EFM32G Unlock — Recovering Firmware from Silicon Labs Gecko MCUs
The EFM32G (Gecko) family from Silicon Labs is an ARM Cortex-M3 based ultra-low-energy microcontroller widely deployed in smart metering, industrial sensors, and medical peripherals. When the Debug Lock Word (DLW) is set, standard SWD/JTAG access to flash is blocked — making EFM32G unlock a non-trivial but achievable task for engineers who need to recover their own firmware for legacy maintenance, design migration, or prototype reconstruction.
Our lab has handled EFM32G unlock requests across multiple package variants (QFP48, QFP64, BGA112) and flash sizes from 32 KB to 128 KB. Success depends on the specific silicon revision, the state of the AAP (Authorization Access Port), and whether a Device Erase command has been configured as the only unlock path. Below we break down every factor that affects feasibility, cost, and delivery time.
What Protection Does the EFM32G Use?
Understanding the protection scheme is essential before committing to an EFM32G unlock project. Silicon Labs Gecko devices implement a layered security model:
| Protection Layer | Mechanism | Effect on Unlock |
|---|---|---|
| Debug Lock Word (DLW) | 32-bit word at address 0x0FE04000 region | Disables SWD/JTAG read access to flash and RAM |
| AAP Lock | Authorization Access Port bit in Lock Bits page | Blocks the AAP Device Erase command — hardest layer to bypass |
| Write Lock | Per-page lock bits (PLW) | Prevents flash page writes; does not directly block reads once debug is open |
| User Data Lock | UDL in Lock Bits page | Protects user data page — relevant if calibration data is stored there |
The DLW alone is the most common configuration we encounter. When only DLW is set (AAP still accessible), our engineers can often recover full flash contents without destructive methods. If both DLW and AAP Lock are engaged, the difficulty — and cost — rises significantly because the AAP erase-only path is the only documented interface Silicon Labs exposes.
Silicon Revision Matters
EFM32G parts shipped across at least four silicon revisions (Rev A through Rev D). Earlier revisions (Rev A/B, date codes before 2013) have known implementation weaknesses in the debug lock logic that improve recovery odds. Revision D parts tighten several timing-based vectors. We ask clients to provide the full part marking (e.g., EFM32G890F128-QFP64) and, if possible, the date code so we can assess feasibility before quoting.
Is EFM32G Unlock Feasible for Your Part?
Feasibility is not binary — it falls on a spectrum. Here is how we classify incoming requests:
- High confidence (≈85–95% success): DLW-only lock, Rev A/B silicon, flash ≤ 64 KB. Typical of legacy metering and sensor designs from 2011–2014.
- Moderate confidence (≈60–80%): DLW + partial AAP lock, Rev C, or 128 KB flash. May require semi-invasive probing.
- Low confidence (≈30–50%): Full AAP Lock + DLW on Rev D silicon. We will attempt but cannot guarantee data-intact recovery; destructive decap and micro-probing may be needed, which risks the die.
We provide a free feasibility assessment before any payment. Ship us the locked device (or a photo of the marking plus your SWD dump log), and our engineers will respond within 2 business days with a go/no-go recommendation and a firm quote.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewStep-by-Step EFM32G Unlock Process
1. Device Intake and Identification
We verify the exact part number, package, and silicon revision under a microscope. The device is logged with a unique job ID, and all work proceeds under NDA. Proof of ownership or authorization is required — see our authorization and IP compliance policy for details.
2. Non-Invasive Probe
Using a J-Link or custom SWD adapter, we attempt to communicate through the AAP. If the AAP is accessible, we explore whether the debug lock can be bypassed through known timing or voltage-glitch vectors specific to the EFM32G’s Cortex-M3 implementation. This stage takes 1–3 days.
3. Semi-Invasive Analysis (If Needed)
When non-invasive methods are insufficient, we decapsulate the IC using fuming nitric acid to expose the die, then use a laser or FIB (Focused Ion Beam) station to probe or modify specific lock-bit fuses. This is common for Rev C/D parts with AAP Lock engaged. Decap adds 2–4 days and increases cost by roughly 40–60%.
4. Flash Readout and Verification
Once debug access is restored, we dump the full flash (including Lock Bits page, User Data page, and Device Information page) into a binary file. We verify the dump with a CRC-32 check and, where possible, disassemble the vector table to confirm a valid firmware image.
5. Deliverables
You receive a verified .bin or .hex file of the flash contents, a dump of the Lock Bits and User Data pages, and a brief technical report noting the silicon revision, protection state found, and method used. If you also need the firmware ported to a new EFM32 variant, we offer that as an add-on — many clients migrating from EFM32G to EFM32PG or EFM32HG request this.
Cost and Turnaround for EFM32G Unlock
| Scenario | Typical Cost Range (USD) | Turnaround (Working Days) |
|---|---|---|
| DLW-only, Rev A/B, ≤ 64 KB | $400 – $800 | 5 – 7 |
| DLW + partial AAP, Rev C, 128 KB | $800 – $1,400 | 7 – 10 |
| Full lock, Rev D, semi-invasive required | $1,400 – $2,200 | 10 – 15 |
| Rush service (any scenario, +50%) | Add 50% to above | Reduce by ~40% |
Pricing depends on the number of sample devices you can provide (we recommend sending 2–3 units for destructive-path jobs), flash size, and protection depth. We charge nothing if the unlock attempt fails — our policy is no-success, no-fee for the extraction itself.
Common Use Cases for EFM32G Firmware Recovery
- Legacy metering equipment: Utility companies running EFM32G-based smart meters from 2012–2015 that need firmware updates but lost the original source code.
- Medical device maintenance: Portable diagnostic tools using EFM32G890 where the original firmware vendor is no longer available.
- Design migration: Moving from the discontinued EFM32G to EFM32PG12 or EFM32GG11 and needing the original binary as a reference for re-implementation.
- Prototype recovery: Startups that programmed prototypes before establishing proper version control.
How EFM32G Compares to Other ARM Cortex-M Unlock Targets
Engineers often ask how EFM32G unlock difficulty stacks up against other popular Cortex-M parts. Here is a rough comparison based on our lab experience:
| MCU Family | Core | Relative Unlock Difficulty | Notes |
|---|---|---|---|
| EFM32G (Gecko) | Cortex-M3 | Medium | AAP lock is the main barrier; older revisions easier |
| STM32F1 | Cortex-M3 | Low–Medium | RDP Level 1 well-documented; Level 2 is permanent |
| RP2040 | Dual Cortex-M0+ | Low | No hardware RDP; OTP-based protection only |
| SAMD20 | Cortex-M0+ | Medium | Security bit + fuse-based; details here |
| LPC4300 | Cortex-M4/M0 | High | AES-based secure boot on some variants; more info |
The EFM32G sits in a favorable middle ground: it is more protected than basic Cortex-M0 parts but lacks the TrustZone or secure-boot features found on newer Cortex-M33 devices, making recovery realistic in the majority of cases.
Authorization and Legal Compliance
We perform EFM32G unlock exclusively for authorized parties — device owners recovering their own intellectual property, companies maintaining legacy products they manufactured, or engineers working under documented authorization from the IP holder. Every engagement begins with a signed NDA and proof-of-ownership verification. If you have questions about what qualifies, review our trust and compliance page.
Frequently Asked Questions
Can you unlock an EFM32G without destroying the chip?
In most cases, yes. When only the Debug Lock Word is set (no AAP Lock), our non-invasive SWD-based methods leave the device fully functional after readout. Semi-invasive decap is only needed for AAP-locked Rev C/D parts, and even then the die often survives if the flash is read before any FIB work. We always attempt non-destructive methods first.
How many sample devices should I send?
For DLW-only jobs, one device is usually sufficient. For AAP-locked parts where decap may be required, we recommend sending 2–3 identical units. This gives us a backup if the first die is damaged during acid decapsulation. Extra units also let us verify the dump across multiple chips for data integrity.
What if my EFM32G has a custom bootloader — can you extract that too?
Yes. Our flash dump covers the entire address range from 0x00000000 through the end of the flash region, including any custom bootloader residing in the first pages. We also dump the User Data page (0x0FE00000) and the Lock Bits page so you have a complete image of every programmable region.
Do you support other EFM32 sub-families?
Absolutely. We handle the EFM32HG (Happy Gecko), EFM32PG (Pearl Gecko), EFM32GG (Giant Gecko), and EFM32WG (Wonder Gecko). Each sub-family has its own lock-bit layout and AAP behavior, so feasibility varies — submit a request and we will evaluate your specific part.
Is there a risk of bricking the device during unlock?
Non-invasive methods carry near-zero brick risk; the worst outcome is that the attempt simply fails and the device remains locked. Semi-invasive decap carries a physical risk to the package but not to the silicon in most cases. We have never permanently damaged a device during a non-invasive EFM32G unlock attempt.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote