Puya PY32 Crack | Protection Levels & Recovery Guide

Puya PY32 Crack — What You Need to Know First

A Puya PY32 crack is the process of bypassing the on-chip readout protection (RDP) to recover firmware from PY32-series Cortex-M0+ microcontrollers. Puya’s PY32F0xx and PY32F003 families use a two-level RDP scheme derived from the ARM SWD debug interface. Level 1 can typically be downgraded with a full-chip erase, but extracting code intact requires fault-injection or side-channel techniques. Level 2 permanently disables debug access and is significantly harder — sometimes impossible — to reverse. Success depends entirely on the specific part number, silicon revision, and the protection state the original developer chose.

Understanding PY32 Readout Protection Levels

Puya implements RDP through option bytes stored in a dedicated flash region. The protection hierarchy closely mirrors STM32’s model, which is unsurprising given the PY32’s Cortex-M0+ core and ST-compatible peripheral set. Here is what each level does:

Most production PY32 devices ship at Level 1. Level 2 is irreversible through normal debug tools — once the option byte is written to 0xCC, the JTAG/SWD port is fused off at the hardware level.

Why Level 1 Is Not the Same as “No Protection”

A common misconception: because Level 1 still allows a debugger to attach, some engineers assume the firmware is readable. It is not. The flash controller gates all read transactions when RDP ≠ 0xAA. You can halt the core and inspect registers, but any attempt to read flash addresses returns bus errors. The only sanctioned exit from Level 1 is a mass erase — which destroys the firmware you want to recover.

How a Puya PY32 Crack Actually Works

Recovering firmware from a protected PY32 without erasing it requires bypassing the flash controller’s access gate. The two primary approaches are voltage fault injection (VFI) and UV/laser fault injection. Both exploit timing windows during the chip’s boot or option-byte-check sequence.

Voltage Fault Injection on PY32

VFI targets the power rail (typically VDD or the internal regulator output) during the few microseconds when the RDP option byte is read and compared. A precisely timed voltage glitch — usually a 5–15 ns dip of 0.4–0.8 V below nominal — can cause the comparison logic to misread Level 1 as Level 0, temporarily opening flash access. Our lab uses programmable glitchers with sub-nanosecond jitter to hit this window.

• Target supply: 3.3 V nominal; glitch depth 2.5–2.9 V
• Glitch width: 8–20 ns depending on silicon revision
• Success window: ~50–200 ns after POR release
• Typical attempts before success: 500–50,000 iterations

On PY32F003 and PY32F030 parts with early silicon revisions (date codes before 2023 Q3), VFI success rates are notably higher because the boot ROM executes the option-byte check in fewer clock cycles, widening the glitch window.

Level 2 — The Hard Boundary

Level 2 on PY32 fuses the debug port using a one-time-programmable (OTP) bit, not just a flash option byte. VFI alone rarely works because there is no software path to re-enable SWD. Recovery at Level 2 may require decapping and micro-probing the flash array directly — a process that costs significantly more and carries a meaningful risk of destroying the die. We evaluate Level 2 parts on a case-by-case basis and will tell you upfront if the probability is too low to justify the cost.

PY32 Part Numbers and Protection Variations

Puya’s PY32 family spans several sub-lines. Protection implementation is consistent across the family, but flash size and package affect practical recovery difficulty.

What We Deliver After a Successful PY32 Crack

• Binary firmware image (.bin) — byte-for-byte copy of the flash contents, verified with CRC32 against a second independent read.
• Intel HEX file (.hex) — address-mapped format ready for re-programming.
• Option byte dump — full contents of the option byte area, including RDP state, watchdog configuration, and boot-mode bits.
• Readout report — glitch parameters used, number of attempts, and any anomalies observed during extraction.

Turnaround for Level 1 PY32 parts is typically 3–7 working days after we receive the sample. Level 2 evaluations take longer — expect 2–4 weeks for the feasibility assessment alone.

Authorization and Legal Requirements

We perform Puya PY32 crack services only for authorized purposes: recovering firmware from your own designs, maintaining legacy products you own, or supporting prototype bring-up where the original source was lost. Before we begin, you must provide proof of ownership or a signed authorization letter. Every engagement is covered by a mutual NDA. If you have questions about what qualifies, our IC break service overview explains the documentation we require.

How PY32 Compares to Other Budget Cortex-M0+ MCUs

The PY32 competes directly with parts like the Nuvoton M051 series and STM8L in the sub-$0.50 MCU segment. Protection implementations vary significantly across these families:

• Nuvoton M051: Uses a security lock bit that disables ISP/ICP read. Glitch-based recovery is possible but requires different timing parameters. See our Nuvoton M051 crack details.
• Renesas RA2: Implements a Trusted Secure IP block with DLM (Device Lifecycle Management) states. More complex than PY32’s option-byte approach. Details in our Renesas RA2 protection analysis.
• Nordic nRF91: Uses ARM TrustZone with APPROTECT — a fundamentally different architecture. Our engineers document the differences in the nRF91 crack feasibility page.

PY32’s relatively straightforward RDP scheme — borrowed heavily from ST’s early Cortex-M0 designs — makes it one of the more approachable targets in this price class, particularly at Level 1.

Common Failure Modes and Honest Caveats

Not every PY32 crack attempt succeeds. Here is what can go wrong:

• Newer silicon revisions: Puya has been tightening glitch windows in recent tape-outs. Parts manufactured after mid-2024 may have additional countermeasures not yet fully characterized.
• Level 2 with UV-hardened packaging: Some PY32 variants in opaque epoxy packages resist optical fault injection, limiting options to electrical methods only.
• Damaged option byte area: If the option bytes are corrupted (e.g., from a failed field update), the chip may enter a locked state that does not respond predictably to glitching.
• Sample destruction: Aggressive VFI parameters can latch-up the internal regulator and permanently damage the die. We mitigate this with current-limited supplies, but the risk is non-zero — typically under 5% for Level 1 attempts.

We always recommend sending at least two sample devices when possible. If only one unit exists, we discuss the risk profile before proceeding.

Getting Started — Free Feasibility Check

Send us your PY32 part number, date code (printed on the package), and a brief description of why you need the firmware recovered. Our engineers will assess the protection level and provide a realistic success estimate, cost range, and timeline — before you ship anything. There is no charge for the initial feasibility evaluation.

Related reading

• Oct 2026STM8AF Crack | Protection Levels & Recovery Guide
• Oct 2026STM8AF Unlock | Feasibility, Cost & Lead Time
• Oct 2026STM32L5 Crack | Protection Levels & Recovery Guide