Cypress PSoC 4 Crack — What Recovery Actually Involves
A Cypress PSoC 4 crack is the process of reading protected firmware from a PSoC 4 series microcontroller when the original project files, hex image, or source code are no longer available. Cypress (now Infineon) implements a tiered flash-protection scheme across the PSoC 4 family: each level restricts debug access, SWD port behavior, and flash-read capability differently. Recovery feasibility depends entirely on which protection level was set during production programming and which specific die revision you have. Our engineers evaluate every chip individually before committing to a timeline or quote.
How PSoC 4 Flash Protection Works
Unlike single-bit read-protection on many ARM Cortex-M0/M0+ parts, the PSoC 4 architecture uses a row-level protection model managed through the Supervisory Flash (SFlash) and the Device Protection settings stored in the chip’s protection byte. Understanding this model is the first step in any Cypress PSoC 4 crack attempt.
Device-Level Protection States
Cypress defines three device-level protection states for PSoC 4 parts. The transition between them is one-directional in normal operation — once you move to a higher level, you cannot step back without erasing flash.
| Protection State | SWD Debug Access | Flash Read via SWD | System Calls Available | Reversibility |
|---|---|---|---|---|
| OPEN (Virgin) | Full | Yes | All | N/A — default state |
| PROTECTED | Limited | Blocked | Restricted subset | Transition to OPEN erases all user flash |
| KILL | Disabled permanently | No | None | Irreversible — chip is permanently locked |
Most production PSoC 4 devices ship in the PROTECTED state. The KILL state is rare in the field but occasionally seen on high-security or anti-tamper designs. A chip in KILL state cannot be recovered by any known method — the SWD port is physically disabled at the silicon level.
Row-Level Protection Bits
Within the PROTECTED state, each flash row (typically 128 or 256 bytes depending on the sub-family) carries its own 2-bit protection setting:
- Unprotected (U) — row can be read and written.
- Write-Protected (W) — row can be read but not written or erased.
- Read/Write-Protected (R+W) — row cannot be read or written through normal system calls.
- Full Protection (F) — row is invisible to all external interfaces, including privileged system calls.
Firmware developers typically set all application rows to R+W or Full before moving the device to PROTECTED. The combination of device-level state and per-row bits determines the actual attack surface for any Cypress PSoC 4 crack effort.
Which PSoC 4 Sub-Families Are Covered?
The PSoC 4 umbrella spans multiple silicon sub-families, each with slightly different flash sizes, peripherals, and — critically — die revisions that affect protection implementation. Here is a summary of the most common parts we encounter:
| Sub-Family | Core | Typical Flash | Common Part Numbers | Recovery Difficulty |
|---|---|---|---|---|
| PSoC 4000 | Cortex-M0 | 16–32 KB | CY8C4013, CY8C4014 | Moderate |
| PSoC 4100 | Cortex-M0 | 32–64 KB | CY8C4124, CY8C4125 | Moderate |
| PSoC 4200 | Cortex-M0 | 32–128 KB | CY8C4244, CY8C4245 | Moderate–High |
| PSoC 4100M | Cortex-M0 | 64–128 KB | CY8C4146, CY8C4147 | High |
| PSoC 4200M | Cortex-M0 | 128–256 KB | CY8C4247, CY8C4248 | High |
| PSoC 4100S / 4100S Plus | Cortex-M0+ | 64–128 KB | CY8C4146S, CY8C4147S | High |
| PSoC 4500S | Cortex-M0+ | 128–256 KB | CY8C4548 | Very High |
Newer “S” and “S Plus” variants use an updated protection controller and may include additional anti-glitch countermeasures. Our lab evaluates the specific die revision (visible under decapsulation or via JTAG ID register when the port is partially accessible) before confirming feasibility.
What Changes at Each Protection Level for Recovery
The practical impact on a Cypress PSoC 4 crack attempt varies dramatically between levels:
OPEN State
If the device is still in OPEN, firmware can be read directly over SWD using a MiniProg3/4 or any compatible debugger. No special technique is needed — this is a straightforward readout. We occasionally receive devices that developers thought were protected but were actually still OPEN due to a programming flow error.
PROTECTED State with R+W or Full Row Bits
This is the most common scenario. The SWD port responds but refuses flash-read commands. Recovery requires bypassing the protection controller through techniques that depend on the specific die revision. Typical approaches our engineers use include voltage-glitch injection during the boot sequence and semi-invasive probing of internal bus lines after chemical decapsulation. Success rates vary by sub-family: early PSoC 4000/4100/4200 silicon revisions (pre-2018 date codes) have higher recovery probability than later revisions with hardened glitch filters.
KILL State
The SWD port is fused off. No debug handshake is possible. We do not accept KILL-state chips for recovery because there is no viable path — we prefer to be upfront about limitations rather than waste your time.
Realistic Constraints and Failure Modes
Honest engineering means disclosing what can go wrong:
- Die damage during decapsulation. PSoC 4 BGA and WLCSP packages are more fragile than QFN/TQFP variants. Chemical etching must be precisely controlled to expose the die without destroying bond wires or the flash array.
- Glitch-hardened revisions. Infineon has progressively improved voltage-glitch detection on newer PSoC 4 steppings. A technique that works on a 2017-dated CY8C4245 may fail on a 2022-dated part with the same part number.
- Encrypted user data. Even if flash is successfully read, some firmware designs encrypt application data in upper flash rows using keys derived from the Unique Device ID (UDID). The raw binary is recoverable, but the encrypted payload may still need separate analysis.
- Partial reads. In some cases we recover 95–99% of flash content with a small number of corrupted rows. We report this transparently and can often reconstruct the missing bytes through disassembly context.
We provide a free feasibility assessment before any work begins. If we determine recovery is unlikely, we tell you — no charge, no obligation.
Our Recovery Process for PSoC 4 Devices
- Intake and authorization check. You provide the device (or the full PCB), proof of ownership or authorization, and sign our NDA. We require documentation that you are the IP owner or have written permission from the IP owner. More detail on our PSoC 5 recovery page covers the same authorization requirements that apply across all Cypress families.
- Non-invasive probe. We attempt SWD communication to confirm the device-level protection state and read accessible metadata (silicon ID, die revision, protection byte if exposed).
- Feasibility determination. Based on the protection state, sub-family, and die revision, we issue a go/no-go assessment with an estimated success probability range and turnaround.
- Recovery execution. If approved, our lab proceeds with the appropriate technique — typically 5–15 working days for PROTECTED-state PSoC 4 parts.
- Deliverable. A verified binary image (.hex or .bin) of the flash contents, plus a brief report noting any anomalies, partial rows, or encrypted segments.
How PSoC 4 Compares to Other Cypress Families
Cypress/Infineon uses different protection architectures across its product lines. If you are working with multiple Cypress devices, these comparisons matter:
- The PSoC 6 series uses a dual-core Cortex-M4/M0+ design with Secure Boot and hardware-rooted trust anchors — significantly harder to recover than PSoC 4.
- Cypress FM4 devices based on Cortex-M4 use a simpler read-protection model closer to classic STM32 RDP, with different attack vectors than PSoC 4’s row-level scheme.
- PSoC 4 protection is generally more granular but less hardened than PSoC 6, placing it in a middle tier of difficulty.
Authorization and Legal Requirements
Every Cypress PSoC 4 crack engagement requires proof of ownership or written authorization from the firmware IP holder. Typical acceptable documentation includes original purchase orders, design files showing you commissioned the firmware, or a letter of authorization from the OEM. We operate under NDA for every project and decline work that lacks clear authorization. This protects both parties and ensures compliance with applicable IP law.
When Does PSoC 4 Firmware Recovery Make Sense?
Common authorized scenarios we handle:
- Lost source code. The original developer is unavailable, and you need to maintain or update a product you own.
- Legacy equipment repair. A PSoC 4-based control board has failed, the part is discontinued or long-lead, and you need the firmware to program a replacement chip.
- Prototype recovery. An early prototype was programmed before version control was established, and the binary is the only surviving copy of a critical firmware revision.
- Second-source validation. You designed the firmware and need to verify what was actually programmed onto production units by a contract manufacturer.
If your situation involves a different MCU vendor — for example, GigaDevice GD32E parts or Nordic nRF53 wireless SoCs — we cover those families as well with dedicated feasibility workflows.
Can a PSoC 4 in KILL state be recovered?
No. The KILL state permanently disables the SWD debug port at the hardware level. There is no known method — invasive or non-invasive — to recover firmware from a PSoC 4 device in KILL state. We verify the protection state before accepting any project and will inform you immediately if the chip is in KILL.
How long does a Cypress PSoC 4 crack typically take?
For PROTECTED-state devices, typical turnaround is 5–15 working days after feasibility confirmation. Older die revisions (pre-2018) tend toward the shorter end. Newer S-series parts with hardened glitch filters may require additional time or multiple attempts.
Do you need the chip removed from the PCB?
Not necessarily. We can work with the chip soldered to the board, though desoldering may be required for semi-invasive techniques. If you send the full PCB, our team handles removal and can resolder or provide a replacement if needed.
What file format is the recovered firmware delivered in?
We deliver an Intel HEX (.hex) or raw binary (.bin) file covering the full user-flash address range. A brief technical report accompanies the delivery, noting the protection state encountered, any partial or corrupted rows, and whether encrypted segments were detected.
Is the recovered binary identical to the original programmed image?
In most successful recoveries, yes — the binary is bit-for-bit identical to what was programmed. In rare cases involving partial row corruption (typically fewer than 1% of rows), we document the affected addresses. Encrypted application data within the binary is delivered as-is; decryption is a separate analysis step if needed.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote