The STM32G070 is an Arm Cortex-M0+ microcontroller from ST’s G0 value line, widely used in consumer electronics, industrial sensors, and motor-control modules. STM32G070 unlock is feasible when the device is set to RDP Level 1, with firmware readout typically completed in 5–8 working days at a starting cost of around $400. RDP Level 2 devices are permanently locked by hardware and cannot be recovered by any known method. Authorization and proof of IP ownership are required before work begins.
What Protection Does the STM32G070 Use?
The STM32G070 relies on ST’s standard Readout Protection (RDP) mechanism, implemented in the option bytes of the embedded Flash. Understanding the exact protection level on your chip is the single most important factor in determining whether an STM32G070 unlock is possible.
RDP Level Breakdown
| Protection Level | Option Byte Value | Flash Read via SWD/JTAG | Unlock Feasible? |
|---|---|---|---|
| RDP Level 0 | 0xAA | Fully open | No unlock needed — firmware is readable |
| RDP Level 1 | Any value except 0xAA or 0xCC | Blocked; debug halted | Yes — recoverable with specialized techniques |
| RDP Level 2 | 0xCC | Permanently disabled; JTAG/SWD fuses blown | No — irreversible hardware lock |
The G0 series also supports write protection (WRP) on individual Flash pages and a proprietary-code readout protection (PCROP) zone. PCROP protects a defined address range even when RDP is regressed from Level 1 to Level 0 — the PCROP zone is erased during that regression. Our engineers account for PCROP boundaries during extraction to preserve the complete binary.
How RDP Level 1 Differs from Level 2 on G0 Devices
On the STM32G070, RDP Level 1 disables external read access through the debug port but does not destroy the debug circuitry itself. The Flash contents remain intact and electrically present. RDP Level 2, by contrast, permanently blows one-time-programmable (OTP) fuses inside the device, making the SWD/JTAG port physically inoperable. No lab technique — including decapping, FIB editing, or glitching — can reliably reverse an RDP Level 2 lock on current G0 silicon revisions.
How Is an STM32G070 Unlock Performed?
Our process for STM32G070 firmware recovery follows a structured workflow designed to maximize success while preserving the original device.
- Step 1 — Feasibility assessment: We examine the chip marking, package (LQFP-48, LQFP-32, or UFQFPN-32), and attempt a non-invasive probe of the debug interface to confirm the RDP level.
- Step 2 — Technique selection: For RDP Level 1 parts, we apply voltage-glitching or timing-fault methods against the boot ROM’s protection-check sequence. The G070’s Cortex-M0+ core and 64 MHz system clock define the glitch window parameters we target.
- Step 3 — Extraction: Once protection is bypassed, the full Flash contents (up to 128 KB on the STM32G070RB, or 64 KB on the STM32G070KB) are read out and verified with a CRC check against the device’s own Flash CRC peripheral.
- Step 4 — Verification & delivery: The binary image is delivered as a raw .bin and Intel HEX file, with an MD5/SHA-256 hash for integrity confirmation.
The chip is not decapped during this process. The original device is returned functional in most cases, though we cannot guarantee the device survives every attempt — voltage-glitch stress occasionally damages a part. We disclose this risk upfront.
STM32G070 Unlock Cost and Turnaround
Pricing depends on the specific variant, protection configuration, and whether PCROP zones are in use. Below are representative ranges based on recent projects.
| Parameter | Typical Range |
|---|---|
| Base cost (RDP Level 1, no PCROP) | $400 – $650 |
| PCROP-zone recovery surcharge | +$100 – $200 |
| Standard turnaround | 5 – 8 working days |
| Rush turnaround (subject to availability) | 3 – 4 working days (+30% fee) |
| Feasibility check | Free — no charge if we determine recovery is not possible |
| RDP Level 2 attempt | Not offered — we will not charge for a known-impossible job |
We operate on a no-success-no-fee basis for the extraction itself. The feasibility assessment and RDP level verification are performed at no cost. If your device turns out to be Level 2 locked, you pay nothing.
Which STM32G070 Variants Can Be Unlocked?
The G070 sub-family includes several part numbers that share the same die and protection architecture. All respond to the same unlock approach when set to RDP Level 1.
| Part Number | Flash Size | Package | RDP L1 Unlock |
|---|---|---|---|
| STM32G070RBT6 | 128 KB | LQFP-64 | Supported |
| STM32G070KBT6 | 128 KB | LQFP-32 | Supported |
| STM32G070CBT6 | 128 KB | LQFP-48 | Supported |
If your specific suffix or package isn’t listed, send us the full part marking. The G070 die is consistent across packages, so coverage is broad.
Common Failure Modes and Honest Caveats
Transparency matters more than a sales pitch. Here are the situations where an STM32G070 unlock will fail or produce incomplete results:
- RDP Level 2: Permanently locked. No workaround exists. We verify this before any paid work starts.
- Damaged Flash cells: If the device has been exposed to overvoltage, ESD events, or excessive thermal cycling, some Flash sectors may return corrupt data. We flag bad sectors in the report.
- PCROP erasure during regression: If someone has already attempted to downgrade RDP from Level 1 to Level 0 using ST’s standard procedure, the PCROP-protected region will have been erased by the hardware. This data is unrecoverable.
- Counterfeit or remarked parts: We occasionally receive chips marked as STM32G070 that are actually GD32 clones with different internal protection. Our feasibility check catches this, and we redirect to the appropriate process.
Authorization and Legal Requirements
We perform STM32G070 unlock only for authorized parties. Acceptable scenarios include:
- Recovery of firmware you developed but lost the source code for.
- Legacy product maintenance where the original developer is unavailable.
- Prototype recovery for hardware you own and designed.
- Court-ordered or insurance-related forensic extraction.
Before work begins, we require a signed declaration of ownership or authorization, plus an NDA if requested. Our compliance and IP protection policies detail the full process. We refuse jobs where ownership cannot be established.
How the STM32G070 Compares to Related STM32 Targets
Engineers often ask how the G070 stacks up against other STM32 parts they may also need recovered. The G0 value line shares a protection philosophy with the F0 series but runs on a newer Cortex-M0+ core with a different boot ROM version — meaning the glitch parameters differ.
The STM32G030 firmware extraction process is closely related since both share the G0 platform, but the G030 has only 32 KB of Flash, making extraction faster. For higher-performance parts like the STM32H750 with its Cortex-M7 core, the protection scheme includes TrustZone and secure-boot features that add complexity and cost. Across vendors, TI MSP430 firmware extraction uses entirely different JTAG-fuse techniques unrelated to ST’s RDP.
What You Need to Send Us
To start a feasibility check for your STM32G070, prepare the following:
- The physical device (either loose chip or mounted on a PCB — we can work with both).
- Full part number from the chip marking (e.g., STM32G070RBT6).
- Any known details about the firmware — version, compiler, IDE used — to help us verify the extracted binary.
- Signed ownership/authorization declaration (we provide the template).
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewFrequently Asked Questions
Can the STM32G070 be unlocked if set to RDP Level 2?
No. RDP Level 2 on the STM32G070 permanently disables the debug interface by blowing internal OTP fuses. No voltage-glitch, decap, or FIB method can reverse this. We verify the RDP level during our free feasibility check and will inform you immediately if the device is Level 2 locked.
Will the STM32G070 chip be destroyed during the unlock process?
In most cases the chip survives and is returned fully functional. However, the voltage-glitching technique applies brief out-of-spec power transients to the supply rail. In a small percentage of attempts (typically under 5%), this can damage the device. We disclose this risk before starting and recommend sending a spare if you have one.
How do I know which RDP level my STM32G070 is set to?
Connect the chip via an ST-Link programmer and open STM32CubeProgrammer. Navigate to the Option Bytes tab. If the tool can connect but shows “Read Out Protection: Level 1,” recovery is likely feasible. If the tool cannot establish any debug connection at all, the device may be Level 2 — send it to us for a definitive check.
Is STM32G070 unlock legal?
Firmware readout is legal when performed on devices you own or are authorized to access. We require proof of ownership or a written authorization letter before accepting any job. Our work is conducted under NDA, and we do not assist with extracting third-party proprietary code without documented consent.
What file format will I receive after extraction?
We deliver the raw binary (.bin), an Intel HEX file (.hex), and SHA-256 hash checksums. If you need a disassembly listing or memory-map annotation for the Cortex-M0+ architecture, we offer that as an optional add-on service.
Related IC Unlock Services
- Full IC unlock service overview and free feasibility check
- PIC16F887 unlock for Microchip 8-bit targets
- NXP Kinetis KV series firmware recovery
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote