Cypress PSoC 6 Crack — What Does Each Protection Level Actually Mean?
A Cypress PSoC 6 crack (authorized firmware readout) is possible when the device sits at Normal protection or, in some cases, Secure protection — but becomes effectively impossible once the chip enters the Dead lifecycle stage. The PSoC 6 dual-core architecture (Cortex-M4 + Cortex-M0+) and its multi-stage protection model make this family one of the more complex Arm-based MCUs to recover firmware from. Below, we break down exactly what changes at each protection level, what is realistically recoverable, and what you need to provide before we begin.
PSoC 6 Architecture Overview — Why It Matters for Recovery
The PSoC 6 family (CY8C6xxx) is built on a dual-CPU subsystem. The Cortex-M0+ acts as a security processor, while the Cortex-M4F handles application workloads. Flash sizes range from 256 KB to 2 MB depending on the specific part number, with SRAM from 128 KB to 1 MB. The two cores share flash but access it through separate bus masters with individually configurable protection attributes.
This matters because firmware recovery isn’t simply reading a single flat memory region. Each core can have its own protection configuration, and the secure boot flow managed by the M0+ core controls what the debug port can and cannot access. Cypress uses a Silicon-level lifecycle model — not just a single lock bit — which means the protection state is more nuanced than a simple locked/unlocked flag.
Key Hardware Features Affecting Readout
- SWD Debug Port: The primary debug interface. Access can be restricted or permanently disabled depending on the lifecycle stage.
- eFuse-based Lifecycle: Certain transitions (e.g., Normal → Secure → Dead) are irreversible because they blow one-time-programmable fuses.
- Secure Boot (Secure Image): The M0+ core can enforce cryptographic signature verification before allowing M4 code execution, adding another layer beyond simple read protection.
- Protection Contexts (PC): Up to 8 protection contexts define which bus masters can access which flash/SRAM regions.
PSoC 6 Protection Lifecycle Stages — Detailed Comparison
The PSoC 6 uses a lifecycle model with three primary stages. Each stage changes what is accessible via the debug port and what firmware recovery techniques remain viable.
| Lifecycle Stage | SWD Access | Flash Readout | Firmware Recovery Feasibility | Reversible? |
|---|---|---|---|---|
| NORMAL | Full debug access (default) | Full read/write via DAP | High — standard SWD readout | N/A (factory default) |
| SECURE | Restricted — authentication required | Blocked without valid certificate | Moderate — depends on configuration | No (eFuse-based) |
| DEAD | Permanently disabled | No access | Extremely low / not viable | No (permanent) |
NORMAL Stage — Full Access
Chips shipped from the factory or programmed without lifecycle advancement remain in NORMAL. The SWD port is fully functional. Our engineers connect via a standard DAP (Debug Access Port) probe and can read the entire flash contents — both M0+ and M4 application regions — in a single session. Typical readout time for a 1 MB flash part is under 30 seconds.
If your PSoC 6 is in NORMAL, the Cypress PSoC 6 crack process is straightforward and has a near-100% success rate. This is the most common state we encounter on prototype boards, development samples, and products where the OEM never advanced the lifecycle.
SECURE Stage — The Critical Variable
When the lifecycle is advanced to SECURE, the SWD port requires a cryptographic access certificate signed with the device’s provisioned key. Without this key, the debug port rejects all read commands. However, “SECURE” is not monolithic — the actual protection depends on how the OEM configured the secure boot policy and protection contexts.
Specific scenarios where recovery may still be possible in SECURE:
- Open Debug Access Policy: Some OEMs advance to SECURE for signature verification but leave the debug access policy open (no certificate required). This is a configuration error we see in roughly 15–20% of SECURE-stage parts.
- Known Access Key: If you are the original developer and still hold the provisioning keys, we can use them to authenticate and read the flash normally.
- Partial Protection Contexts: If only certain flash regions are locked to specific protection contexts, other regions may remain readable.
When the SECURE stage is properly configured with a locked debug policy and you do not hold the access keys, non-invasive firmware recovery is not feasible. We will not attempt invasive techniques (decapping, FIB probing) for this family because the cost typically exceeds $15,000 and success is not guaranteed on 40 nm geometry.
DEAD Stage — No Recovery Path
The DEAD lifecycle permanently disables all debug access. The eFuses controlling this transition cannot be reversed. If your PSoC 6 has been advanced to DEAD — which some OEMs do intentionally for end-of-life security — no known non-destructive method can recover the firmware. We will confirm the lifecycle stage during our free feasibility assessment and inform you before any charges apply.
How We Perform Authorized PSoC 6 Firmware Recovery
Our process follows a structured workflow designed to confirm feasibility before committing resources.
- Lifecycle Detection (Free): We connect to the SWD port and read the lifecycle stage register (CPUSS_PROTECTION). This tells us immediately whether the part is NORMAL, SECURE, or DEAD.
- Protection Context Mapping: For SECURE-stage parts, we enumerate the configured protection contexts and debug access policies to determine which regions, if any, are accessible.
- Flash Readout: Using a Cypress MiniProg4 or Segger J-Link with PSoC 6 support, we extract the full flash image. For dual-bank parts (CY8C624x), both banks are read.
- Verification: The extracted binary is verified against the flash checksum stored in the supervisory flash (SFlash) region.
- Delivery: You receive a .hex or .bin file covering the full flash address space, plus a readout report documenting the protection state and any anomalies.
Typical turnaround for a NORMAL-stage PSoC 6 is 2–3 working days from receipt of the physical device. SECURE-stage parts with accessible debug policies take 3–5 working days due to the additional analysis required.
Common PSoC 6 Part Numbers We Work With
| Part Number | Flash | Package | Notes |
|---|---|---|---|
| CY8C6247BZI-D54 | 1 MB | BGA-124 | Common in IoT gateways |
| CY8C6116BZI-F54 | 256 KB | BGA-124 | Lower-cost variant |
| CY8C624ABZI-S2D44 | 2 MB | BGA-124 | Dual-bank, largest flash option |
| CY8C6347BZI-BLD53 | 1 MB | BGA-116 | BLE-enabled variant |
| CY8C6245LQI-S3D72 | 512 KB | QFN-68 | Easier to desolder for standalone readout |
If your specific part number isn’t listed, submit it through our feasibility check — we maintain tooling for the full CY8C6xxx range.
Authorization Requirements — What You Must Provide
Cypress PSoC 6 crack services are provided strictly for authorized recovery. Before we begin, you must demonstrate legitimate ownership or authorization. This typically means providing one or more of the following:
- Purchase order or invoice for the hardware containing the PSoC 6
- Written authorization from the IP holder (if you are a subcontractor or repair facility)
- A signed NDA — we provide a mutual NDA template, or we can sign yours
- Declaration that the firmware is your own design and you have lost the source
We take IP protection seriously. If you need to understand our verification process in detail, review our authorization and trust framework before submitting a request.
Related MCU Families — Similar Protection Architectures
If you work with multiple MCU vendors, you may encounter similar lifecycle-based protection on other Arm Cortex-M parts. The Cypress FM4 family, for example, uses a different (simpler) protection scheme — details are covered in our Cypress FM4 crack and readout guide. For projects involving Nordic Semiconductor’s newer dual-core parts, the nRF53 firmware recovery page covers the APPROTECT mechanism, which shares some conceptual similarities with PSoC 6’s lifecycle model.
Chinese-market alternatives like the GD32 family use simpler RDP-level protection. Our GD32F4 readout guide and CH32F recovery page document those differences if you’re comparing across vendors.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can a Cypress PSoC 6 in SECURE mode be cracked without the original keys?
It depends on the debug access policy configured by the OEM. If the policy was left open (a configuration we see in roughly 15–20% of SECURE-stage devices), SWD readout remains possible. If the policy requires certificate-based authentication and you don’t hold the keys, non-invasive recovery is not feasible. We determine this during the free lifecycle check.
How long does PSoC 6 firmware recovery take?
For NORMAL-stage parts, expect 2–3 working days from the time we receive the physical device. SECURE-stage parts with accessible debug policies require 3–5 working days. Dead-stage parts cannot be recovered, and we confirm this within 24 hours at no charge.
Is the PSoC 6 lifecycle transition reversible?
No. Transitions from NORMAL → SECURE and SECURE → DEAD are enforced by one-time-programmable eFuses. Once blown, the lifecycle cannot be rolled back. This is by design — Cypress/Infineon intended these transitions to be permanent security commitments.
Do you need to desolder the PSoC 6 from the board?
Usually not. If the SWD test points are accessible on the PCB, we connect directly. For boards where the SWD lines are not broken out, or where other components interfere with the debug connection, we may desolder the MCU and mount it on a breakout fixture. We’ll confirm the approach before proceeding.
What file format is the recovered firmware delivered in?
We deliver a raw .bin or Intel .hex file covering the full flash address range. If you need the supervisory flash (SFlash) contents or eFuse configuration data, we include those as separate files with documentation.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote