STM32MP1 Unlock — Authorized Firmware Recovery for Dual-Core MPUs
STM32MP1 unlock refers to the authorized extraction or recovery of firmware and configuration data from STMicroelectronics’ STM32MP1-series microprocessors. These heterogeneous dual-core devices (Cortex-A7 + Cortex-M4) use a layered security model that combines TrustZone, secure boot chains, and OTP fuse-based read-out protection. Successful recovery depends on which security features were activated at provisioning, the specific sub-variant, and the condition of the physical die. Our engineers have handled dozens of STM32MP1 projects; below is a transparent breakdown of what is — and is not — realistically achievable.
What Protection Does the STM32MP1 Use?
Unlike single-core STM32 MCUs that rely primarily on RDP (Read-out Device Protection) levels 0–2, the STM32MP1 family implements a more complex, multi-layer scheme inherited from its application-processor heritage. Understanding these layers is the first step in any STM32MP1 unlock assessment.
Security Layers at a Glance
| Layer | Mechanism | Reversibility |
|---|---|---|
| Secure Boot (ROM code) | Authentication chain from on-chip ROM → FSBL → SSBL → OS. Uses ECDSA or RSA-2048/4096 key stored in OTP fuses. | Non-trivial; key hash is burned into OTP. If the private key is lost, boot chain cannot be re-signed without advanced recovery. |
| TrustZone (Cortex-A7) | Hardware isolation between Secure World and Normal World. Secure peripherals, memory regions, and ETZPC firewall. | Logical bypass is generally not possible without physical-level intervention on the die. |
| RDP (Cortex-M4 co-processor) | Similar to STM32 RDP Level 0/1/2 applied to the M4 flash/SRAM context. | Level 0 = open; Level 1 = recoverable with effort; Level 2 = permanent lockout, no known non-destructive path. |
| OTP Fuses (BSEC) | One-time programmable bits controlling secure boot enable, debug lock, key hashes, and lifecycle state. | Irreversible once blown; however, not all fuse words are always programmed in production units. |
| JTAG/SWD Lock | Debug port can be permanently or conditionally disabled via OTP. | Conditional lock may be opened with a password; permanent lock requires invasive techniques. |
Sub-Variants and Their Impact
The STM32MP1 family spans three lines — STM32MP151, STM32MP153, and STM32MP157 — with further package and temperature grade variants. The silicon revision matters: Rev. B and Rev. Z dice have known errata around secure-boot edge cases that can occasionally provide a recovery window our engineers exploit under controlled conditions. Rev. C and later revisions tightened these paths. During our feasibility assessment we identify the exact die revision via JTAG ID code or lot markings before committing to a technique.
Is STM32MP1 Unlock Feasible for Your Device?
Feasibility is not binary — it depends on the intersection of the protection state and the data you need. Here is a realistic decision matrix based on our lab experience.
| Scenario | Target Data | Feasibility | Notes |
|---|---|---|---|
| Secure boot OFF, JTAG open | eMMC / NAND / NOR image + M4 flash | High (>90%) | Standard read-out via SWD/JTAG + direct flash interface. Turnaround 3–5 days. |
| Secure boot ON, JTAG open | Encrypted boot image on external flash | Medium-High | External flash contents are readable but encrypted. Decryption requires key recovery from OTP — possible on some revisions. |
| Secure boot ON, JTAG locked (conditional) | Full firmware + keys | Medium | Password-based JTAG unlock attempted first; if password unknown, semi-invasive probing of OTP may be required. |
| Secure boot ON, JTAG permanently disabled, RDP Level 2 on M4 | Full firmware | Low | Requires invasive die-level techniques. Success not guaranteed; risk of die destruction. Cost significantly higher. |
We provide a free feasibility report before any paid work begins. You ship us the device (or provide high-resolution photos of the PCB and chip markings), and our team returns a written assessment within 2 business days.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewHow Our Engineers Approach an STM32MP1 Unlock
Step 1 — Identification and Triage
We read the chip markings, JTAG ID, and — where accessible — the BSEC shadow registers to determine the exact protection state. External flash type (eMMC, QSPI NOR, raw NAND) is identified and its contents imaged separately as a first-pass data capture.
Step 2 — Non-Invasive Extraction
If debug ports are open, we connect via ST-Link V3 or a custom OpenOCD configuration tuned for the MP1 dual-core topology. The Cortex-A7 and Cortex-M4 contexts are dumped independently. External flash is read through a dedicated programmer (e.g., Dediprog SF600 for SPI NOR, or SD/eMMC reader for managed NAND).
Step 3 — Semi-Invasive / Glitch-Based Techniques
When OTP-based locks block standard read-out, we apply voltage or electromagnetic fault injection at precisely timed points during the ROM-code boot sequence. On Rev. B silicon, a 3–8 ns glitch window during the BSEC shadow-register load can bypass the secure-boot authentication check, granting temporary debug access. This technique requires custom jig fabrication per board layout and typically adds 3–5 working days.
Step 4 — Invasive Recovery (Last Resort)
For fully locked devices where all non-destructive paths are exhausted, we decapsulate the package and use micro-probing or focused ion beam (FIB) editing to access OTP fuse contents directly. This is expensive ($2,000+), carries a non-zero risk of die damage, and is only recommended when the firmware value justifies the cost. We always discuss risk/reward transparently before proceeding.
Cost and Turnaround for STM32MP1 Unlock
| Protection Level | Typical Cost (USD) | Turnaround (Working Days) |
|---|---|---|
| Unprotected / JTAG open | $400 – $600 | 3 – 5 |
| Secure boot ON, JTAG conditional | $800 – $1,500 | 5 – 10 |
| Fully locked (invasive required) | $2,000 – $4,000+ | 10 – 20 |
Pricing depends on the number of sample units provided (we recommend shipping at least 2–3 to allow for destructive testing if needed), the target data scope, and whether you need the output as raw binary, ELF, or a re-flashable image with boot-header reconstruction.
Authorization and Legal Requirements
We perform STM32MP1 unlock exclusively for clients who demonstrate lawful ownership or authorization over the target firmware. Typical scenarios include:
- Legacy product maintenance — original firmware source lost; production line needs re-flashing capability.
- Second-source qualification — OEM recovering their own design from a contract manufacturer who retained the only programmed samples.
- Failure analysis — reading back firmware to compare against known-good images for root-cause investigation.
- IP audit — verifying that a subcontractor’s delivered firmware matches the contracted specification.
Every project is covered by a mutual NDA, and we require a signed declaration of ownership or authorization before work begins. For more on our compliance process, see our authorization and NDA framework.
STM32MP1 vs. Other STM32 Families — Key Differences
Engineers familiar with unlocking simpler STM32 MCUs often underestimate the STM32MP1’s security depth. The MP1 is not just “a bigger STM32” — it is an application processor with an embedded MCU co-processor, and its security model reflects that dual nature.
- The Cortex-A7 side boots from external flash through a multi-stage authenticated chain — there is no single monolithic firmware blob to extract.
- The Cortex-M4 side has its own independent RDP and option-byte configuration, which must be addressed separately.
- OTP fuse management (BSEC) adds a lifecycle-state concept (Open → Closed → Closed-Locked) that does not exist on standard STM32F/G/L parts.
If you are dealing with a simpler STM32 part, our process is faster and less costly. For instance, STM32F091 unlock or STM32L071 firmware recovery projects typically complete in 3–5 days at lower cost because those parts use straightforward RDP without secure boot chains.
Related Chip Unlock Services
Our lab handles a wide range of ARM Cortex-based microcontrollers beyond the STM32 ecosystem. If your project involves mixed-vendor boards, we can often bundle multiple IC recoveries into a single engagement:
- NXP i.MXRT crossover processor unlock — another Cortex-based MPU with HAB secure boot.
- Artery AT32F403 firmware extraction — a popular STM32F4-compatible alternative.
- STM32G070 read-out recovery — entry-level G0 series with simplified RDP.
Can the STM32MP1 be unlocked if secure boot is enabled and the signing key is lost?
It depends on the silicon revision and whether JTAG is permanently or conditionally disabled. On some Rev. B devices, fault-injection techniques can bypass the authentication check during early boot, granting temporary debug access. Rev. C and later tighten this significantly. We assess each case individually — ship us the device and we provide a free feasibility report within 2 business days.
Is the Cortex-M4 firmware on the STM32MP1 protected separately from the Cortex-A7 side?
Yes. The M4 co-processor has its own RDP level (0, 1, or 2) and option bytes independent of the A7’s secure boot configuration. It is possible for the A7 side to be fully locked while the M4 context remains at RDP Level 0, or vice versa. Our extraction process addresses both cores independently.
How many sample units should I send for an STM32MP1 unlock project?
We recommend 2–3 identical units. If the device is fully locked and semi-invasive or invasive techniques are required, one unit may be consumed during the glitch-characterization or decapsulation phase. Having spares avoids delays if the first attempt damages the die.
What deliverable formats do you provide after a successful STM32MP1 unlock?
Standard deliverables include raw binary images of each flash region (eMMC partitions, QSPI NOR, M4 internal flash), the option-byte / OTP configuration dump, and — where applicable — a reconstructed FIP (Firmware Image Package) suitable for re-flashing via STM32CubeProgrammer. We can also provide ELF files with symbol reconstruction at additional cost.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote