EFM32HG Unlock — Recovering Firmware from Silicon Labs Happy Gecko MCUs
The EFM32HG unlock process recovers firmware from Silicon Labs’ EFM32 Happy Gecko series by bypassing or resetting the chip’s Debug Lock (DLK) protection. When the DLK bit in the lock-bits page is cleared (written to 0), standard SWD access to flash is blocked. Our engineers use a combination of voltage-glitch injection and proprietary protocol-level techniques to re-enable read access without triggering a mass erase, preserving the original flash contents. Typical turnaround is 5–10 working days with costs starting at $400 per unique part number.
What Protection Does the EFM32HG Use?
Silicon Labs implemented a single-tier debug protection model on the EFM32HG family (EFM32HG108, EFM32HG110, EFM32HG210, EFM32HG222, EFM32HG310, EFM32HG321, EFM32HG322, and others). Understanding the exact mechanism is the first step in any EFM32HG unlock engagement.
| Feature | Detail |
|---|---|
| Core | ARM Cortex-M0+ @ 25 MHz |
| Flash range | 16 KB – 64 KB (device-dependent) |
| RAM | 2 KB – 8 KB |
| Debug interface | SWD (Serial Wire Debug), no JTAG |
| Lock mechanism | Debug Lock (DLK) bit in Lock Bits Page (address 0x0FE04000) |
| AAP (Auth Access Port) | Present — allows mass-erase-only unlock via Device Erase command |
| Secure boot | Not available on HG series |
| Additional protection | Page-level write lock (PLW) — protects against accidental overwrite, not read |
The DLK bit disables the AHB-AP (debugger’s access port to the memory bus) while leaving the AAP (Authentication Access Port) functional. Silicon Labs’ intended “unlock” path is a full chip erase through the AAP — which destroys the firmware. The challenge in a non-destructive EFM32HG unlock is re-enabling AHB-AP access without executing that erase command.
How DLK Differs from Series 2 Secure Element Protection
Engineers familiar with newer EFM32PG23 or EFR32 Series 2 parts should note that the EFM32HG does not use a Secure Element (SE) or root-of-trust architecture. There is no secure boot chain, no anti-tamper mesh, and no hardware-accelerated key storage. This makes the HG family significantly more approachable for authorized recovery compared to Series 2 devices, where success rates drop considerably.
Is EFM32HG Unlock Feasible for Every Part?
Feasibility depends on several factors. Not every locked EFM32HG chip can be read out, and we are transparent about the constraints before any work begins.
- DLK-only locked parts: High success rate. Glitch-based bypass of the DLK bit on Cortex-M0+ targets is well-characterized in our lab. We have recovered firmware from EFM32HG222F64 and EFM32HG310F64 parts with consistent results.
- Parts with damaged flash: If the chip has been exposed to overvoltage, excessive ESD, or has exceeded its 20,000-cycle flash endurance, read-back data may be corrupted even after a successful unlock. We verify integrity with CRC checks post-extraction.
- Remarked or counterfeit parts: We occasionally receive chips marked as EFM32HG that are actually different silicon. A die-level inspection confirms the correct die before we begin work.
- Previously erased via AAP: If someone already issued a Device Erase through the AAP, the flash is zeroed. No recovery is possible — the data is gone at the silicon level.
We provide a free feasibility assessment before quoting. Ship us the chip (or the full PCB), and our team confirms the exact part revision, lock status, and flash condition within 2–3 working days.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewOur EFM32HG Unlock Process Step by Step
1. Intake and Verification
We receive the device, verify the part number and revision against Silicon Labs’ device information page, and confirm that the DLK bit is indeed set by probing the SWD interface. We also check for page-lock bits and any custom bootloader behavior.
2. Authorization Check
EFM32HG unlock is performed only for authorized parties — original firmware owners, licensees, or companies with documented proof of IP ownership. We require a signed NDA and an authorization declaration before proceeding. This protects both parties and ensures compliance with applicable IP law. Read more about our authorization and NDA framework for IC recovery services.
3. Glitch Injection and Read-Back
Our engineers apply precisely timed voltage glitches on the DVDD rail during the SWD initialization handshake. The goal is to cause the lock-bits check to fail open — allowing the AHB-AP to become accessible for a window long enough to dump the full flash contents. On the EFM32HG’s Cortex-M0+, the timing window is approximately 50–200 ns, depending on the clock configuration and supply decoupling on the target board.
We use custom FPGA-based glitch hardware (not off-the-shelf ChipWhisperer alone) to achieve the sub-nanosecond jitter control needed for repeatable results on this family.
4. Verification and Delivery
The extracted binary is verified against the vector table structure expected for Cortex-M0+ (valid stack pointer at 0x00000000, valid reset vector at 0x00000004). We deliver the firmware as a raw .bin file and an Intel HEX (.hex) file, along with a memory map showing flash base, size, and any identified bootloader regions.
Cost and Turnaround for EFM32HG Unlock
| Service Tier | Turnaround | Starting Price (USD) | Notes |
|---|---|---|---|
| Standard | 7–10 working days | $400 | Single part number, DLK-only |
| Priority | 5–7 working days | $600 | Expedited queue, same-day intake |
| Batch (3+ identical parts) | 10–14 working days | $300 per unit | Volume discount, shared setup cost |
Pricing varies by exact part variant and flash size. Devices with 64 KB flash take marginally longer to dump than 16 KB variants due to transfer time, but the cost difference is minimal. We charge nothing if the unlock attempt fails — you pay only for a successful read-back with verified data.
EFM32HG vs. Other Low-Power MCU Families
Engineers evaluating recovery options across multiple platforms often ask how the EFM32HG compares to competing parts in terms of unlock difficulty. Here is a practical comparison based on our lab experience:
| MCU Family | Vendor | Core | Protection Tier | Relative Difficulty |
|---|---|---|---|---|
| EFM32HG | Silicon Labs | Cortex-M0+ | DLK (single-level) | Moderate |
| SAMD10 | Microchip | Cortex-M0+ | NVM BOOTPROT + Security Bit | Moderate |
| MSP430F2 | Texas Instruments | MSP430 | JTAG fuse blow | Moderate-High |
| RP2040 | Raspberry Pi | Dual Cortex-M0+ | OTP-based (limited) | Low-Moderate |
| STM32MP1 | ST Micro | Cortex-A7 + M4 | OTP + Secure Boot | High |
If you are also working with Microchip’s Cortex-M0+ parts, our team handles SAMD10 unlock using related glitch techniques. For Texas Instruments’ ultra-low-power line, we support MSP430F2 unlock where JTAG fuse recovery is needed. Engineers dealing with Raspberry Pi’s dual-core controller can review our RP2040 unlock page for OTP-specific details.
Common Use Cases for EFM32HG Firmware Recovery
- Legacy product maintenance: The original developer is unavailable, source code is lost, and the product uses an EFM32HG222F64 for BLE sensor data aggregation. Recovery lets you maintain or update the product.
- Second-source qualification: You designed the firmware, locked the chip during production, and now need to verify that a contract manufacturer programmed the correct binary. Read-back confirms the deployed image matches your golden file.
- Failure analysis: A field-returned unit exhibits unexpected behavior. Extracting the firmware lets you compare it against the release build to check for corruption or unauthorized modification.
- Migration to a newer platform: You own the firmware IP but need to port it to an EFM32PG or EFR32 target. Recovering the binary gives you a reference when source code documentation is incomplete.
What We Deliver
| Deliverable | Format | Details |
|---|---|---|
| Firmware binary | .bin, .hex | Full flash contents from 0x00000000 to end of user flash |
| Memory map | Annotated flash layout — bootloader, application, lock-bits page state | |
| Integrity report | CRC32 checksum, vector table validation, any anomalies noted | |
| Lock-bits dump | .bin | Raw content of 0x0FE04000 region for reference |
All files are delivered via encrypted transfer. Physical chips are returned unless the client requests otherwise.
Frequently Asked Questions
Does EFM32HG unlock destroy the chip?
No. Our voltage-glitch method is non-destructive. The chip remains fully functional after read-back, and the DLK bit stays set — we do not permanently alter the lock state. You can continue using the same chip in your product.
Can you unlock an EFM32HG that is soldered to a PCB?
Yes, provided we have access to the SWD pads (SWDIO, SWCLK, RESETn, VDD, GND). If the SWD port is not broken out to a header or test points, we can probe directly on the QFN/QFP pads. We prefer receiving the full PCB rather than a desoldered chip to avoid thermal damage to the package.
What if the firmware is encrypted in flash?
The EFM32HG does not have a hardware decryption engine or secure boot. Firmware stored in flash is plain-text machine code. If the application developer implemented a software-level encryption layer over data sections, we extract the raw binary as-is — decryption of application-level payloads is outside our scope.
How does this relate to other Artery or WCH MCU unlocks?
The EFM32HG is a Silicon Labs part, unrelated to Artery (AT32) or WCH (CH5xx/CH6xx) architectures. However, our lab handles a wide range of Cortex-M and RISC-V targets. For Artery chips, see our AT32F403 unlock page. For WCH’s RISC-V line, our CH585 unlock guide covers the process.
Do you guarantee success?
We do not guarantee success on any IC unlock — anyone who does is being dishonest. What we guarantee is a no-charge outcome if recovery fails. Our success rate on DLK-only EFM32HG parts with intact flash is high, but we confirm feasibility before you commit financially.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote