 2021-era wafers have shown better probe-pad accessibility than 2023 revisions.
- Encrypted payloads: Even after a successful flash dump, some firmware is AES-encrypted by the application layer. We deliver the raw binary; decryption is the owner’s responsibility unless contracted separately.
When Is APM32F103 Unlock the Right Move?
Common authorized use cases our clients bring to us:
- Legacy product maintenance: Original firmware source lost; production line needs reflash capability for field returns.
- Second-source qualification: Verifying that a contract manufacturer programmed the correct firmware revision.
- Prototype recovery: Engineering samples with pre-production firmware that was never archived.
- Failure analysis: Reading back flash to diagnose field failures or compare against known-good binaries.
If your project involves companion EEPROM or serial flash on the same board — for example, a 24C256 I²C EEPROM or a W25Q64 SPI flash — we can extract those in the same engagement, often at a bundled rate.
Related Cortex-M3 and Alternative-Vendor Unlocks
Engineers working with STM32-compatible ecosystems often need recovery across multiple vendor parts in the same product family. Our lab handles several related devices:
- STM32WB55 firmware recovery — dual-core BLE part with additional secure-element considerations.
- EFM32G Gecko series unlock — Silicon Labs’ low-power Cortex-M3 with its own debug-lock mechanism.
- SAMD20 Cortex-M0+ recovery — Microchip’s entry-level ARM with NVM-based security bits.
Each vendor implements read protection differently, so cross-vendor experience is critical for first-attempt success.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewIs APM32F103 unlock legal?
Firmware readout is legal when performed on devices you own or for which you hold explicit authorization from the IP holder. We require documented proof of ownership or a signed authorization letter before starting work, and all deliverables are covered by NDA. This service is intended for legitimate recovery, maintenance, and failure-analysis purposes — not for copying third-party proprietary code.
Can you unlock an APM32F103 at RDP Level 2?
Level 2 recovery is possible in some cases using invasive microprobing techniques, but success is not guaranteed. The chip is physically consumed during the process. We assess each Level 2 case individually and provide an honest feasibility estimate — including the probability of failure — before you commit. Costs typically start at $1,500 and timelines extend to 15–25 working days.
Will my APM32F103 chip still work after firmware extraction?
For Level 1 non-invasive extraction, yes — the chip remains fully functional and can be resoldered onto your board. For Level 2 invasive extraction, the chip package is destroyed during decapsulation and cannot be reused. We recommend sending a spare unit when available.
How do I ship my APM32F103 for unlock?
You can ship the bare chip (desoldered, in an ESD bag) or the entire assembled PCB. We handle worldwide shipments and can provide a DHL/FedEx account number for return. Anti-static packaging is essential — damaged pads or bond wires can reduce recovery success. Include a brief description of the board and your authorization documentation.
What file format will I receive after APM32F103 unlock?
Standard deliverables are a raw binary (.bin) and an Intel HEX (.hex) file covering the full flash range. Option bytes and, if applicable, EEPROM/OTP contents are provided in a separate file. A short extraction report documenting the RDP level, CRC verification result, and any anomalies is included at no extra charge.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote