STM8S105 Unlock — Recovering Firmware from a Protected STM8
The STM8S105 unlock process extracts firmware from ST’s 8-bit microcontroller when its Read-Out Protection (ROP) bit is active. Our engineers recover the full flash contents — typically 16 KB or 32 KB depending on the sub-variant — using a combination of semi-invasive techniques and proprietary tooling. Feasibility exceeds 90 % on STM8S105 devices we have evaluated, with turnaround averaging 5–10 working days and pricing starting near $400 for a single-unit job.
What Protection Does the STM8S105 Use?
STMicroelectronics equips the STM8S “Access Line” family with a single-level Read-Out Protection (ROP) mechanism. When enabled, ROP blocks SWIM-interface read access to on-chip flash and EEPROM. Unlike the multi-level RDP system on STM32 parts, STM8S ROP is a binary on/off flag stored in the option bytes at address 0x4800.
Key technical details of STM8S105 protection:
- Protection scope: Program flash (up to 32 KB), 1 KB data EEPROM, and option bytes.
- Interface locked: SWIM (Single Wire Interface Module) — the only debug/programming port on STM8.
- No secure boot chain: The STM8S105 does not implement encrypted boot or secure-key storage, which simplifies recovery relative to Cortex-M parts with TrustZone.
- Package variants: LQFP-32, LQFP-44, LQFP-48, LQFP-64 — all share the same die and ROP implementation.
Because the protection is a single hardware flag without fuse-blow or anti-tamper mesh, STM8S105 unlock is among the more straightforward MCU recovery jobs we handle. That said, die revision, fabrication lot, and package condition all influence the approach and timeline.
How Our Engineers Perform an STM8S105 Unlock
Step 1 — Feasibility Assessment
You ship us the target device (or the entire PCB). We verify the exact part number (e.g., STM8S105K4T6, STM8S105C6T6), confirm ROP status via SWIM probe, and inspect the package under magnification for damage, remarking, or prior decap attempts. This assessment is free; if we determine recovery is not viable, you pay nothing.
Step 2 — Semi-Invasive Recovery
Our lab uses controlled chemical decapsulation to expose the die, followed by micro-probing or fault-injection techniques targeted at the ROP latch circuitry. The STM8S105’s 130 nm process node and relatively simple memory controller make it a well-characterized target. We maintain die maps for multiple STM8S105 revisions, reducing setup time significantly.
Step 3 — Verification & Delivery
Extracted firmware is verified by checksum comparison and, where possible, functional re-programming into a blank STM8S105 on a test jig. You receive:
- Binary file (.bin or Intel HEX) of the full program flash.
- Data EEPROM dump (1 KB).
- Option-byte map documenting the original ROP and watchdog settings.
All deliverables are transferred via encrypted channel under NDA. We require proof of ownership or written authorization before starting work — see our authorization and NDA policy for details.
STM8S105 Unlock Cost and Turnaround
| Parameter | Typical Value | Notes |
|---|---|---|
| Feasibility rate | 90 %+ | Based on STM8S105 jobs completed 2021–2024 |
| Standard turnaround | 5–10 working days | From receipt of device to delivery of binary |
| Rush turnaround | 3–5 working days | +30 % surcharge |
| Starting price (single unit) | ~$400 | Varies by sub-variant and flash size |
| Volume discount threshold | ≥5 units | 10–20 % reduction per unit |
| Destructive risk | Low (~5 %) | Chemical decap may damage die on older lots |
Price depends on the specific sub-variant. The STM8S105K4 (16 KB flash) is faster to verify than the STM8S105C6 (32 KB), so cost may differ by $50–$100. We provide a firm quote after the free feasibility check.
When Does STM8S105 Unlock Make Sense?
Authorized firmware recovery is the right move in several common scenarios:
- Lost source code: An original developer left the company, and the only copy of the firmware lives inside a production unit.
- Legacy equipment maintenance: The STM8S105 controls a motor driver, HMI panel, or sensor node in equipment that must stay in service, but the programming tool chain or source is unavailable.
- Prototype recovery: You built a working prototype, programmed it, and need to reconstruct the binary for a production run.
- Failure analysis: Comparing firmware from a failing unit against a known-good binary to isolate a corruption or programming error.
If your project involves a different ST microcontroller — for instance, a Bluetooth-enabled STM32WB55 with RDP Level 1 or 2 — the protection architecture and pricing differ substantially. We handle both, but the STM8S105 is considerably simpler.
STM8S105 vs. Other Common MCU Unlock Targets
| MCU Family | Protection Type | Typical Feasibility | Relative Difficulty |
|---|---|---|---|
| STM8S105 | ROP (single-level) | 90 %+ | Low |
| GD32E230 | SWD read protection | 85–90 % | Low–Medium |
| nRF52840 | APPROTECT (hardware) | 70–85 % | Medium–High |
| PIC16F18x | CP bit (code protect) | 90 %+ | Low |
| MSP430F2x | JTAG fuse + BSL password | 80–90 % | Medium |
The STM8S105 sits at the easier end of the spectrum. If you also need to recover firmware from a GD32E230 or a Nordic nRF52840, we can bundle the work and reduce overall cost.
What Can Go Wrong?
Transparency matters. Here are the realistic failure modes we see on STM8S105 unlock jobs:
- Die damage during decap: Approximately 5 % of devices — especially LQFP-32 packages from older wafer lots — suffer bond-wire lift or passivation cracking. We mitigate this with controlled acid concentration and temperature profiling, but the risk is non-zero.
- Remarked or counterfeit parts: We occasionally receive devices marked as STM8S105 that contain a different die (sometimes an STM8S003). If the die doesn’t match, our process map won’t apply. We identify this during feasibility and inform you immediately.
- Corrupted flash: If the original firmware was partially erased or the device experienced latch-up, the extracted binary may be incomplete. We flag suspect regions in the deliverable.
Frequently Asked Questions
Is STM8S105 unlock legal?
Yes, when performed on devices you own or are authorized to access. Firmware recovery for maintenance, failure analysis, or IP you created is lawful in most jurisdictions. We require written proof of ownership or a signed authorization letter before beginning work. Read our trust and compliance page for the full policy.
Do you need the chip removed from the PCB?
Not necessarily. We can work with the chip soldered to the board, though desoldering gives us better access for decapsulation. If you prefer, ship the entire assembly and we will handle removal and — if needed — re-soldering after recovery.
Can the recovered firmware be programmed into a new STM8S105?
Yes. The binary we deliver is a standard flash image that can be written via SWIM using ST’s STVP programmer or any compatible tool. We include the option-byte configuration so you can replicate the original protection and watchdog settings.
What if my device is an STM8S105 variant I don’t see listed?
All STM8S105 sub-variants (K4, K6, C4, C6, S4, S6) share the same die-level ROP mechanism. The process applies to every package and flash-size option. Differences affect only verification time and cost.
How does STM8S105 compare to EEPROM recovery like the 24C256?
Serial EEPROMs such as the 24C256 rarely have hardware read protection — the challenge is usually a locked I²C address or board-level access control. MCU unlock on the STM8S105 is a fundamentally different (and more involved) process targeting on-chip flash behind a protection fuse.
Related IC Unlock Services
If you are working across multiple platforms, these pages cover chips our lab handles regularly:
- MSP430F2 firmware recovery — TI’s ultra-low-power 16-bit MCU with JTAG fuse protection.
- PIC16F18 code-protect unlock — Microchip’s mid-range 8-bit family with CP bit.
Check feasibility for your project
Send the chip marking or board details and tell us what you need to recover. Add clear photos if available.
Request a feasibility reviewWorking on a board like this?
Send the chip marking or two photos. You get feasibility, lead time and price within 24 hours, and the check costs nothing.
Get a free quote