STM32 Firmware Recovery: Complete RDP Guide and Extraction Methods

August 27, 2026
8:42 am

STM32 Firmware Recovery: Complete Guide to RDP Levels and Extraction Methods

Introduction: STM32 and the Firmware Recovery Challenge

STMicroelectronics’ STM32 family — based on ARM Cortex-M cores — is the workhorse of modern embedded systems. From industrial PLCs to consumer electronics to automotive modules, STM32 chips are everywhere. As a result, STM32 firmware recovery is the most common MCU extraction request we receive.

The challenge: STM32 includes Readout Protection (RDP), a hardware-level feature that blocks JTAG/SWD debug access to flash memory. When the original firmware source code is lost, the developer is locked out, or the OEM has discontinued support, understanding STM32’s protection mechanisms is the first step to recovery.

This article is a deep-dive into STM32-specific firmware recovery. For a broader overview of MCU firmware recovery — covering PIC, AVR, MSP430, and other families — see our MCU Firmware Recovery Service hub article.

Key Takeaways

STM32 firmware is recoverable at all RDP levels, but the method changes: SWD for RDP 0, glitching or chip-off for RDP 1, chip-off only for RDP 2
Mass erase destroys firmware — it does NOT recover it. This is the most common misconception in STM32 recovery
STM32 series matters: F1 is easier to recover than H7; newer series have more hardened security
Flash encryption is different from RDP: encryption means the dump is encrypted, not that it can’t be read
RDP 2 requires chip-off: permanent lockout means JTAG/SWD is completely disabled

Understanding STM32 Readout Protection (RDP)

The primary mechanism protecting STM32 firmware is RDP (Readout Protection). Unlike simple “lock bits” on 8-bit MCUs, STM32’s RDP has three discrete levels, each with very different behavioral implications.

RDP Level 0: No Protection

Factory default. JTAG and SWD have full access to all flash memory, SRAM, and registers. You can read, write, and erase at will. Firmware can be dumped in seconds.

RDP Level 1: Standard Protection

Debug access is blocked. CPU can be halted and examined, but flash memory read commands are blocked. Critically: Mass erase via debug IS still possible — which downgrades RDP to Level 0 but destroys the firmware in the process.

RDP Level 2: Maximum Protection

Permanent lockout. JTAG/SWD does not respond at all. The chip appears dead from a debug perspective. Boot from system memory is disabled. Option bytes cannot be changed. RDP 2 is one-way — there is no software method to downgrade it.

RDP Level Comparison Table

Property	RDP 0	RDP 1	RDP 2
SWD/JTAG Read	Full access	Blocked	Blocked
Flash Erase via Debug	Yes	Yes (downgrades RDP)	Blocked
Bootloader Flash Read	Yes	Blocked	Blocked
Recovery Difficulty	None	Medium (glitching)	High (chip-off)

STM32 Series and Recovery Difficulty

Not all STM32 series are equally vulnerable to firmware extraction:

Easiest: STM32F1, STM32F0, STM32L0

Older architecture and die process. Well-documented glitching success. STM32F1 has been extensively studied by the reverse engineering community.

Medium: STM32F4, STM32L4, STM32F7

STM32F4 is the most popular series; glitching success rates are documented (20–40%). More hardened than F1, but still vulnerable on certain die revisions.

Hardest: STM32H7

Dual-core, Secure Boot, SBRV protection, and TrustZone on M33 variants. Glitching success rate: 5–15%. Chip-off is the reliable path for all H7 protection levels.

Firmware Extraction Methods for STM32

Method 1: Direct SWD (RDP 0 Only)

Connect via SWD (PA13=SWDIO, PA14=SWCLK) using ST-Link, J-Link, or CMSIS-DAP. Read flash with STM32CubeProgrammer, OpenOCD, or J-Link Commander. Success rate: 100%. Non-destructive.

Method 2: Mass Erase — NOT Recovery

Important: Mass erase does NOT recover firmware. It erases the flash and downgrades RDP to Level 0. The original firmware is gone forever. Mass erase is for reprogramming, not recovery.

Method 3: Voltage Glitching (RDP 1)

Bypass the RDP check to get one flash read before protection re-engages. Target: STM32F1 (best), STM32F4 (varies), STM32L4 (some success). Success rate: 20–40%. If this fails, move to chip-off.

Method 4: Bootloader Exploit (Limited)

The built-in bootloader supports flash read via UART, SPI, I2C if BOOT0 is high and RDP is Level 0. If RDP is Level 1 or 2, the bootloader blocks flash read. Only useful if RDP is Level 0.

Method 5: Chip-Off / IC Decapsulation (RDP 1 or 2)

As a last resort: remove MCU, decapsulate to expose die, use microprobe station to read flash memory cells. Works for RDP 1 (when glitching fails) and RDP 2. Our IC decapsulation service covers this in detail.

Flash Encryption vs Read Protection

RDP and Flash Encryption are separate features. RDP blocks debug access (flash is in plain text). Flash Encryption encrypts the flash contents using AES. Even via decapsulation, you get encrypted data. Without the AES key (stored in unreadable OTP), decryption is not feasible.

Cloning to a different chip: Not possible — each chip has a unique key
Restoring to the same chip: Possible if chip is functional and RDP is not Level 2
Analyzing code: You see encrypted regions but cannot read the code

How to Identify Your STM32 Chip

Part number format: STM32 [Series][Pin Count][Package Code][Temperature]

Example: STM32F407VGT6: F4 series, 100-pin, LQFP package, industrial temp. If unsure, send us a photo of the top marking.

Related Firmware Recovery Services

MCU firmware recovery service — Hub article for all MCU families
PIC microcontroller code recovery — Microchip PIC series
AVR firmware recovery — ATmega and ATtiny series
IC decapsulation service — Last-resort chip-level extraction
Firmware backup legacy equipment — Complete backup for end-of-life devices

Frequently Asked Questions

Can I recover firmware from a locked STM32?

It depends on the RDP level. RDP 0: yes, direct SWD (100%). RDP 1: yes via glitching (20–40%) or chip-off (40–70%). RDP 2: chip-off only (40–70%). Flash Encryption: encrypted blob only, cannot be decrypted without the key.

What is STM32 RDP and what do the levels mean?

RDP (Readout Protection) has three levels: Level 0 (no protection, full debug), Level 1 (debug blocked, mass erase possible), Level 2 (permanent lockout, chip-off required).

Does mass erase recover STM32 firmware?

No. Mass erase DESTROYS firmware. It erases the flash and downgrades RDP to Level 0, enabling reprogramming — but the original code is permanently gone.

Can voltage glitching bypass STM32 protection?

Yes, with 20–40% success rate (varies by series, revision, temperature). STM32H7 is much harder (5–15%).

Can I recover firmware from encrypted STM32?

You can extract encrypted contents via chip-off, but without the AES key (stored in unreadable OTP), decryption is not feasible.

Which STM32 series are easiest/hardest to recover?

Easiest: STM32F1, F0, L0. Medium: STM32F4, L4, F7. Hardest: STM32H7 (Secure Boot, SBRV, TrustZone).

How do I identify my STM32 chip?

Check the top marking: STM32 + series letter + pin count + package code + temperature grade. Take a photo and send it to us for identification.

What tools do you use for STM32 extraction?

ST-Link V3, J-Link, OpenOCD for SWD; ChipWhisperer and custom glitching setups; hot-plate rework, IR reflow, chemical decapsulation for chip-off; microprobe station.

Can STM32H7 be glitched like STM32F4?

STM32H7 is significantly harder due to Secure Boot, SBRV protection, and TrustZone. Success rate 5–15% vs 20–40% on F4. Chip-off is the more reliable path for H7.

What happens if RDP Level 2 is set?

JTAG/SWD is permanently disabled. The only recovery path is physical chip-off and IC decapsulation. RDP 2 cannot be undone.

Summary: Key Takeaways

RDP 0: Direct SWD extraction, 100% success
RDP 1: Glitching (20–40%) or chip-off (40–70%), mass erase DESTROYS firmware
RDP 2: Chip-off only, permanent lockout
Flash Encryption: Encrypted dump only, cannot be decrypted without key
Series difficulty: F1 (easiest) → F4 (medium) → H7 (hardest)
Bootloader: Respects RDP — useless if locked

Need STM32 Firmware Recovery?

Send us your STM32 part number for a free assessment. We’ll identify the series, explain the RDP level implications, and provide a fixed-price quote. Authorization documentation required before work begins.

[Get a Free Assessment →]

STM32 is the world’s most recovered microcontroller — but not all STM32 firmware is equally recoverable. This guide explains exactly what your chip’s RDP level means and what recovery path is available.