STM32F405 Unlock — What Is Actually Possible?
The STM32F405 is an ARM Cortex-M4 microcontroller from STMicroelectronics running at up to 168 MHz, with 1 MB of flash and 192 KB of SRAM. STM32F405 unlock refers to recovering the firmware stored behind the chip’s Read-Out Protection (RDP). Success depends almost entirely on which RDP level was set by the original programmer — Level 0, Level 1, or Level 2 — and on the specific silicon revision of the device. Our engineers routinely handle STM32F4-family extractions for authorized owners who have lost source code, need to maintain legacy hardware, or must verify production firmware integrity.
How Does STM32F405 Flash Protection Work?
STMicroelectronics implements a three-tier readout protection scheme across the STM32F4 line. Understanding these tiers is essential before requesting any STM32F405 unlock service because they dictate both the technical approach and the realistic outcome.
| RDP Level | Protection Behavior | Recovery Feasibility |
|---|---|---|
| Level 0 | No protection — flash readable via SWD/JTAG and bootloader | Trivial; standard read with ST-Link or UART bootloader |
| Level 1 | Flash protected from external read; debug access limited; SRAM execution still allowed; regression to Level 0 erases flash | High — multiple known attack vectors on STM32F405 Rev A/Y silicon |
| Level 2 | Debug port permanently disabled; JTAG/SWD fuses blown; no regression possible via software | Requires invasive techniques (decapping, FIB, glitching); success rate lower, cost significantly higher |
Most STM32F405 devices encountered in production boards are set to RDP Level 1. Level 2 is comparatively rare because it is irreversible — even ST cannot undo it — and many developers avoid it precisely because it eliminates field debugging.
RDP Level 1 — The Common Scenario
At RDP Level 1, the STM32F405 disables external flash read through the debug interface and bootloader, but the Cortex-M4 core can still execute code from SRAM. This architectural behavior has been exploited in published research (including voltage-glitching the power rail during the RDP check and leveraging debug-halt timing windows). On certain silicon revisions, a carefully timed fault injection during the boot sequence can cause the RDP check to pass incorrectly, exposing the full 1 MB flash contents.
Our lab uses a combination of electromagnetic fault injection (EMFI) and voltage glitching tuned specifically for the STM32F405’s 2.0 V–3.6 V operating range. The glitch window is typically in the range of 5–50 ns, injected during the first few hundred microseconds after power-on reset. Success on Level 1 devices is high — the vast majority of STM32F405 RDP-1 chips yield a complete binary within a few hundred to a few thousand attempts.
RDP Level 2 — Invasive Recovery
Level 2 permanently disables the debug port by blowing one-time-programmable (OTP) fuses. Software-only attacks cannot bypass this. Recovery requires physical access to the silicon die:
- Chemical or laser decapping to expose the die without damaging bond wires or the flash array.
- Focused Ion Beam (FIB) editing to reconnect or bypass the fuse circuit — a precision operation with sub-micron tolerances on the 90 nm process node used by the STM32F405.
- Micro-probing of internal buses if the flash array layout is characterized.
Level 2 work is not guaranteed. We provide a free feasibility assessment before any invasive attempt and charge only if the firmware is successfully extracted. Turnaround is longer (see table below), and cost is substantially higher due to the specialized equipment involved.
Who Needs an STM32F405 Unlock?
Legitimate use cases we see regularly include:
- Lost source code: An engineering team’s repository was corrupted or a contractor disappeared, and the only surviving copy of the firmware is inside production units.
- Legacy maintenance: End-of-life industrial or medical equipment running STM32F405-based controllers that need firmware recovery to support continued operation or regulatory compliance.
- Production verification: OEMs confirming that a contract manufacturer programmed the correct firmware revision before shipping.
- Prototype recovery: A single prototype board carries the only working build, and the team needs to extract the binary to continue development.
Authorization is required for every job. We ask for proof of design ownership, purchase records, or a signed declaration before beginning work. For details on our verification process and NDA protections, see our STM32MP1 unlock and authorization workflow page, which uses the same intake procedure as all STM32-family projects.
Cost and Turnaround for STM32F405 Firmware Extraction
Pricing depends on the RDP level and whether the chip must be removed from the PCB (BGA packages like the STM32F405VG in LQFP-100 are straightforward; the STM32F405RG in LQFP-64 is similarly accessible). Below are typical ranges — exact quotes are provided after our free feasibility check.
| Scenario | Typical Cost Range (USD) | Turnaround (Working Days) | Success Likelihood |
|---|---|---|---|
| RDP Level 0 (read only) | $50 – $150 | 1 – 2 | ~100% |
| RDP Level 1 (glitch/EMFI) | $500 – $1,500 | 5 – 10 | High (most revisions) |
| RDP Level 2 (invasive) | $3,000 – $8,000+ | 15 – 30 | Variable; assessed per-chip |
We do not charge for unsuccessful Level 2 attempts. A refundable deposit covers lab time, and it is returned in full if the flash contents cannot be recovered.
Our STM32F405 Unlock Process — Step by Step
- Feasibility request: You submit the chip part number, package type, quantity, and any known RDP level. Photos of the board help us plan desoldering if needed.
- Free assessment: Our engineers confirm the silicon revision (visible on the die markings or readable via the DBGMCU_IDCODE if SWD responds at all) and estimate success probability.
- Authorization & NDA: You provide ownership documentation; we countersign an NDA covering the extracted binary.
- Extraction: For Level 1, we mount the chip on our glitching fixture and run automated fault-injection sweeps. For Level 2, the chip goes to our decapping and FIB station.
- Verification: The extracted .bin is verified against the flash CRC (stored in the STM32’s option bytes) and, where possible, loaded onto a blank STM32F405 to confirm functional equivalence.
- Delivery: You receive the raw binary (.bin), an Intel HEX file, and an optional disassembly listing, all via encrypted transfer.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewSTM32F405 vs. Related Chips — Protection Comparison
Engineers often ask how the STM32F405 compares to other MCUs they may also need to recover. Here is a brief comparison with chips we handle frequently:
| MCU | Core | Protection Scheme | Relative Difficulty |
|---|---|---|---|
| STM32F405 | Cortex-M4 @ 168 MHz | RDP Level 0/1/2 | Moderate (Level 1); Hard (Level 2) |
| STM32WB55 | Cortex-M4 + M0+ dual-core | RDP + secure-element partition | Moderate–Hard |
| nRF52840 | Cortex-M4 @ 64 MHz | APPROTECT (hardware) | Moderate (older revisions); Hard (newer) |
| GD32E230 | Cortex-M23 @ 72 MHz | SWD lock + OB protection | Low–Moderate |
If you have multiple chips on the same board — for example, an STM32F405 paired with an external W25Q64 SPI flash or an 24C256 EEPROM — we can extract all devices in a single project, which reduces overall cost and turnaround.
Common Failure Modes and Honest Caveats
Not every STM32F405 unlock succeeds. Transparency matters more than a sales pitch:
- Newer silicon revisions (Rev Z and later) have tightened glitch-timing tolerances, making some Level 1 attacks harder. We adapt our EMFI parameters, but extraction may take longer.
- Damaged flash cells: If the chip has been exposed to ESD, latch-up, or over-voltage events, some flash sectors may return corrupted data even after a successful RDP bypass.
- Write-protection (WRP) bits: Some developers enable sector write protection alongside RDP. This does not prevent readout once RDP is bypassed, but it can complicate verification on a blank chip.
- Proprietary bootloader overlays: A few third-party bootloaders remap the vector table or encrypt payloads in flash. We extract the raw binary as-is; decryption of application-layer encryption is outside scope.
Frequently Asked Questions
Can the STM32F405 be unlocked without erasing the flash?
Yes, if the device is at RDP Level 1. Our fault-injection techniques bypass the readout protection check without triggering the mass-erase that a normal Level 1 → Level 0 regression would cause. At Level 2, invasive methods also aim to read flash non-destructively, though the chip itself may not be reusable afterward.
How do I know which RDP level my STM32F405 is set to?
Connect via SWD using an ST-Link. If the debugger can halt the core and read memory, you are at Level 0. If it connects but returns read errors on flash addresses, you are likely at Level 1. If the SWD port does not respond at all (no IDCODE), the chip is almost certainly at Level 2. Our feasibility check confirms this definitively.
Is STM32F405 firmware extraction legal?
Extracting firmware you own — or are authorized to recover — is legal in most jurisdictions. We require proof of ownership or written authorization before starting any project. Circumventing protection on third-party IP without permission is not a service we offer. All work is performed under NDA.
Do you need the whole PCB or just the chip?
Either works. If you send the assembled board, we desolder the STM32F405 ourselves (and can resolder it afterward if the board must remain functional). Sending a loose chip in an anti-static carrier is also fine. For BGA variants, sending the full board is preferred to minimize pad damage.
What if my board also has external memory ICs?
We commonly extract companion EEPROMs and SPI flash alongside the MCU. Chips like the AT24C512 or SST25VF series are straightforward to read and are included in the same project scope.
Related IC Unlock Services
- STM32WB55 unlock — dual-core BLE MCU recovery
- nRF52840 APPROTECT bypass and firmware extraction
- GD32E230 flash readout and SWD unlock
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote