Puya PY32 Unlock — What You Need to Know First
The Puya PY32 series — spanning PY32F002A, PY32F003, PY32F030, and the newer PY32F040 — has gained rapid traction as a low-cost Arm Cortex-M0+ alternative to parts from ST and GigaDevice. With unit prices sometimes under $0.10, these MCUs now appear in consumer electronics, LED drivers, sensor nodes, and industrial control boards worldwide. When the original firmware source is lost, the engineer who designed the product, or the company that owns the IP, needs a reliable path to Puya PY32 unlock and flash readout.
Our engineers recover firmware from read-protected PY32 devices for authorized owners — typically for legacy maintenance, second-source qualification, or disaster recovery after a developer departure. Every engagement requires proof of ownership or written authorization, and work is performed under NDA.
How Does Puya PY32 Read Protection Work?
Puya implements a read-protection scheme modeled closely on ST’s RDP framework, but with notable differences in silicon behavior. Understanding these levels is critical before requesting a PY32 firmware extraction.
| Protection Level | SWD Debug Access | Flash Readout | Unlock Feasibility |
|---|---|---|---|
| Level 0 (no protection) | Full | Open | Trivial — standard read via SWD |
| Level 1 (RDP Level 1) | Blocked for flash read | Denied unless de-protected | High — recoverable in most cases |
| Level 2 (permanent lock) | Permanently disabled | Permanently denied | Extremely low — silicon-level attack required |
Most PY32 devices encountered in the field are set to RDP Level 1. At this level, the SWD port remains physically present but returns bus errors on flash-read commands. Our approach exploits specific timing and voltage-glitch vectors on the Puya boot sequence that differ from the well-documented STM32 paths. The PY32F003 and PY32F030, in particular, share a boot-ROM behavior that leaves a narrow extraction window when the option bytes are manipulated under controlled conditions.
Level 2 is a different story. Puya’s fuse-blow mechanism on Level 2 is irreversible at the logic level, and recovery would require invasive die-level techniques (FIB, micro-probing) with no guaranteed outcome. We evaluate Level 2 cases on request but quote them separately with an explicit “best-effort, no-guarantee” disclaimer.
Which PY32 Variants Can We Unlock?
Not every PY32 part number behaves identically. Puya has iterated the silicon across several mask revisions, and some newer steppings have tightened glitch-detection circuitry. Below is our current feasibility snapshot based on lab-verified results.
| Part Number | Core | Flash (KB) | RDP L1 Recovery | Notes |
|---|---|---|---|---|
| PY32F002A | Cortex-M0+ | 20 | Yes | Earliest mask; most straightforward |
| PY32F003 | Cortex-M0+ | 32 / 64 | Yes | Most common in field samples |
| PY32F030 | Cortex-M0+ | 32 / 64 | Yes | Pin-compatible with STM32F030 |
| PY32F040 | Cortex-M0+ | 64 / 128 | Case-by-case | Newer silicon; tighter glitch window |
| PY32F071 | Cortex-M0+ | 128 | Under evaluation | Limited field samples so far |
If your specific part number or mask revision isn’t listed, submit a free feasibility request. We test the actual device — markings alone don’t tell the full story because Puya has shipped different die revisions under the same orderable part number.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewPY32 Unlock Process — Step by Step
- Feasibility intake: You ship 2–3 programmed samples (we recommend spares in case of destructive testing on one unit). Provide the exact part marking, board context, and proof of IP ownership.
- Initial assessment (1–2 days): We identify the die revision, confirm the RDP level via SWD probe response, and check for any additional obfuscation (encrypted external flash, custom bootloader locks).
- Extraction attempt (3–5 days): Using voltage-glitch injection synchronized to the PY32 boot-ROM fetch cycle, we attempt to force the MCU into an unprotected read state. Flash contents are dumped, verified with CRC, and compared across multiple reads for integrity.
- Verification & delivery: The extracted binary (.bin / .hex) is loaded onto a blank PY32 of the same variant and functionally tested where possible. You receive the firmware file, a readout log, and a summary of option-byte settings.
Total turnaround for a straightforward PY32F003 at RDP Level 1 is typically 5–8 working days from sample receipt. Rush service (3–4 days) is available at a surcharge.
Cost Range for Puya PY32 Firmware Readout
Pricing depends on the variant, protection level, and number of unique firmware images needed. The table below gives representative starting points — final quotes are issued after feasibility assessment.
| Scenario | Typical Cost (USD) | Turnaround |
|---|---|---|
| PY32F002A / F003, RDP L1, single image | $400 – $800 | 5–8 days |
| PY32F030, RDP L1, single image | $500 – $900 | 5–8 days |
| PY32F040, RDP L1 (newer stepping) | $800 – $1,500 | 7–12 days |
| Any PY32, RDP L2 (best-effort) | Quoted individually | 15+ days |
| Rush surcharge | +40–60% | 3–4 days |
We operate on a no-read, no-fee policy for Level 1 jobs: if we cannot extract a valid firmware image, you pay nothing beyond return shipping.
PY32 vs. Similar Budget MCUs — Protection Comparison
Engineers sometimes ask how the PY32’s protection compares to other low-cost Cortex-M0/M0+ parts they might encounter on the same product line. Here’s a quick reference:
- GigaDevice GD32: Uses a similar RDP scheme but with different boot-ROM timing. GD32 unlock feasibility and process details are covered separately.
- Nuvoton M051 / Mini51: These parts rely on a config-bit lock rather than fuse-based RDP, which changes the attack surface entirely. See our pages on Nuvoton M051 flash recovery and Mini51 unlock methods.
- Nordic nRF53: Substantially stronger protection (APPROTECT with Secure-domain isolation). nRF53 readout protection bypass is a different class of challenge.
- Renesas RA2: TrustZone-lite protection on Cortex-M23; our RA2 unlock assessment explains the constraints.
What Can Go Wrong — Honest Caveats
We don’t promise 100% success on every PY32 unlock attempt. Here are the realistic failure modes:
- Die revision mismatch: A PY32F003 from 2022 and one from 2024 may carry different internal boot-ROM versions. Newer revisions sometimes add glitch-detection counters that force a mass-erase after repeated anomalies.
- Damaged SWD pads: If the board-level SWD traces are cut or the pads are corroded, we may need to bond directly to the die — adding cost and risk.
- RDP Level 2 fuses blown: As noted, Level 2 is a permanent lock. We can attempt invasive recovery, but success is not assured and the chip is destroyed in the process.
- External encrypted flash: Some designs store part of the application in an external SPI flash with AES encryption keyed to the PY32’s unique ID. Extracting the MCU firmware alone won’t yield a working image without the decryption key.
Authorization and Legal Requirements
Every Puya PY32 unlock engagement requires documented authorization. Acceptable evidence includes a purchase order for the original development, a company letterhead declaration of IP ownership, or a signed authorization from the rights holder. We decline jobs where ownership cannot be established. This protects both parties and ensures compliance with applicable IP law.
Frequently Asked Questions
Can a Puya PY32 be unlocked without erasing the flash?
Yes, for RDP Level 1. Our glitch-based method reads flash contents non-destructively. The chip’s existing firmware remains intact after extraction. RDP Level 2 attempts, however, may trigger a mass-erase as a side effect of the silicon’s anti-tamper response.
How many sample chips should I send for a PY32 unlock?
We recommend 2–3 programmed samples. One serves as the primary extraction target, a second as a backup in case the first is damaged during glitch injection, and a third for post-extraction functional verification. For PY32F002A jobs, two samples are usually sufficient.
Is the extracted PY32 firmware a .bin or .hex file?
We deliver both formats by default: a raw .bin image and an Intel HEX (.hex) file. Option-byte configurations are documented separately so you can reproduce the exact protection and clock settings on a fresh chip.
Does Puya PY32 unlock work on the TSSOP-20 and QFN-32 packages equally?
Package type does not affect flash-protection level — the die is identical. However, QFN-32 packages with exposed pads sometimes offer cleaner power-rail access for glitch injection, which can marginally improve first-pass success rates.
What if my PY32 chip is soldered to a board — do I need to desolder it?
Not necessarily. If SWD test points or header pads are accessible on the PCB, we can work with the chip in-circuit. If the board layout blocks SWD access, we’ll desolder the chip using hot-air rework and mount it on a test jig. We can resolder it afterward on request.
Related IC Unlock Services
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote