CY8C Unlock — Authorized Firmware Recovery for Cypress PSoC Devices
CY8C unlock refers to the authorized extraction of firmware from Cypress (now Infineon) PSoC microcontrollers whose flash protection bits have been set, preventing normal readout through SWD or JTAG. Our engineers recover flash contents from CY8C devices — including PSoC 1, PSoC 3, PSoC 4, PSoC 5LP, and PSoC 6 families — for clients who own the IP but have lost source code, need to support legacy hardware, or must verify production firmware against a known-good binary. Success depends on the specific die revision and protection level; not every CY8C variant is unlockable.
Why CY8C Devices Are Commonly Locked
Cypress designed the PSoC architecture with configurable protection modes that go beyond a single read-protect bit. Depending on the family, protection can span multiple zones, each with independent settings for read, write, and erase. Engineers who originally programmed these parts often enabled full chip protection during production programming — sometimes without retaining a backup of the final binary.
Common scenarios that lead to a CY8C unlock request:
- Lost source code: The original developer left the organization or the version-control archive was corrupted.
- Legacy equipment support: A product uses a CY8C24x23 or CY8C27x43 that is now obsolete, and the firmware is needed for a replacement board.
- Production audit: Verifying that contract-manufactured units carry the correct firmware revision.
- Prototype recovery: Extracting a working build from a prototype when the build environment can no longer be reproduced.
Which CY8C Families Can Be Unlocked?
Feasibility varies significantly across PSoC generations. The table below summarizes our current success profile based on lab results across hundreds of samples. “High” feasibility means we have a repeatable, validated process; “Medium” means success depends on die revision and protection configuration; “Low” means the device uses hardware-enforced secure boot that resists known extraction methods.
| Family | Common Part Numbers | Flash Size | Protection Scheme | Unlock Feasibility |
|---|---|---|---|---|
| PSoC 1 (CY8C2xx) | CY8C24x23, CY8C27x43, CY8C29x66 | 4–32 KB | Flash Security (row-level) | High |
| PSoC 3 (CY8C38xx) | CY8C3866AXI, CY8C3246PVI | 16–64 KB | Device Security + WPR | Medium–High |
| PSoC 4 (CY8C4xxx) | CY8C4245AXI, CY8C4247AZI | 16–256 KB | Chip Protection (OPEN/PROTECTED/KILL) | Medium |
| PSoC 5LP (CY8C58xx) | CY8C5868AXI, CY8C5888LTI | 32–256 KB | Flash Protection + Debug Disable | Medium |
| PSoC 6 (CY8C6xxx) | CY8C6247BZI, CY8C6347BZI | Up to 2 MB | Secure Boot (eFuse + TOC2) | Low |
PSoC 6 parts with secure boot fully provisioned (lifecycle stage SECURE_WITH_DEBUG disabled) are extremely resistant to extraction. We provide a free feasibility assessment before quoting these devices so you don’t spend money on an attempt that cannot succeed.
PSoC 1 — The Most Recoverable CY8C Generation
PSoC 1 devices (CY8C21x34, CY8C24x23, CY8C27x43, CY8C29x66) use an M8C core with row-level flash security controlled by a table in supervisory flash. Our lab has a success rate above 95 % on these parts. The process typically takes 3–5 working days, and the extracted binary is verified against a checksum read from the device’s supervisory area.
PSoC 3 and PSoC 5LP — Moderate Complexity
These families use an 8051 core (PSoC 3) and ARM Cortex-M3 (PSoC 5LP) respectively, with write-protection rows (WPR) and a device-wide protection byte. When protection is set to “Full Protection,” the debug port is disabled and flash reads return all zeros. Our approach involves decapping and micro-probing in a controlled lab environment. Turnaround is 7–12 working days depending on package type (BGA packages require more delicate preparation than QFN/TQFP).
PSoC 4 — PROTECTED vs. KILL States
PSoC 4 implements a three-state model: OPEN, PROTECTED, and KILL. In PROTECTED mode, SWD access is restricted but the device can potentially be transitioned back to OPEN — at the cost of a full flash erase — which is useless for firmware recovery. Actual firmware extraction from a PROTECTED CY8C4xxx requires physical-level techniques. Devices in KILL state have permanently disabled all debug access; recovery from KILL is not feasible with current methods.
How CY8C Unlock Works — Our Process
- Intake & identification: You ship 1–3 sample devices (or a populated PCB). We read the part marking, confirm the die revision under a microscope, and check the protection state via SWD/ISSP probe.
- Feasibility report (free): Within 2 working days we tell you whether extraction is possible, at what confidence level, and the quoted cost.
- Decapsulation: For protected parts, we chemically or laser-decap the package to expose the die. PSoC 1 and PSoC 3 use a single-die construction; PSoC 5LP and PSoC 4 BLE variants may have a multi-die module requiring separate handling.
- Micro-probing / fault injection: Depending on the family, we use FIB-assisted probing, voltage glitching on the power rail during the boot sequence, or UV exposure of specific flash-security cells. Each technique is matched to the protection architecture of the target family.
- Readout & verification: Extracted data is verified by comparing CRC values, re-programming a blank device, and confirming functional equivalence on your test fixture (if provided).
- Delivery: You receive the firmware binary (.hex / .bin), a brief extraction report, and optional disassembly listing. All work is covered by our NDA, and proof of ownership or authorization is required before we begin.
Authorization is mandatory. We require a signed declaration confirming you own the intellectual property or are authorized by the IP holder to recover it. Details on our compliance process are available on our authorization and NDA policy page.
CY8C Unlock Cost and Turnaround
| Device Family | Typical Cost (USD) | Turnaround (Working Days) | Sample Qty Needed |
|---|---|---|---|
| PSoC 1 (CY8C2xx) | $400 – $800 | 3–5 | 1–2 |
| PSoC 3 (CY8C38xx) | $800 – $1,500 | 7–12 | 2–3 |
| PSoC 4 (CY8C4xxx, PROTECTED) | $900 – $2,000 | 8–15 | 2–3 |
| PSoC 5LP (CY8C58xx) | $1,000 – $2,500 | 10–15 | 2–3 |
| PSoC 6 (CY8C6xxx) | Quote on assessment | Assessment first | 3+ |
Pricing reflects lab time, consumables (decap chemicals, probe tips), and the number of sample devices consumed during the process. BGA-packaged parts cost more because decapsulation is more labor-intensive. Rush service (≤5 days for PSoC 3/4/5LP) is available at a 40 % surcharge.
What Can Go Wrong
Honest caveats our engineers share upfront:
- Die damage during decap: Aggressive chemical etching can destroy bond wires or the flash array. This is why we request 2–3 samples — the first may be sacrificial.
- Newer die revisions: Cypress/Infineon occasionally updates the silicon without changing the part number. A CY8C4245AXI from 2022 may have different protection hardening than one from 2017.
- Encrypted external flash: Some PSoC 6 designs store application code in external QSPI flash encrypted with a device-unique key. Even if we read the external flash, the data is useless without the key — and the key is stored in eFuse.
- KILL-state devices: If a PSoC 4 or PSoC 6 is in KILL lifecycle state, no known recovery path exists. We will identify this during the free assessment and not charge you.
CY8C Unlock Compared to Other MCU Families
If you work with mixed-vendor designs, you may need unlock services across several chip families. The CY8C PSoC architecture is unique in its configurable analog/digital blocks, which means the firmware often contains custom component configurations that are not easily reconstructed from scratch — making recovery more valuable than for simpler GPIO-centric MCUs.
For related projects, we also support nRF52840 firmware extraction (Nordic’s APPROTECT mechanism), EFM32HG unlock (Silicon Labs’ Debug Lock), and MSP430F2 readout recovery (TI’s JTAG fuse). Each uses a different protection strategy, but our lab workflow adapts to the silicon.
Deliverable Formats
- Binary files: Intel HEX (.hex) and raw binary (.bin)
- Extraction report: Protection state observed, method used (generalized), CRC/checksum verification results
- Optional disassembly: Annotated disassembly listing for M8C (PSoC 1) or ARM Cortex-M (PSoC 4/5LP) — useful for porting to a new platform
- Cypress Creator workspace: For PSoC 1 parts, we can reconstruct a partial PSoC Designer project with the correct device settings if the customer provides the original .cywrk or hardware schematic
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Is CY8C unlock legal?
Yes, when performed for authorized purposes — recovering your own firmware, supporting legacy equipment you own, or conducting security research under applicable laws. We require a signed ownership declaration and work under NDA. Unauthorized extraction of third-party IP is something we decline. See our trust and compliance page for details.
How many sample CY8C chips do I need to send?
For PSoC 1, one or two devices usually suffice. For PSoC 3, 4, and 5LP, we recommend sending three samples because the decapsulation and probing process may consume one or two. PSoC 6 assessments require at least three due to the complexity of the secure boot chain.
Can you recover firmware from a CY8C4xx BLE module?
PSoC 4 BLE modules (e.g., CY8C4247LQI-BL483) contain a multi-die package with separate Cortex-M0 and radio dies. We can extract the application firmware from the Cortex-M0 flash if the device is in PROTECTED state. BLE stack binaries stored in ROM are Cypress intellectual property and are not included in the deliverable.
What if my CY8C part is soldered to a board?
We can work with populated PCBs. If the part is in a QFN or BGA package, we desolder it in-house using controlled hot-air rework at the manufacturer-recommended reflow profile. There is no extra charge for desoldering, though we recommend shipping the board in an anti-static, foam-cushioned box.
Do you support the newer PSoC 62 and PSoC 64 secure MCUs?
PSoC 62 (CY8C62x) parts without secure boot provisioned can often be read. PSoC 64 (CY8C64x) is Infineon’s “Secure Boot” line with hardware root-of-trust; these are currently not feasible for firmware extraction. We assess each device individually and report honestly if recovery is not possible.
Related IC Unlock Services
Our lab handles a wide range of microcontroller families beyond Cypress PSoC. If your project involves multiple device types, we can bundle assessments to save time and shipping costs:
- STM32WB55 unlock — dual-core STM32 with wireless stack protection
- GD32E230 readout recovery — GigaDevice Cortex-M23 parts with SWD lock
- SAMD20 firmware extraction — Microchip SAM D20 with NVM security bit
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote