CH32F Unlock: Authorized Firmware Recovery for WCH’s Flash-Protected MCUs
CH32F unlock is the process of reading protected firmware from WCH’s CH32F-series microcontrollers when the original source code or binary is lost. WCH implements a read-out protection (RDP) mechanism across the CH32F family that blocks SWD/JTAG flash readback once enabled. Our engineers recover firmware from CH32F003, CH32F103, CH32F203, and CH32F207 parts using a combination of voltage-glitch attacks, debug-interface exploits, and—where necessary—invasive die-level techniques. Success depends on the specific sub-family, silicon revision, and protection level configured. Authorization and proof of ownership are required before any work begins.
How Does WCH Protect the CH32F Flash?
WCH’s CH32F family borrows its protection architecture from the broader CH32 ecosystem. The Option Bytes store a Read-out Protection (RDP) flag that, once set, disables flash readback through the debug port. There are effectively two protection states relevant to unlock work:
- RDP Level 1 (standard protection): Debug access to SRAM remains partially available, but flash read commands return all zeros or trigger a bus fault. This is the most common configuration we encounter.
- RDP Level 2 (permanent protection): The debug port is fully disabled at the hardware level. Reverting to Level 0 via normal means mass-erases the flash. Recovery from Level 2 requires invasive techniques with lower success probability.
On CH32F103 and CH32F203 parts, the protection implementation shares silicon with early WCH RISC-V designs. Certain silicon revisions (particularly pre-2022 masks) exhibit timing vulnerabilities during the RDP-check boot sequence that our lab exploits with precision voltage glitching. Newer revisions have tightened these windows, making the process more time-intensive but still feasible in most Level 1 cases.
Feasibility by CH32F Sub-Family
Not every CH32F part responds identically. The table below reflects our lab’s current assessment based on hundreds of units processed. These figures apply to Level 1 protection; Level 2 adds significant difficulty and cost.
| Sub-Family | Core | Flash Size | RDP Level 1 Feasibility | RDP Level 2 Feasibility | Typical Attempts |
|---|---|---|---|---|---|
| CH32F003 | RISC-V (QingKe V2A) | 16–64 KB | High | Low–Moderate | 1–3 |
| CH32F103 | RISC-V (QingKe V3A) | 64–128 KB | High | Moderate | 1–4 |
| CH32F203 | RISC-V (QingKe V4B) | 64–256 KB | High | Moderate | 2–5 |
| CH32F207 | RISC-V (QingKe V4F) | 256 KB | Moderate–High | Low | 3–8 |
“Attempts” refers to the number of sample ICs our engineers may need. Voltage-glitch techniques are non-destructive in most runs, but some attempts stress the device beyond reuse. We recommend sending 2–3 spare units when possible.
What Does the CH32F Unlock Process Look Like?
Step 1 — Feasibility Assessment (Free)
You send us the exact part number (e.g., CH32F103C8T6), the silicon revision if known, and ideally a sample unit. Our engineers verify the protection level using WCH’s WCH-LinkE probe and custom diagnostic firmware within 1–2 working days. There is no charge for this step.
Step 2 — Non-Invasive Attack Phase
For Level 1 parts, we begin with voltage-fault injection on the VDD rail during the RDP verification window. Our glitch rig targets a 20–80 ns window at boot with sub-nanosecond timing resolution. On CH32F103 parts with older mask revisions, this succeeds in roughly 70–85% of first attempts. If the glitch opens the debug port, we dump the full flash contents via SWD within seconds.
Step 3 — Semi-Invasive / Invasive Phase (if needed)
When non-invasive methods fail—typically on CH32F207 Level 2 parts or newer silicon revisions—we escalate to die-level work. This involves chemical decapsulation, UV exposure of security fuse areas, or micro-probing of internal buses. These techniques require destroying the package, which is why spare units matter. Turnaround extends by 3–7 additional working days.
Step 4 — Verification & Delivery
Recovered firmware is delivered as a raw .bin or Intel .hex file. We verify the dump by programming it onto a blank CH32F of the same part number and confirming basic functional behavior (clock startup, peripheral init, UART output) where possible. You receive the file via encrypted transfer under NDA.
Cost and Lead Time for CH32F Unlock
Pricing depends on the sub-family, protection level, and number of units available for attempts. The ranges below cover the most common scenarios:
| Scenario | Price Range (USD) | Lead Time (Working Days) |
|---|---|---|
| CH32F003 / CH32F103, RDP Level 1 | $400 – $800 | 5 – 8 |
| CH32F203, RDP Level 1 | $500 – $1,000 | 5 – 10 |
| CH32F207, RDP Level 1 | $700 – $1,200 | 7 – 12 |
| Any CH32F, RDP Level 2 | $1,200 – $2,500+ | 10 – 20 |
We operate on a no-success-no-fee basis for Level 1 jobs. For Level 2 engagements, a partial upfront fee covers die-preparation costs regardless of outcome. Final pricing is confirmed after the free feasibility assessment.
Authorization and Legal Requirements
We perform CH32F unlock exclusively for authorized parties—original designers recovering lost source, companies maintaining legacy products they own, or engineers working under documented IP-transfer agreements. Before work starts, you must provide proof of ownership or a signed authorization letter. Every engagement is covered by a mutual NDA. If you have questions about what qualifies, our compliance team can advise during the feasibility stage.
For a deeper look at how we handle IP protection and client confidentiality across all MCU families, see our CH32L unlock service page, which shares the same WCH authorization framework.
How CH32F Compares to Other WCH and Domestic-China MCU Families
WCH produces several MCU lines beyond the CH32F. The CH32V series (pure RISC-V, no ARM legacy), the CH32X series for USB-focused applications, and the CH5xx Bluetooth SoCs all use related but distinct protection schemes. If your target device is from a different WCH family, these sibling pages cover the specifics:
- CH32X unlock feasibility and process — USB-centric WCH parts with similar RDP but different boot sequences.
- CH573 Bluetooth SoC unlock — WCH’s BLE-enabled line with additional code-protection layers.
- CH579 firmware recovery — Ethernet + BLE combo SoC with dual-bank flash protection.
Among other domestic-China MCU vendors, the protection architectures vary considerably. MindMotion’s MM32 family uses an STM32-style OB protection that responds well to similar glitch techniques. Puya’s PY32 ultra-low-cost line has simpler protection that is generally faster to defeat. If you’re working with a mixed BOM, we can assess multiple IC families in a single engagement—see our pages on MindMotion MM32 unlock and Puya PY32 unlock for details.
What Can Go Wrong — Honest Limitations
We don’t promise 100% success. Here are the real failure modes our engineers encounter:
- Newer silicon revisions: WCH has been tightening the glitch window on post-2023 CH32F103 and CH32F207 masks. Parts manufactured after mid-2023 may require invasive methods even at Level 1.
- Damaged devices: If the flash array itself has been corrupted by ESD, latch-up, or excessive erase cycles, the data may be unrecoverable regardless of protection state.
- Encrypted application layer: Some designers apply AES encryption to their firmware payload on top of RDP. We can dump the raw flash contents, but decrypting an application-layer cipher is outside our scope.
- Insufficient samples: Invasive methods destroy the package. If you send a single unit and the first attempt fails, there is no second chance without additional hardware.
We communicate these risks clearly during the feasibility assessment so you can make an informed decision before committing budget.
Deliverables and File Formats
| Deliverable | Format | Notes |
|---|---|---|
| Flash firmware dump | .bin / .hex | Full flash range, including Option Bytes |
| EEPROM data (if applicable) | .bin | Separate file for data-flash regions |
| Option Byte configuration | Text report | RDP level, WDG config, boot mode bits |
| Verification report | Functional check results on blank target IC |
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewIs CH32F unlock legal?
Yes, when performed for authorized purposes. Recovering firmware from hardware you designed or legally own is legitimate in most jurisdictions. We require proof of ownership or a signed authorization letter and work under NDA. We do not assist with unauthorized copying of third-party IP.
How many sample CH32F chips should I send?
For RDP Level 1 jobs, two units is ideal—one for the primary attempt and one backup. For Level 2 engagements requiring invasive work, we recommend three to five units. Non-invasive voltage-glitch attempts are usually non-destructive, but stressed devices may not survive repeated sessions.
Can you unlock a CH32F103 with RDP Level 2?
It is possible but significantly harder and more expensive than Level 1. Level 2 disables the debug port permanently, so recovery requires die-level invasive techniques. Success rates are moderate on CH32F103 and lower on CH32F207. We assess feasibility for free before quoting.
What if my CH32F firmware is encrypted on top of RDP?
We can dump the raw flash contents regardless of application-layer encryption. However, decrypting an AES- or custom-encrypted payload is outside our standard service. We deliver the binary as-is and can recommend partners for cryptanalysis if needed.
Do you support remote engagements for CH32F unlock?
Absolutely. Most clients ship sample ICs via DHL or FedEx. We provide a shipping address, handle customs documentation, and deliver recovered firmware via encrypted file transfer. Average door-to-door turnaround including shipping is 8–15 working days for Level 1 jobs.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote