STM32WL Unlock: What You Need to Know First
The STM32WL is ST Microelectronics’ sub-GHz wireless system-on-chip — the first STM32 to integrate a LoRa/FSK/MSK/BPSK radio transceiver directly on the Arm Cortex-M4/M0+ die. That integration makes it popular in smart metering, asset tracking, and industrial IoT gateways. It also means an STM32WL unlock involves more than just flash readout: you must account for radio calibration data, secure key storage, and dual-core firmware partitioning that don’t exist on standard STM32 families.
Our engineers have handled STM32WL recovery across multiple sub-variants — STM32WL55, STM32WL54, STM32WLE5, and STM32WLE4. Below is a frank assessment of what is technically feasible, what it costs, and where the hard limits sit.
How Does the STM32WL Protect Its Firmware?
Like all STM32 parts, the STM32WL uses ST’s Readout Protection (RDP) mechanism, but with nuances specific to the wireless and dual-core architecture:
| Protection Level | What It Does | Unlock Feasibility |
|---|---|---|
| RDP Level 0 | No protection — JTAG/SWD read access open | Trivial; standard readout via ST-Link |
| RDP Level 1 | Flash read blocked via debug interface; SRAM readable under certain conditions; regression to Level 0 triggers full flash erase | Recoverable in most cases via fault injection or side-channel techniques — does not erase flash when our method is used |
| RDP Level 2 | Permanent: JTAG/SWD physically disabled, option bytes locked, no regression possible | Extremely difficult; requires invasive die-level work with no guarantee — success depends on specific silicon revision |
Beyond RDP, the STM32WL adds:
- Secure User Memory (PCROP) — proprietary-code read-out protection on selectable flash sectors, enforced independently of RDP.
- Write Protection (WRP) — prevents accidental or malicious sector erasure.
- Hardware Secure Storage — AES-256 keys stored in a one-time-programmable area used for LoRaWAN session keys (AppKey, NwkKey).
- Dual-core isolation — CPU1 (Cortex-M4) and CPU2 (Cortex-M0+, running the radio stack) have independent flash banks with separate access control. Unlocking one does not automatically unlock the other.
This layered scheme means a blanket “unlock” isn’t a single operation. Our process addresses each layer in sequence, and we report exactly which sections were recoverable before you pay for the full extraction.
Which STM32WL Sub-Variants Can Be Unlocked?
The STM32WL family splits into single-core (WLE) and dual-core (WL5) lines. Protection behavior differs slightly:
| Sub-Family | Core(s) | Flash Size | RDP 1 Recovery | RDP 2 Recovery |
|---|---|---|---|---|
| STM32WLE5 | Cortex-M4 only | 64–256 KB | High success rate | Case-by-case; invasive |
| STM32WLE4 | Cortex-M4 only | 64–256 KB | High success rate | Case-by-case; invasive |
| STM32WL55 | Cortex-M4 + M0+ | 256 KB | Moderate — dual-bank adds complexity | Very limited |
| STM32WL54 | Cortex-M4 + M0+ | 256 KB | Moderate | Very limited |
Single-core WLE variants are closer in architecture to the mainstream STM32L5 series with TrustZone, and our existing tooling transfers well. Dual-core WL55/WL54 parts require separate extraction passes for each core’s flash bank, adding time but not necessarily reducing the success rate for RDP Level 1.
What Makes STM32WL Unlock Different from Other STM32 Families?
Three factors set the STM32WL apart from, say, an STM32WB Bluetooth SoC unlock or a general-purpose STM32F4 recovery:
1. Integrated Radio Calibration Data
ST stores factory RF calibration constants in a protected system flash area. If your goal is to replicate a working LoRa node — not just read application code — we need to extract or reconstruct these constants. Without them, TX power, frequency offset, and RSSI accuracy degrade noticeably (±2–3 dB typical).
2. LoRaWAN Key Material
Many STM32WL designs store AppKey, NwkKey, or DevEUI in OTP or secure SRAM. These keys are often the real target of a recovery project — for example, when migrating a deployed sensor fleet to a new network server. OTP readout depends heavily on whether the keys were written before or after RDP was set.
3. Sub-GHz PHY Firmware on CPU2
On dual-core variants, ST supplies a pre-compiled radio stack binary that runs on the Cortex-M0+. This binary is covered by its own access-control bits. If you need the complete firmware image — application plus radio stack — both banks must be extracted, which roughly doubles the analysis effort compared to a single-core STM32C0 entry-level unlock.
Our STM32WL Unlock Process Step by Step
- Feasibility assessment (free) — You send us the exact part number (e.g., STM32WLE5J8I6), package marking photo, and a description of what data you need recovered. We confirm the protection level remotely when possible (SWD probe response tells us RDP 0 vs. 1 vs. 2).
- Authorization & NDA — We require proof of design ownership, a signed NDA, and a statement of intended use. This is non-negotiable. Read more on our approach to authorized recovery and IP ethics.
- Sample shipment — You ship 1–3 programmed ICs (or populated boards). We recommend at least 2 samples for RDP Level 2 attempts because invasive methods can consume a sample.
- Protection analysis — We map RDP level, PCROP sectors, WRP settings, and OTP status. This takes 1–2 working days.
- Extraction — For RDP 1: non-invasive fault-injection or glitching on the voltage rail during boot, targeting the RDP check window. For RDP 2: micro-probing after chemical decapsulation (not always successful). Typical extraction window: 3–10 working days.
- Verification & delivery — Binary image verified via CRC against the flash size declared in the option bytes. Delivered as a raw .bin, Intel HEX, or Motorola S-record — your choice.
Cost and Lead Time for STM32WL Unlock
| Scenario | Typical Cost (USD) | Lead Time (working days) |
|---|---|---|
| RDP Level 0 readout (no protection) | $100–$150 | 1–2 |
| RDP Level 1, single-core (WLE5/WLE4) | $400–$900 | 5–10 |
| RDP Level 1, dual-core (WL55/WL54) | $700–$1,400 | 7–15 |
| RDP Level 2, any variant | $2,000–$5,000+ | 15–30; no-success-no-fee option |
| LoRaWAN key recovery (OTP) | $300–$600 add-on | Included in extraction window |
Pricing varies by flash size, number of PCROP-protected sectors, and whether you need just the application binary or the full dual-bank image including the radio stack. We quote fixed-price after the free feasibility check — no hourly billing surprises.
When STM32WL Unlock Is Not the Right Path
Honesty saves everyone time. We will tell you upfront if:
- The chip is RDP Level 2 on a recent silicon revision (Rev Y or later on WL55) — success probability drops below 30%, and the cost may exceed designing a new firmware.
- Your real need is the source code, not the binary. We extract machine code; decompiling Cortex-M4 binaries back to readable C is a separate reverse-engineering effort with variable results.
- The firmware is encrypted at rest using the STM32WL’s AES hardware engine with a key stored in OTP — even a successful flash dump yields ciphertext without the key.
In these cases, we can still help with board-level PCB reverse engineering to recover schematics, Gerbers, and BOM so you can re-develop firmware on a clean codebase.
Related Microcontroller Unlock Services
If you work across multiple MCU families, we maintain proven tooling for dozens of architectures beyond the STM32WL. Engineers working with Microchip parts may find our ATSAM4 unlock service or AT90 AVR recovery process relevant — the protection models differ substantially from ST’s RDP, and each requires family-specific techniques.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewCan the STM32WL be unlocked without erasing the flash?
Yes, for RDP Level 1. Our fault-injection method bypasses the readout protection check without triggering the mass-erase sequence that a normal RDP regression would invoke. For RDP Level 2, invasive methods read the flash directly from the silicon, so erasure is not a factor — but the chip is physically consumed in the process.
Do I need to remove the STM32WL from the PCB before sending it?
Not necessarily. For RDP Level 1 work, we can probe SWD pads on a populated board if the test points are accessible. For RDP Level 2 invasive work, we do need the bare IC — we can desolder it ourselves if you send the complete board.
Will the recovered firmware include LoRaWAN session keys?
It depends on where the keys are stored. Keys in main flash are included in the binary dump. Keys in OTP require a separate extraction step (available as an add-on). Keys generated at runtime and held only in volatile SRAM are lost at power-down and cannot be recovered from a powered-off chip.
Is STM32WL unlock legal?
Firmware recovery is legal when performed on your own intellectual property — for example, recovering firmware you developed but lost the source code for, or maintaining legacy equipment you own. We require proof of ownership or written authorization before starting any project. See our trust and authorization policy for details.
How does STM32WL protection compare to STM32WB?
Both use RDP Levels 0/1/2, but the STM32WB adds a secure enclave for its Bluetooth stack that is managed by ST’s proprietary FUS (Firmware Upgrade Services). The STM32WL’s radio stack on CPU2 is less isolated, making dual-bank extraction somewhat more straightforward on the WL series. Read our STM32WB unlock breakdown for a direct comparison.
Working on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote