STM32G030 Unlock — What Is Actually Possible?
Yes, STM32G030 unlock is feasible when the chip is protected at RDP Level 1 — the most common configuration we encounter. Our engineers recover firmware from STM32G030 devices for authorized owners needing legacy maintenance, production recovery, or prototype restoration. RDP Level 2 (permanent lock) is a different story and carries significant constraints. Below we break down exactly what each protection level means for your project, what it costs, and how long it takes.
Understanding STM32G030 Read-Out Protection
The STM32G030 belongs to ST’s G0 series — a Cortex-M0+ part built on a 90 nm process with up to 64 KB of Flash and 8 KB of SRAM. ST implements three protection tiers through the RDP (Read-out Protection) option bytes:
| Protection Level | Option Byte Value | Flash Access via Debug | Unlock Feasibility |
|---|---|---|---|
| RDP Level 0 | 0xAA | Full read/write | No unlock needed — chip is open |
| RDP Level 1 | Any value except 0xAA or 0xCC | Blocked; mass erase on regression | High — non-invasive or semi-invasive methods |
| RDP Level 2 | 0xCC | Permanently disabled; no regression | Low — requires invasive silicon-level work |
Most production boards ship at RDP Level 1. The STM32G030 also supports write protection (WRP) on individual Flash pages and proprietary code readout protection (PCROP) on specific sectors, but these are secondary barriers that become relevant only after the primary RDP is addressed.
RDP Level 1 — The Common Case
At Level 1, the SWD debug port still connects but cannot read Flash contents. A standard regression (changing the option byte back to 0xAA) triggers a full mass erase — wiping the firmware you need. The goal of an STM32G030 unlock at this level is to extract the Flash image before or without triggering that erase. Our lab uses fault-injection and glitching techniques refined specifically for the G0 family’s boot sequence timing. Success rates on RDP-1 G030 parts in our lab exceed 85% on the first attempt.
RDP Level 2 — Permanent Lock
Level 2 fuses the debug interface permanently. There is no software regression path. Recovery requires physical decapsulation and die-level analysis, which is slower, more expensive, and not guaranteed. We assess Level 2 cases individually — success depends on the specific die revision and mask set.
How We Perform an STM32G030 Unlock
Our process follows a structured workflow designed to protect your device and data at every step.
- Feasibility check (free): You send us the part number, RDP level (if known), and proof of ownership. We confirm whether the specific G030 variant (G030C6, G030F6, G030J6, G030K6, G030K8) is in our tested database.
- Device receipt & inspection: We verify the package, markings, and condition. Remarked or counterfeit parts are flagged immediately — we see this roughly 5% of the time on STM32G0 devices sourced from secondary markets.
- Protection-level identification: We connect via SWD to confirm the actual RDP level without triggering erase. This takes under 30 minutes.
- Firmware extraction: For RDP-1, we apply voltage-glitch or electromagnetic fault injection on the G030’s power rail during the boot-ROM execution window. The Cortex-M0+ on this part has a relatively simple pipeline, which gives us a predictable glitch timing window of approximately 50–200 ns.
- Verification & delivery: The extracted binary is verified against the Flash size declared in the device ID register. We deliver a raw .bin file and, on request, an Intel HEX or Motorola S-record.
The entire process is performed under NDA. We require written proof of IP ownership or authorized recovery rights before starting any work. Read more about our microcontroller unlock process and authorization policy.
STM32G030 Unlock Cost and Turnaround
| Scenario | Typical Cost (USD) | Turnaround (Working Days) |
|---|---|---|
| RDP Level 1, standard queue | $400 – $800 | 5 – 10 |
| RDP Level 1, rush service | $600 – $1,200 | 2 – 4 |
| RDP Level 2, invasive approach | $2,000 – $5,000+ | 15 – 30 |
| Batch (5+ identical devices) | Per-unit discount ~20–30% | Varies |
Pricing depends on the exact variant, protection level, and whether the device is soldered to a board or supplied loose. Loose TSSOP-20 or LQFP-32 packages are easiest to handle; BGA or WLCSP packages (used on some G030J6 variants in the UFQFPN-8 footprint) require additional fixturing. We quote firm pricing after the free feasibility check — no surprises.
What Can Go Wrong?
Transparency matters. Here are the realistic failure modes we encounter on STM32G030 unlock jobs:
- Die revision mismatch: ST periodically updates the silicon mask. A newer revision may shift the glitch timing window, requiring recalibration. This adds 1–3 days, not extra cost.
- Damaged Flash cells: If the device has been through excessive thermal cycling or ESD events, some Flash sectors may return corrupted data. We deliver what we recover and flag bad sectors.
- RDP Level 2 misidentified as Level 1: Rare, but it happens when a previous debug session accidentally set Level 2. We identify this during inspection and advise on next steps before any charges apply.
- PCROP-protected sectors: Even after RDP bypass, PCROP-locked sectors remain unreadable through normal extraction. These require a separate approach and may increase cost by 20–40%.
We do not charge if the extraction fails entirely. You pay only for a successful, verified firmware image.
STM32G030 vs. Related STM32 Families
The G030 shares the G0 platform with the G031, G041, G050, G070, and G071. However, the G041 adds AES hardware and additional tamper detection, making it harder to unlock. The G030, lacking a crypto accelerator, is among the more accessible G0 variants.
If your project involves a higher-performance STM32 part, our lab also handles the STM32H750 Cortex-M7 series, which uses TrustZone and different RDP mechanics. For GigaDevice clones that look pin-compatible but have different internal protection, see our notes on GD32 unlock — where protection differs from genuine STM32.
Authorization and Legal Requirements
We perform STM32G030 unlock exclusively for authorized parties: original firmware authors, product OEMs recovering from a lost source archive, or maintenance engineers with documented ownership. You will need to provide one of the following before we begin:
- Purchase order or invoice for the original product/device
- Design files or schematics showing the STM32G030 in your BOM
- A signed declaration of ownership and intended use
All work is covered by mutual NDA. We do not retain copies of extracted firmware after delivery. For a broader overview of how we handle IP protection and compliance, visit our authorized firmware extraction service page.
Deliverables
| Deliverable | Format | Included |
|---|---|---|
| Raw Flash image | .bin | Always |
| Intel HEX | .hex | On request |
| Option byte dump | .txt / .csv | Always |
| Extraction report | Always — includes RDP level, device ID, Flash CRC |
If you need the firmware reprogrammed into a fresh STM32G030 — for example, to replace a damaged unit on a production board — we can supply pre-programmed replacement ICs as part of an MCU unlock and recovery engagement.
Can the STM32G030 be unlocked without erasing the firmware?
Yes, at RDP Level 1. Our fault-injection technique extracts the Flash contents without triggering the mass-erase that a normal RDP regression would cause. At RDP Level 2, the approach is invasive and carries higher risk, but the goal remains non-destructive extraction of the stored binary.
How do I know which RDP level my STM32G030 is set to?
Connect via SWD using an ST-Link or J-Link. If the debugger connects but cannot read Flash, the device is at RDP Level 1. If the debugger cannot connect at all and the device ID register is inaccessible, it is likely RDP Level 2. We confirm the exact level during our free feasibility check.
Is STM32G030 unlock legal?
Extracting firmware from a microcontroller you own — or are authorized to service — is legal in most jurisdictions. We require proof of ownership and work under NDA. We do not assist with extracting third-party proprietary code without authorization. Review our compliance approach on the supported IC list and authorization guidelines.
What if my STM32G030 is soldered to a PCB?
We can work with the chip in-circuit if the SWD pins are accessible and the board provides a stable 3.3 V supply. If the board layout prevents clean access, we desolder the IC using controlled hot-air rework (peak 260 °C, JEDEC J-STD-020 profile) and process it on a test socket. The IC can be resoldered afterward if needed.
Do you support all STM32G030 package variants?
Yes. We have test fixtures for TSSOP-20 (G030F6), LQFP-32 (G030K6/K8), SO-8 (G030J6), and LQFP-48 (G030C6). The SO-8 variant with only 8 pins requires careful power-rail access for glitching but is fully supported.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote