Can You Unlock an STM32? The Short Answer
Yes — but only under specific conditions. Whether you can unlock an STM32 depends on the Read-Out Protection (RDP) level ST configured at the factory and the level the original developer activated. RDP Level 0 chips are already unlocked. RDP Level 1 chips can almost always have their flash contents recovered through known voltage-glitching, debug-port, or semi-invasive techniques. RDP Level 2, however, permanently disables the debug interface and fuses the option bytes — making non-destructive firmware readout effectively impossible with current methods. Our engineers assess every STM32 unlock request against these three tiers before quoting, and we will tell you upfront if recovery is not viable.
Understanding STM32 Read-Out Protection Levels
ST Microelectronics implements a three-tier protection scheme across the STM32 Cortex-M family. Each level locks down the JTAG/SWD debug port and the flash memory interface differently. The table below summarizes what each level means for firmware recovery.
| RDP Level | Debug Access | Flash Read | Unlock Feasibility | Typical Method |
|---|---|---|---|---|
| Level 0 (0xAA) | Full | Open | No unlock needed — firmware freely readable | Standard SWD/JTAG readout |
| Level 1 (any value except 0xAA/0xCC) | Restricted — SRAM access only | Blocked via debug; bootloader restricted | High (≈85–95 % across F0/F1/F2/F4 families) | Voltage glitching, boot-mode exploits, semi-invasive probing |
| Level 2 (0xCC) | Permanently disabled | Permanently locked | Very low — generally not recoverable non-destructively | Decap + micro-probing (destructive, costly, uncertain) |
The critical takeaway: if your chip is at RDP 1, there is a well-documented attack surface. If it is at RDP 2, the option-byte fuse is physically blown and the JTAG port cannot be re-enabled without silicon-level intervention.
How We Determine Your STM32’s RDP Level
Before any work begins, our lab runs a non-destructive probe sequence. We connect via SWD and attempt an identification read. The response pattern tells us which protection tier is active:
- Full ID + flash dump succeeds: RDP 0 — you already have access.
- ID responds but flash read returns bus errors: RDP 1 — recovery is feasible.
- No debug response at all (JTAG/SWD completely silent): RDP 2 — we flag this immediately and discuss options honestly.
This triage step takes less than one working day and is included in every feasibility assessment at no charge. We photograph the part marking, cross-reference the exact die revision (e.g., STM32F103C8T6 Rev Z vs. Rev Y), and check our internal database of known-good extraction routes for that silicon revision.
STM32 Families and Their Real-World Unlock Rates
Not all STM32 series behave the same. Newer silicon revisions often patch glitching vectors that worked on earlier steppings. Below is an honest breakdown based on our lab data across several hundred recovery jobs.
| STM32 Family | Core | RDP 1 Success Rate | Typical Turnaround | Notes |
|---|---|---|---|---|
| STM32F0xx | Cortex-M0 | ~90 % | 5–8 working days | Smaller flash (16–256 KB); well-characterized glitch windows |
| STM32F1xx | Cortex-M3 | ~92 % | 5–10 working days | Most common legacy target; multiple known vectors |
| STM32F2xx | Cortex-M3 | ~88 % | 7–12 working days | Larger flash (up to 1 MB); tighter timing margins |
| STM32F4xx | Cortex-M4F | ~85 % | 7–14 working days | ART Accelerator adds complexity; some revisions patched |
| STM32F7xx | Cortex-M7 | ~70 % | 10–18 working days | Dual-bank flash, tighter voltage monitoring |
| STM32H7xx | Cortex-M7 dual | ~50–60 % | 14–21 working days | TrustZone-capable parts with enhanced tamper detection |
| STM32L0/L1/L4 | Cortex-M0+/M3/M4 | ~80 % | 7–14 working days | Low-power brownout detectors can interfere with glitching |
| STM32G0/G4 | Cortex-M0+/M4 | ~75 % | 10–15 working days | Newer silicon; some steppings have improved glitch filters |
| STM32WB/WL | Cortex-M4/M0+ | ~65 % | 14–21 working days | Wireless co-processor complicates extraction |
| STM32MP1 | Cortex-A7 + M4 | Case-by-case | 21+ working days | MPU-class; eFuse + secure boot chain — assess individually |
These numbers reflect RDP Level 1 only. RDP Level 2 parts across all families sit below 10 % feasibility and require destructive decapping, which we only recommend when the firmware value justifies a $3,000–$8,000+ investment with no guarantee.
What Techniques Are Used to Unlock STM32 at RDP 1?
Voltage Fault Injection (Glitching)
The most common method. A precisely timed voltage dip on VDD or VDDA during the RDP-check routine causes the CPU to skip the protection branch. Our rigs use sub-nanosecond MOSFET crowbar circuits synchronized to the chip’s boot sequence. The glitch window on an STM32F103 is typically 8–15 ns wide, triggered 12–45 µs after reset release — exact timing varies by lot and revision.
Boot-Mode and UART Exploits
Some older STM32F1 and F0 parts have system-bootloader vulnerabilities where a crafted UART command sequence can leak flash contents in small blocks. ST has patched most of these in newer bootloader revisions (≥ v9.x), but legacy stock still surfaces regularly.
Semi-Invasive Probing
For parts where glitching fails, we can decap the package under controlled conditions and use laser fault injection or EM probing to induce the same protection-skip at the transistor level. This is more expensive ($1,500–$4,000 range) and reserved for high-value recovery.
What Does NOT Work
Connecting an ST-Link and clicking “Remove Protection” in STM32CubeProgrammer will indeed clear RDP 1 — but it mass-erases all flash in the process. This is by design. If you need the firmware, do not attempt a standard unprotect. We receive several chips per month that have been accidentally erased this way.
Authorization and Legal Requirements
We perform STM32 firmware recovery only for authorized parties: the original developer, the board owner recovering their own IP, or a company with documented rights to the design. Every job requires a signed authorization form and proof of ownership before work begins. Read more about our compliance and IP verification process. This is non-negotiable — it protects you and us.
Pricing Signals for STM32 Unlock
Cost depends on family, flash size, and RDP level. Rough ranges based on RDP 1 recovery:
- STM32F0/F1 (≤128 KB flash): $400–$900
- STM32F2/F4 (256 KB–1 MB): $800–$1,800
- STM32F7/H7 (1–2 MB): $1,500–$3,500
- STM32L/G/WB series: $600–$2,200
- RDP 2 decap attempt (any family): $3,000–$8,000+ with no success guarantee
All quotes include the initial feasibility assessment. If we determine recovery is not possible, you pay nothing.
How STM32 Compares to Other MCU Families
Engineers often ask how STM32 protection stacks up against competing Cortex-M parts. The answer: STM32 RDP 1 is among the more recoverable protection schemes, while RDP 2 is among the strongest. For comparison, PIC microcontrollers use a different code-protect fuse model that varies widely by family. NXP Kinetis parts like the Kinetis KV series use a similar multi-level scheme but with different timing characteristics. Silicon Labs EFM32 parts — such as the EFM32PG — implement their own debug lock with distinct attack surfaces.
What You Receive After a Successful STM32 Unlock
- Raw binary file (.bin): Exact flash contents, byte-for-byte, verified with CRC32 checksum.
- Intel HEX file (.hex): Address-mapped format ready for re-programming.
- Option-byte dump: Full OB configuration including RDP level, write-protection sectors, BOR level, and watchdog settings.
- Verification report: Read-back comparison confirming the extracted image matches across two independent reads.
If you also need the surrounding PCB recovered — schematic, Gerber, BOM — our engineers can handle the complete board alongside the firmware. See boards we have successfully cloned and recovered for examples of combined PCB + firmware projects.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can you unlock an STM32 without erasing the flash?
Yes, that is the entire point of a professional firmware recovery. The standard “unprotect” command in STM32CubeProgrammer triggers a mass erase. Our methods bypass the RDP check without issuing that command, preserving all flash contents intact. This works reliably at RDP Level 1 across most F0, F1, F2, and F4 parts.
How do I know if my STM32 is RDP 1 or RDP 2?
Connect via SWD with an ST-Link. If STM32CubeProgrammer can detect the chip and read its device ID but cannot read flash, you are at RDP 1. If the tool cannot establish any debug connection at all, the part is likely RDP 2. We confirm this definitively during our free feasibility check.
Is STM32 unlock legal?
Recovering firmware from a chip you own — for backup, legacy maintenance, or authorized redesign — is a legitimate engineering activity in most jurisdictions. We require signed proof of ownership and an NDA before starting. We do not assist with unauthorized extraction of third-party IP.
What if my STM32 is RDP 2 — is there any hope?
RDP 2 is a permanent fuse. Non-destructive recovery is not possible. Destructive decap with micro-probing has a low success rate (under 10 %) and costs $3,000–$8,000+. We will be honest about the odds before you commit. In many cases, re-developing the firmware from the schematic and known behavior is more cost-effective.
How long does an STM32 firmware recovery take?
Feasibility assessment: 1 working day. Actual extraction: 5–21 working days depending on the family and flash size. STM32F1 parts at RDP 1 are typically the fastest; STM32H7 and wireless variants take the longest. We provide a firm timeline estimate after the initial assessment.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote