STM32G431 Unlock — What You Need to Know First
The STM32G431 can be unlocked in most cases when Read-Out Protection (RDP) is set to Level 1. Our engineers use a combination of voltage glitching, debug-interface exploitation, and proprietary techniques to recover firmware from this Cortex-M4F microcontroller. RDP Level 2 devices are a different matter entirely — success is not guaranteed and requires a dedicated feasibility study before any commitment. Authorization and proof of ownership are required for every STM32G431 unlock project we accept.
Understanding STM32G431 Protection Architecture
The STM32G431 belongs to ST’s G4 series, built on the 90 nm process with up to 128 KB of flash and 32 KB of SRAM. ST implements a three-tier read-out protection scheme across the G4 family:
| Protection Level | Debug Access | Flash Readout | Unlock Feasibility |
|---|---|---|---|
| RDP Level 0 | Full SWD/JTAG | Unrestricted | No unlock needed — read directly |
| RDP Level 1 | Limited (no flash read) | Blocked via debug | High success rate — standard service |
| RDP Level 2 | Permanently disabled | Permanently blocked | Requires invasive analysis; case-by-case |
Beyond RDP, the STM32G431 offers Proprietary Code Readout Protection (PCROP) on specific flash sectors and write protection (WRP) on individual pages. PCROP zones can block extraction of selected code regions even after an RDP Level 1 bypass. Our pre-assessment identifies whether PCROP is active before we quote a price.
Option Bytes and Firewall Considerations
The G4 series also features a Firewall peripheral that segments code and data regions in volatile memory. While the Firewall doesn’t directly protect flash contents at rest, it can complicate runtime-based extraction methods. We analyze option byte configurations — including BOR level, nBOOT0, nSWBOOT0, and IWDG settings — to select the optimal attack vector for each specific STM32G431 device.
How We Approach an STM32G431 Unlock
Every project follows a structured workflow designed to protect both the device and your data:
- Intake & Authorization: You submit the device along with proof of IP ownership or a signed authorization letter. We execute a mutual NDA before any technical work begins.
- RDP Level Identification: We connect via SWD to determine the exact protection state — RDP level, PCROP zones, WRP sectors, and option byte map.
- Technique Selection: For RDP Level 1, we typically use voltage fault injection on the VDDA or VDD rail during the RDP check routine. Timing windows are in the 5–50 ns range, requiring sub-nanosecond glitch positioning.
- Flash Extraction: Once the protection check is bypassed, we dump the full flash contents — typically 128 KB for the STM32G431CBU6 or 32 KB for the STM32G431K6 variants.
- Verification: We verify the extracted binary against vector table structure, CRC where available, and known peripheral initialization patterns to confirm integrity.
- Delivery: Firmware is delivered as a raw .bin or Intel HEX file, encrypted and transferred through our secure portal.
For RDP Level 2 devices, the approach shifts to semi-invasive or fully invasive techniques — decapsulation, microprobing, or UV-based attacks on the NVM cells. These are not always successful on 90 nm geometry parts, and we provide an honest feasibility assessment before you invest.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWhich STM32G431 Variants Can Be Unlocked?
The G431 sub-family includes multiple package and memory configurations. Here is a breakdown of common part numbers and their unlock outlook:
| Part Number | Flash Size | Package | RDP L1 Unlock | RDP L2 Outlook |
|---|---|---|---|---|
| STM32G431CBU6 | 128 KB | UFQFPN48 | Standard | Feasibility study required |
| STM32G431KBU6 | 128 KB | UFQFPN32 | Standard | Feasibility study required |
| STM32G431RBT6 | 128 KB | LQFP64 | Standard | Feasibility study required |
| STM32G431C6U6 | 32 KB | UFQFPN48 | Standard | Limited — smaller die area |
| STM32G431K6U6 | 32 KB | UFQFPN32 | Standard | Limited |
The LQFP64 package variants tend to be slightly easier to work with due to accessible power pins for glitch injection. QFN packages require more careful probe placement but remain fully serviceable.
STM32G431 Unlock Cost and Turnaround
Pricing depends on the protection level, PCROP usage, and urgency. Here are typical ranges:
| Scenario | Typical Cost (USD) | Turnaround |
|---|---|---|
| RDP Level 1, no PCROP | $400 – $900 | 5–10 working days |
| RDP Level 1 + PCROP active | $700 – $1,500 | 7–15 working days |
| RDP Level 2 (feasibility study) | $200 – $500 (study fee) | 3–5 working days for assessment |
| RDP Level 2 (full attempt) | $2,000 – $5,000+ | 15–30 working days |
Rush service (48-hour priority queue) is available for RDP Level 1 jobs at a 40–60% surcharge. We operate on a no-read-no-fee basis for Level 1 projects — if we cannot extract valid firmware, you pay nothing beyond the initial assessment.
When Does STM32G431 Unlock Make Sense?
Legitimate use cases we handle regularly include:
- Lost source code recovery: An engineer leaves the company, the repository is corrupted, and the only copy of production firmware lives inside a programmed STM32G431.
- Legacy equipment maintenance: Industrial controllers or motor drives built around the G431 need firmware updates, but the original development environment is gone.
- Prototype verification: You need to confirm that a contract manufacturer programmed the correct binary into your devices before shipping.
- Second-source qualification: Verifying firmware identity across multiple production batches for quality control.
We do not accept projects intended to copy or pirate third-party intellectual property. Every engagement requires documented authorization, and we maintain full audit trails. Learn more about our STM32MP1 unlock process for comparison with higher-complexity STM32 application processors.
STM32G431 vs. Related MCU Unlock Complexity
How does the G431 compare to other targets our lab handles? The table below provides context:
| MCU Family | Process Node | Protection Scheme | Relative Difficulty |
|---|---|---|---|
| STM32G431 (Cortex-M4F) | 90 nm | RDP L0/L1/L2 + PCROP | Moderate |
| EFM32G (Cortex-M3) | 180 nm | Debug Lock | Low–Moderate |
| PIC18FK (8-bit) | Older process | Code Protect bits | Low |
| SAMD20 (Cortex-M0+) | 110 nm | Security bit | Low–Moderate |
| XC866 (8051-based) | 130 nm | Security fuses | Moderate |
For simpler 8-bit or EEPROM targets, you may find our 24C256 EEPROM unlock or PIC18FK unlock services more relevant. For other Arm Cortex parts, see our work on the EFM32G unlock and SAMD20 unlock.
What Can Go Wrong
Transparency matters. Here are realistic failure modes and constraints:
- RDP Level 2 permanence: ST’s Level 2 fuses a physical bit. There is no software path back. Invasive methods have a meaningful failure rate on 90 nm parts.
- PCROP masking: Even after RDP bypass, PCROP-protected sectors may read as 0x00 or 0xFF. Recovering those regions requires additional techniques and time.
- Device damage: Voltage glitching can, in rare cases (~1–2%), cause latch-up or permanent damage to the power regulator. We carry spare devices when the client provides multiples.
- Encrypted payloads: If the firmware itself is AES-encrypted in flash (application-layer encryption, not hardware RDP), the raw binary will be unreadable without the key — that is outside the scope of an unlock service.
Frequently Asked Questions
Can you unlock an STM32G431 with RDP Level 2?
We can attempt it, but success is not guaranteed. RDP Level 2 permanently disables debug access at the hardware level. Our lab uses semi-invasive techniques — decapsulation and microprobing — which work on some G4 devices but not all. We charge a separate feasibility study fee ($200–$500) before committing to a full attempt, so you know the realistic odds before investing further.
Is STM32G431 unlock legal?
Yes, when performed on firmware you own or are authorized to access. Typical legal scenarios include recovering your own lost source code, maintaining legacy equipment, or verifying contract-manufactured devices. We require proof of ownership or a signed authorization letter, and we operate under NDA. We decline any project that appears intended to infringe third-party IP.
How do I know which RDP level my STM32G431 is set to?
Connect to the chip via SWD using an ST-Link or J-Link probe. If you can read the option bytes at address 0x1FFF7800, the device is at RDP Level 0. If the debugger connects but flash reads are blocked, it is Level 1. If the debugger cannot connect at all, the device is likely Level 2. We perform this assessment as part of our intake process at no extra charge.
Do you need the entire PCB, or just the chip?
We can work with either. Sending the full PCB is often easier — we desolder the MCU ourselves if needed and can verify pinout and power rail routing. If you desolder the STM32G431 yourself, use a hot-air station at 260°C max to avoid thermal damage to the flash cells. Ship in an ESD-safe container with foam padding.
What file format is the recovered firmware delivered in?
Standard delivery is a raw .bin file covering the full flash address range. We also provide Intel HEX (.hex) on request. If PCROP regions are present and partially recovered, we annotate the address map so you know exactly which sectors are complete and which may have gaps.
For other Infineon or specialty MCU targets, explore our XC866 unlock service — a common request from industrial control engineers working with 8051-architecture devices.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote