GD32F4 Unlock — Authorized Firmware Recovery for GigaDevice Cortex-M4 MCUs
GD32F4 unlock refers to the recovery of flash contents from GigaDevice GD32F4xx series microcontrollers whose Security Protection (SPC) has been enabled. Our engineers can extract firmware from most GD32F405, GD32F407, GD32F450, and GD32F470 variants when the requester provides proof of IP ownership. Typical turnaround is 5–10 working days, and pricing starts in the USD 500–2 000 range depending on protection level and package type.
What Protection Does the GD32F4 Series Use?
GigaDevice implements a two-tier Security Protection Code (SPC) scheme across the GD32F4xx family. Understanding which level is active on your target device is the single most important factor in determining whether a GD32F4 unlock is feasible.
| Protection Level | GigaDevice Designation | Effect on Flash | Unlock Feasibility |
|---|---|---|---|
| Level 0 (no protection) | SPC OFF (0xA5) | Full read/write via SWD/JTAG | No unlock needed — direct readout |
| Level 1 | SPC LOW (any value ≠ 0xA5, ≠ 0xCC) | Flash read blocked via debug; SRAM access restricted; code executes normally | High success rate — multiple proven attack vectors |
| Level 2 | SPC HIGH (0xCC) | JTAG/SWD permanently disabled; option bytes locked | Significantly harder; requires invasive techniques; success not guaranteed |
Most production GD32F4 boards we receive are locked at Level 1 (SPC LOW). This level disables debug readout but does not fuse-blow the debug port, leaving several non-invasive and semi-invasive paths available. Level 2 devices require decapping and physical fault injection — a longer, costlier process with lower certainty.
Key Differences from STM32F4 Protection
The GD32F4 is register-compatible with STM32F4, but the flash controller IP is GigaDevice’s own design. Glitch parameters, voltage thresholds, and timing windows differ measurably from ST’s implementation. Engineers who assume identical behavior will waste time. Our lab maintains device-specific profiles for GD32F405RGT6, GD32F407VET6, GD32F450ZIT6, and other common part numbers.
How GD32F4 Unlock Works in Our Lab
- Intake & SPC verification. We connect to the target via SWD and read the option-byte area (when accessible) to confirm the active protection level. If SWD is completely unresponsive, we probe BOOT0/BOOT1 to check system-bootloader access.
- Attack-path selection. For Level 1 devices, our primary approach uses voltage fault injection (VFI) on the core supply rail during the SPC check routine. We also evaluate cold-boot and clock-glitch vectors when the package allows easy decoupling-cap removal.
- Extraction. Once the protection check is bypassed, flash contents are read out via SWD or through the system bootloader in blocks and verified with a CRC-32 pass against the device’s own flash CRC peripheral.
- Validation. The binary is disassembled to confirm a valid vector table at 0x0800 0000 and sane peripheral initialization sequences. We deliver the raw .bin/.hex plus a brief analysis report.
For Level 2 parts, steps 1–2 are replaced with decapping (chemical or laser), die imaging, and focused-ion-beam (FIB) or laser fault injection targeting the security fuse latch. This adds 5–15 working days and roughly doubles the cost.
GD32F4 Unlock Cost and Lead Time
| Scenario | Typical Cost (USD) | Lead Time (Working Days) | Notes |
|---|---|---|---|
| SPC Level 1, LQFP package | 500 – 900 | 5 – 8 | Most common; high success rate |
| SPC Level 1, BGA package | 800 – 1 400 | 7 – 10 | Decoupling access harder; probe adaptation needed |
| SPC Level 2, any package | 1 500 – 3 500+ | 10 – 25 | Invasive; success evaluated per-device |
| Batch (5+ identical units, Level 1) | 350 – 600 / unit | 8 – 12 total | Profiling cost amortized across units |
Pricing depends on part number, package, protection level, and quantity. We provide a binding quote after the free feasibility check — no charge if we determine the job is not viable.
Which GD32F4 Part Numbers Can Be Unlocked?
We maintain tested profiles for the following GD32F4xx sub-families:
- GD32F405xx — 168 MHz, 1 MB flash, USB OTG HS. Common in industrial HMI and motor drives.
- GD32F407xx — adds Ethernet MAC and camera interface. Seen in IoT gateways and medical devices.
- GD32F450xx — 200 MHz, up to 3 MB flash, TLI display controller. Frequent in touchscreen panels.
- GD32F470xx — 240 MHz, hardware crypto accelerator (AES/DES/TRNG). The crypto engine does not affect SPC-level unlock but may mean the firmware itself encrypts payloads in flash.
If your specific part number is not listed, submit it for a free feasibility assessment. GigaDevice’s SPC implementation is consistent across the F4 line, so coverage extends to newer suffixes as well.
What Can Go Wrong — Realistic Constraints
Transparency matters. Here are failure modes we have encountered:
- Level 2 fuse damage during decap. Aggressive chemical decapping can destroy the bond wires or corrode the security-fuse latch, making readout impossible. We use controlled laser decap to minimize this risk, but it is never zero.
- Flash wear / corruption. Devices that have been through thousands of erase cycles may have marginal cells. The extracted binary may contain bit errors in rarely-accessed pages. We flag suspect regions in our report.
- Encrypted application payloads. On GD32F470 parts with the hardware crypto engine, firmware authors sometimes AES-encrypt calibration or configuration blocks. We can extract the raw flash, but decrypting application-layer encryption is outside the scope of a GD32F4 unlock engagement.
- Anti-tamper watchdogs. Some designs tie an external supervisor IC to the NRST pin and trigger a mass-erase on power anomalies. We ask clients to identify external supervisor ICs before we begin glitching.
Authorization and Legal Requirements
We perform GD32F4 unlock only for clients who demonstrate lawful authority over the firmware. Acceptable documentation includes original design files, purchase records for the IP, a sworn declaration of ownership, or a court order for forensic analysis. Every engagement is covered by a mutual NDA. For full details on our compliance framework, see our authorization and trust policy.
Related GigaDevice and Domestic-MCU Unlock Services
If your project involves other GigaDevice families, our lab also handles GD32L series low-power MCU unlock and GD32W Wi-Fi SoC firmware recovery. For boards using alternative Chinese-domestic Cortex-M controllers, we support WCH CH32F unlock and MindMotion MM32 firmware extraction. Nordic Semiconductor users may be interested in our nRF53 APPROTECT bypass service.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can a GD32F4 be unlocked without erasing the flash?
Yes, for Level 1 (SPC LOW) devices. The voltage-glitch approach bypasses the protection check without triggering a mass-erase. Level 2 unlock also targets non-destructive readout, though the invasive process carries a higher risk of collateral damage to the die.
How do I check which SPC level my GD32F4 is set to?
Connect via SWD using OpenOCD or GigaDevice’s GD-Link utility. If the debugger attaches but flash reads return all 0x00 or 0xFF, Level 1 is likely active. If the SWD port does not respond at all (no IDCODE), the device may be Level 2. We can confirm the level for free during our feasibility intake.
Is GD32F4 unlock the same process as STM32F4 unlock?
No. While the two families share a Cortex-M4 core and similar peripheral registers, the flash controller silicon differs. Glitch timing, voltage thresholds, and bootloader behavior are distinct. Using STM32F4 attack profiles on a GD32F4 typically fails or risks triggering a protective mass-erase.
Do I need to desolder the MCU from the board?
Not usually. For Level 1 LQFP parts, we work with the chip soldered in place — we only need access to the SWD pins and the VDD rail. BGA packages or Level 2 jobs may require desoldering for decap access.
What file formats are delivered after a GD32F4 unlock?
We provide the raw flash dump as a .bin file and an Intel .hex file. Option bytes and OTP (one-time-programmable) area contents are included as a separate file. On request, we can also supply a disassembly listing with vector-table annotations.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote