Cypress PSoC 4 Unlock — What Is Actually Possible?
Cypress PSoC 4 unlock is the process of recovering firmware from a protection-enabled PSoC 4 microcontroller when the original source code, project files, or programming image has been lost. Our engineers extract the flash contents from authorized devices using a combination of protocol-level, fault-injection, and semi-invasive techniques — depending on the exact part number and the protection bits that were set during production. Success rates vary by sub-family, but most PSoC 4 targets fall within the recoverable range when proper authorization and a working sample are provided.
How Does PSoC 4 Flash Protection Work?
Infineon (formerly Cypress) implemented a multi-tier protection scheme across the PSoC 4 family. Understanding it is the first step in evaluating any Cypress PSoC 4 unlock request.
Protection Levels
PSoC 4 devices expose three main protection states through the CPUSS_PROTECTION register and the chip-level protection (Chip Protection) field in the supervisory flash (SFlash):
| Protection Level | Debug Access | Flash Read | Transition Allowed |
|---|---|---|---|
| OPEN (Virgin / Normal) | Full SWD | Yes | → PROTECTED or KILL |
| PROTECTED | Limited — test mode only | No external read | → OPEN (mass-erase) or → KILL |
| KILL | None | No | Irreversible |
Most production units ship in PROTECTED mode. The SWD port remains physically present but is locked behind a system call that requires knowledge of a device-unique key or triggers a full erase on incorrect attempts. The KILL state permanently disables all debug interfaces by blowing an eFuse — devices in this state are significantly harder to work with and may require die-level intervention.
Row-Level Protection
Beyond the chip-level lock, PSoC 4 allows per-row flash protection. Each 256-byte row can be independently marked as Unprotected, Write-Protected, or Full Protection (no read or write). This means a partially protected image can exist — some rows readable, others locked — which complicates extraction but also means partial recovery is sometimes possible even when a full dump is blocked.
Which PSoC 4 Sub-Families Can Be Unlocked?
The PSoC 4 product line spans at least eight sub-families. Each uses a slightly different silicon revision, and the protection implementation varies enough that feasibility must be assessed per part number.
| Sub-Family | Typical Part Prefix | Core | Unlock Feasibility | Notes |
|---|---|---|---|---|
| PSoC 4000 | CY8C40xx | Cortex-M0 | High | Simpler protection; older silicon revision |
| PSoC 4100 | CY8C41xx | Cortex-M0 | High | Similar to 4000 with added CapSense |
| PSoC 4200 | CY8C42xx | Cortex-M0 | High | Most common target we receive |
| PSoC 4100M | CY8C41xx-M | Cortex-M0 | Moderate–High | Larger flash; same protection model |
| PSoC 4200M | CY8C42xx-M | Cortex-M0 | Moderate–High | Up to 256 KB flash |
| PSoC 4100S | CY8C41xx-S | Cortex-M0+ | Moderate | Updated boot ROM; tighter glitch window |
| PSoC 4100S Plus | CY8C41xx-S+ | Cortex-M0+ | Moderate | Enhanced secure boot on some revisions |
| PSoC 4500S | CY8C45xx | Cortex-M0+ | Low–Moderate | Newest silicon; strongest protection |
The older Cortex-M0 variants (4000/4100/4200) are the most commonly unlocked. The newer “S” and “S Plus” lines introduced a hardened boot sequence that narrows the attack surface. Devices set to KILL state in any sub-family drop feasibility substantially.
Our Cypress PSoC 4 Unlock Process
Every engagement begins with verification of ownership and authorization. We require a signed declaration that the firmware belongs to the requester — or that the requester has legal authority to recover it (e.g., for legacy maintenance, lost-source recovery, or second-source qualification). For details on our compliance framework, see our authorization and NDA policy.
Step 1 — Part Identification & Protection Assessment
We examine the chip markings, read the silicon ID via SWD (if accessible), and determine the exact die revision. The protection level is probed non-destructively to confirm whether the device is in PROTECTED or KILL state.
Step 2 — Technique Selection
Based on the sub-family and protection state, our engineers select the appropriate extraction path:
- Protocol-level bypass — exploiting known weaknesses in the SWD handshake or system-call interface. Applicable primarily to older 4000/4100/4200 revisions.
- Voltage fault injection (VFI) — precisely timed glitches on the supply rail during the boot authentication sequence. Requires specialized pulse generators with sub-nanosecond timing resolution.
- Semi-invasive / die-level — decapsulation followed by optical or laser fault injection. Reserved for KILL-state devices or hardened “S” variants where non-invasive methods fail.
Step 3 — Extraction & Verification
The raw flash dump is verified against a CRC or checksum embedded in the device’s supervisory flash. Where possible, we perform a second independent extraction and compare the two images bit-for-bit. The delivered file is a standard Intel HEX or binary image that can be reprogrammed into a blank PSoC 4 using Cypress/Infineon PSoC Programmer or the OpenOCD SWD interface.
Cost and Lead Time for PSoC 4 Unlock
Pricing depends on the sub-family, protection level, and the number of sample devices available (we typically need 2–5 working samples to account for destructive steps).
| Scenario | Typical Cost (USD) | Turnaround (Working Days) |
|---|---|---|
| PSoC 4000/4100/4200, PROTECTED state | $400 – $800 | 5 – 8 |
| PSoC 4100M/4200M, PROTECTED state | $600 – $1,000 | 7 – 10 |
| PSoC 4100S / 4100S Plus, PROTECTED state | $900 – $1,400 | 8 – 12 |
| PSoC 4500S, PROTECTED state | $1,200 – $1,800 | 10 – 15 |
| Any sub-family, KILL state | Quote on assessment | 15 – 25+ |
We charge a non-refundable assessment fee of $50–$100 that is credited toward the project if we proceed. If our assessment determines the device is unrecoverable, you pay only the assessment fee.
What Can Go Wrong — Realistic Limitations
Honesty about failure modes is part of the service:
- KILL-state devices — eFuse-based lockout is physically irreversible at the logic level. Die-level extraction is possible but expensive and not guaranteed.
- Damaged flash — if the chip has been exposed to overvoltage, ESD, or excessive heat, stored data may be partially corrupted regardless of protection status.
- Encrypted payloads — some PSoC 4 applications store user data encrypted with a key derived from the device-unique ID. We can dump the raw bytes, but decryption is the client’s responsibility.
- Newer silicon revisions — Infineon periodically updates the mask ROM. A technique that works on revision *A may fail on revision **B of the same part number. We always verify the die revision before quoting.
Cypress PSoC 4 vs. Other Cypress Families
If your target device is not a PSoC 4, the protection architecture — and therefore the unlock approach — differs significantly:
- The PSoC 5LP unlock process deals with a Cortex-M3 core and a different eFuse layout that can be more resistant to VFI.
- PSoC 6 devices implement a dual-core (Cortex-M4 + Cortex-M0+) secure boot with hardware-backed key storage, making them the most challenging Cypress targets.
- The Cypress FM4 family (now Infineon) uses an ARM Cortex-M4 with a simpler RDP-style lock that is generally easier to bypass than PSoC 4’s multi-tier scheme.
Who Requests Cypress PSoC 4 Unlock?
Typical authorized use cases we handle:
- Contract manufacturer handoff — the original design house dissolved or went unresponsive; the OEM owns the IP but lost the project files.
- Legacy product maintenance — a PSoC 4-based controller board in industrial equipment needs a firmware update, but the source was never version-controlled.
- Second-source qualification — verifying that a contract programmer flashed the correct binary by comparing a readback against the golden image.
- Failure analysis — reading back firmware from a failed unit to determine whether a code defect caused the failure.
Deliverables
Upon successful extraction, you receive:
- Flash image in Intel HEX and raw BIN format.
- SFlash / supervisory-flash dump (if recoverable) — includes trim values, protection configuration, and device-unique ID.
- A brief technical report noting the protection level encountered, the technique used, and any caveats about data integrity.
- Optional: a reprogramming script for PSoC Programmer or OpenOCD so your production team can flash replacement parts immediately.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can a Cypress PSoC 4 in KILL state still be unlocked?
Potentially, but it requires die-level (semi-invasive) techniques that are more expensive and carry a lower success probability than non-invasive methods. The KILL state permanently disables the SWD port via eFuse, so all protocol-level and most fault-injection approaches are blocked. We assess KILL-state devices on a case-by-case basis and quote only after inspecting the die revision.
How many sample chips do you need for a PSoC 4 unlock?
We recommend sending 3–5 identically programmed, working samples. Some extraction techniques are destructive to the package (decapsulation) or carry a small risk of damaging the flash during fault injection. Having spare devices lets us refine timing parameters without risking the only copy of your firmware.
Is Cypress PSoC 4 unlock legal?
Firmware recovery is legal when performed on devices whose IP you own or are authorized to access. We require a signed ownership declaration and work under NDA. We do not assist with extracting firmware that belongs to a third party without their written consent. Review our trust and compliance page for full details.
Will the extracted firmware work on a different PSoC 4 part number?
Generally yes, provided the target part has the same or larger flash size, the same peripheral set, and compatible trim values. Some PSoC 4 firmware references the device-unique ID for licensing or calibration — in those cases the binary runs but application behavior may differ. We document any device-specific dependencies we detect during extraction.
What if my chip is a PSoC 4 BLE variant?
PSoC 4 BLE parts (CY8C4xx7, CY8C4xx8) include a Bluetooth radio, but the flash protection architecture is identical to the standard PSoC 4200 series. The BLE stack firmware resides in the same user flash and is extracted alongside application code. Feasibility and cost align with the 4200-class estimates in the table above.
Related IC Unlock Services
Working with a different microcontroller family? Our lab covers a wide range of Arm Cortex-M targets beyond Cypress:
- GigaDevice GD32E firmware recovery — a popular STM32 alternative with its own flash-protection quirks.
- Nordic nRF53 unlock — dual-core BLE SoC with APPROTECT and secure-boot challenges.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote