STM32F091 Unlock — What Is Realistically Possible?
The STM32F091 can be unlocked when its flash is protected at RDP Level 1, allowing authorized recovery of firmware for legacy maintenance, prototype reconstruction, or second-source validation. RDP Level 2 devices are permanently locked at the silicon level and cannot be read out without destructive die-level analysis. Our engineers routinely recover STM32F091 firmware from Level 1 parts within 5–8 working days at a starting cost of $350, with proof of ownership required before work begins.
How Does the STM32F091 Protect Its Flash?
The STM32F091 belongs to ST’s Cortex-M0 F0 family and uses the standard STM32 Read-out Protection (RDP) mechanism. Understanding which level is active on your specific device is the single most important factor in determining feasibility.
| Protection Level | Option Byte Value | Flash Access via SWD/JTAG | Unlock Feasibility |
|---|---|---|---|
| RDP Level 0 | 0xAA | Full read/write | No unlock needed — flash is open |
| RDP Level 1 | Any value ≠ 0xAA, ≠ 0xCC | Blocked; debug halted | High — recoverable with specialized techniques |
| RDP Level 2 | 0xCC | Permanently disabled | Very low — requires die-level silicon analysis, cost and timeline increase dramatically |
Most STM32F091 devices encountered in production boards ship at RDP Level 1. Level 2 is rarer because it also disables the bootloader and all debug interfaces irreversibly, which many OEMs avoid to retain field-update capability.
How We Determine Your Device’s RDP Level
Before committing to a project, we perform a non-destructive probe of the SWD port. If the debugger connects but returns a locked status, the device is almost certainly Level 1. If the SWD port is completely unresponsive and the system bootloader rejects connection, Level 2 is likely. We report findings within 1–2 working days at no charge as part of our feasibility assessment.
STM32F091 Unlock Process — Step by Step
- Authorization check. You provide proof of IP ownership, original design files, purchase records, or a signed declaration. We will not proceed without this documentation. Details on our verification process are available on our supported MCU unlock overview.
- Feasibility probe. We connect to the target via SWD/JTAG and read option bytes to confirm the RDP level, flash size (up to 256 KB on the F091), and device revision.
- Firmware recovery. For Level 1 parts, our lab applies voltage-glitch or protocol-level techniques specific to the STM32F0 family to bypass the read-out gate and extract the full flash contents — including the vector table, application code, and any data stored in the upper pages.
- Verification. The extracted binary is loaded onto a blank STM32F091 (same package and revision) and functionally tested against the original board where possible.
- Delivery. You receive the raw .bin or Intel HEX file, a CRC-32 checksum log, and a brief extraction report noting any anomalies (blank pages, partial reads, etc.).
What Makes the STM32F091 Different from Other STM32 Targets?
The F091 sits at the top of the STM32F0 line: 256 KB flash, 32 KB SRAM, and a 48 MHz Cortex-M0 core. Several characteristics affect the unlock process specifically:
- Larger flash than most F0 parts. At 256 KB, full readout takes longer and requires more stable glitch windows compared to 64 KB F030 variants.
- Dual-bank boot option. Some F091 boards use the dual-bank boot feature, meaning firmware may reside in either bank. Both must be read.
- CAN and HDMI-CEC peripherals. Boards using the F091 for automotive or consumer-electronics interfaces sometimes store calibration data alongside firmware — we capture the entire flash image, not just the code region.
- Shared die with F098. The STM32F098 is the same silicon with a lower-voltage regulator. Unlock techniques are identical; if you have an F098, the same process applies.
If you are working with other STM32 families, the protection architecture varies. The STM32H750 uses a Cortex-M7 with more complex trust-zone features, while the low-power STM32L071 family shares a similar RDP scheme but runs on a different process node.
Cost and Turnaround for STM32F091 Unlock
| Scenario | Typical Cost (USD) | Turnaround (Working Days) |
|---|---|---|
| RDP Level 1, standard queue | $350 – $600 | 5 – 8 |
| RDP Level 1, expedited | $500 – $850 | 2 – 4 |
| RDP Level 2 (die-level analysis) | $3,000 – $8,000+ | 20 – 45 |
| Feasibility assessment only | Free | 1 – 2 |
Pricing depends on the specific revision, board condition, and whether the chip must be desoldered. Damaged pads or corroded SWD pins can add 1–2 days for rework. Level 2 jobs require chemical or laser decapping followed by micro-probing, which is why cost and lead time jump by an order of magnitude.
When STM32F091 Unlock Fails — Honest Constraints
No responsible lab guarantees 100% success. Here are the realistic failure modes we encounter:
- RDP Level 2 with no budget for die work. If the option bytes are set to 0xCC and the client cannot justify the $3K+ cost of silicon-level recovery, the project stops at feasibility.
- Physically damaged flash array. ESD events, latch-up, or prolonged over-voltage can corrupt flash cells. We can still attempt a partial read, but gaps may exist.
- Revision-specific countermeasures. ST periodically updates mask revisions. A Rev Z die may respond differently to glitch parameters than a Rev Y. We maintain a library of per-revision profiles, but new revisions occasionally require additional characterization time (add 2–5 days).
- Encrypted application layer. Even after a successful flash dump, some OEMs encrypt their application payload and store the key in OTP or option bytes. The raw binary is recoverable, but decrypting the application logic is a separate reverse-engineering effort.
Authorization and Legal Requirements
STM32F091 unlock is performed exclusively for authorized parties: original designers recovering lost source, maintenance engineers supporting legacy equipment, or companies with documented IP ownership. We require a signed service agreement and proof of authorization before any extraction begins. Read more about our authorized firmware extraction workflow for details on documentation requirements.
We do not assist with circumventing third-party IP protections, cloning competitors’ products, or any activity that violates applicable IP or export-control laws.
Related STM32 and MCU Unlock Capabilities
The STM32F091 is one of dozens of STM32 targets our lab supports. If your project involves multiple MCU types on the same board — or across different product generations — we can often bundle recovery work to reduce per-unit cost. Common adjacent targets include the STM32G030 in the newer G0 family and the STM32L476 for ultra-low-power designs. For non-STM32 parts on the same board, we also handle PIC18 code-protection recovery and many other architectures.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCan the STM32F091 be unlocked without erasing flash?
Yes, when RDP is at Level 1. Our techniques extract the flash contents non-destructively — the original firmware remains intact on the chip after readout. Downgrading RDP from Level 1 to Level 0 through the standard ST bootloader command would erase flash, which is why we bypass the protection rather than remove it.
How do I know if my STM32F091 is RDP Level 1 or Level 2?
Connect an ST-Link or J-Link to the SWD port. If STM32CubeProgrammer reports “Read-out protection active” but still detects the device, it is Level 1. If the debugger cannot connect at all and the BOOT0 bootloader also refuses communication, Level 2 is likely. We offer a free feasibility check if you are unsure.
Is the STM32F098 unlock process the same as the F091?
Yes. The STM32F098 shares the same die as the F091 with an added low-voltage capability. The RDP mechanism, flash layout, and unlock techniques are identical. Pricing and turnaround are the same.
What deliverables do I receive after STM32F091 firmware recovery?
You receive the complete flash image as a .bin and/or Intel HEX file, a CRC-32 integrity log, and a short report documenting the extraction method, any anomalies detected (blank sectors, partial pages), and the option-byte configuration read from the device.
Do I need to send the entire PCB or just the chip?
Either works. Sending the full board is preferred because it preserves SWD routing and decoupling, reducing the risk of connection issues. If you desolder the chip, use a TQFP-64 or LQFP-64 adapter socket and ensure no pads are lifted or bridged.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote