STM32WB55 Unlock — What You Need to Know First
The STM32WB55 is ST Microelectronics’ dual-core wireless MCU pairing an Arm Cortex-M4 application processor with a Cortex-M0+ network processor dedicated to Bluetooth 5.0 LE and IEEE 802.15.4. Its flash protection scheme — three-level RDP (Read-out Protection) plus optional PCROP and WRP — makes STM32WB55 unlock a technically demanding task. Our engineers can recover firmware from RDP Level 1 devices with high confidence and evaluate Level 2 parts on a case-by-case basis, provided the requester demonstrates proof of IP ownership or authorized maintenance rights.
How Does the STM32WB55 Protect Its Firmware?
Understanding the protection stack is essential before committing time or budget. The STM32WB55 implements multiple independent mechanisms that can be layered together:
| Protection Layer | Scope | Recovery Difficulty |
|---|---|---|
| RDP Level 0 | No protection — flash fully readable via SWD/JTAG | Trivial (no unlock needed) |
| RDP Level 1 | Debug access disabled; flash unreadable while debugger attached. Regression to Level 0 erases flash. | Moderate — non-invasive and semi-invasive techniques applicable |
| RDP Level 2 | Permanent lock — debug port physically disabled, option-byte changes blocked | High — requires invasive die-level work; success not guaranteed |
| PCROP (Proprietary Code Read-Out Protection) | Specific flash sectors execute-only; even DMA reads blocked | Adds complexity on top of RDP; sector-granular |
| WRP (Write Protection) | Prevents modification of selected sectors | Low standalone impact on readout recovery |
| Secure User Memory (SFSA) | Cortex-M0+ wireless stack area isolated from M4 core | Separate address space; requires dual-core handling |
The dual-core architecture introduces an extra wrinkle: the Cortex-M0+ manages the BLE/802.15.4 stack in a secure flash region (starting at the address defined by SFSA in the option bytes). Standard STM32 unlock approaches must account for this partition or the recovered image will be incomplete.
What Makes STM32WB55 Unlock Different from Single-Core STM32?
Many engineers familiar with GD32E230 firmware recovery or similar single-core Cortex-M0 parts assume the same workflow applies. The STM32WB55 adds three specific complications:
- Dual flash banks with independent access control. The M4 application flash (up to 1 MB) and the M0+ wireless stack flash are protected separately. Recovering one does not automatically yield the other.
- Shared SRAM with hardware semaphores (HSEM). Inter-processor communication data stored in SRAM2a/SRAM2b may be relevant to full firmware reconstruction.
- Fused BLE stack. ST ships the M0+ radio firmware as a pre-compiled binary (stm32wb5x_BLE_Stack_full_fw.bin or similar). If the OEM loaded a custom stack variant, identifying the exact version matters for functional restoration.
These factors mean STM32WB55 unlock typically requires 20–40% more lab time than an equivalent single-core STM32F4 at the same RDP level.
Realistic Success Rates and Limitations
We are transparent about what is and is not achievable. Overpromising wastes everyone’s time.
RDP Level 1
Our lab has consistent results recovering full application flash contents from RDP-1 STM32WB55 devices using a combination of voltage-glitch fault injection on the VDDA rail and controlled debug-session exploitation. The 40 nm process node used in the STM32WB55 responds well to sub-nanosecond glitch profiles tuned between 1.08 V and 1.21 V. Typical success window: first successful readout within 2–6 hours of active glitching, depending on decoupling capacitor configuration on the target board.
RDP Level 2
Level 2 fuses the debug port permanently. Recovery requires decapsulation and die-level probing or laser fault injection — techniques that are time-intensive and carry a meaningful failure risk. We evaluate Level 2 requests individually; budget and timeline are significantly higher, and we will decline the job if preliminary analysis suggests the die revision has mitigations that make success unlikely.
PCROP-Protected Sectors
PCROP sectors resist even DMA-based readout from the M4 core. When PCROP is active alongside RDP Level 1, our approach targets the flash controller bus directly during the glitch window. Success depends on the number of PCROP-protected sectors and their placement. We request the option-byte dump (if available) before quoting.
STM32WB55 Unlock Cost and Turnaround
| Scenario | Estimated Cost (USD) | Turnaround (Working Days) |
|---|---|---|
| RDP Level 0 (read only, no unlock needed) | $0 – $150 handling fee | 1–2 |
| RDP Level 1, no PCROP | $450 – $900 | 5–8 |
| RDP Level 1 + PCROP | $800 – $1,500 | 7–12 |
| RDP Level 2 (feasibility eval first) | $2,000+ (quoted after eval) | 15–30+ |
Pricing depends on package type (UFBGA129 vs. WLCSP100 vs. UFQFPN48 — each has different decap and probing geometry), board condition, and whether you need the wireless stack region recovered alongside application firmware. We provide a binding quote after the free feasibility assessment.
Our STM32WB55 Unlock Process — Step by Step
- Feasibility request. You submit the part number (e.g., STM32WB55CEU6, STM32WB55RGV6), known protection level if available, and proof of ownership or authorization.
- Option-byte analysis. If you can supply an option-byte dump or SWD connection log showing the RDP level, we skip exploratory probing and quote faster.
- Lab evaluation (free). We connect the device, confirm the protection configuration, and determine the best attack vector. You receive a go/no-go recommendation within 2 working days.
- Firmware extraction. Upon approval, our engineers execute the recovery. For RDP-1 jobs, this is typically glitch-based. We verify the dump with CRC checks against the internal flash checksum registers.
- Delivery. You receive a raw binary (.bin) or Intel HEX (.hex) file covering the recovered address range, plus an option-byte configuration report. If the M0+ wireless stack was recovered, it is delivered as a separate image with version identification.
Authorization and Legal Requirements
STM32WB55 unlock is performed exclusively for authorized parties — original firmware developers recovering a lost build, OEMs maintaining legacy products, or repair facilities with documented customer authorization. We require a signed declaration of ownership or a maintenance/repair agreement before work begins. Every engagement is covered by a mutual NDA. For details on our compliance framework, see our trust and authorization policy.
Related MCU Unlock Services
If your project involves multiple microcontrollers or you are evaluating alternatives, our lab handles a wide range of Arm Cortex-M and RISC-V parts. Engineers working with mixed BOM designs often need parallel recovery for companion controllers:
- GD32VF103 RISC-V firmware recovery — common in cost-reduced BLE gateway boards paired with STM32WB modules.
- SAMD20 unlock — Microchip’s Cortex-M0+ line, often found on sensor nodes in the same 802.15.4 mesh as STM32WB55 coordinators.
- AT32F413 flash readout — Artery’s STM32F4-compatible part, used as application processors alongside STM32WB radios.
Frequently Asked Questions
Can the STM32WB55 be unlocked without erasing the flash?
Yes, for RDP Level 1. Our glitch-based method reads flash contents without triggering the mass-erase that a normal RDP regression would cause. RDP Level 2 recovery also aims to preserve contents, but the invasive techniques involved carry a small risk of partial data loss in edge cases.
Do you recover the BLE wireless stack from the M0+ core as well?
We can extract the M0+ secure flash region if it is needed and not independently fuse-locked by ST’s factory programming. In most production devices, the wireless stack binary is a standard ST release that can be matched by version rather than read out. We identify the version and confirm whether a direct dump is necessary.
What if I only know the board, not the exact STM32WB55 variant?
Ship us the board. We will identify the exact part number from the package marking, determine the flash size and protection level, and include this in the free feasibility report. No upfront cost for identification.
Is the recovered firmware a 1:1 copy of what was programmed?
The binary we deliver is a bit-accurate image of the flash contents at the time of extraction. It includes application code, const data, and any configuration stored in flash. It does not include OTP (one-time-programmable) area contents unless specifically requested, and it does not reconstruct source code — you receive machine code only.
How does pricing compare to other STM32 families?
The dual-core architecture and larger flash of the STM32WB55 make it 20–40% more expensive to unlock than a comparable single-core STM32F1 or STM32G0 at the same RDP level. The wireless stack analysis adds a verification step that single-core parts do not require.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote