Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
The STM32F103 microcontroller, manufactured by STMicroelectronics, has long been one of the most widely deployed ARM Cortex-M3 chips in industrial control, consumer electronics, and embedded systems. Its popularity stems from an excellent balance of processing power, peripheral integration, and cost effectiveness. However, this ubiquity also makes it a prime target for firmware extraction and reverse engineering attacks. Security researchers and hardware hackers have repeatedly demonstrated that the chip's Readout Protection (RDP) mechanism, particularly at Level 1, can be reliably bypassed using voltage fault injection techniques. The most notable of these attacks is the PicoPwner exploit, which leverages a Raspberry Pi Pico as a low-cost glitch generator to defeat the protection and dump the entire flash memory. This case study examines the technical details of the STM32F103 RDP bypass, the attack methodology employed by researchers, and the broader implications for embedded system security.
The STM32F103 series is built around the ARM Cortex-M3 core running at up to 72 MHz, with flash memory capacities ranging from 16 KB to 512 KB depending on the specific variant. The chip integrates a rich set of peripherals including GPIO ports, USART interfaces, SPI, I2C, USB, CAN, and ADC converters, making it suitable for a vast array of applications. To protect proprietary firmware from being extracted via debug interfaces or bootloader tools, STMicroelectronics implemented a Readout Protection mechanism with three configurable levels. Level 0 represents the default unprotected state where all memory operations are permitted. Level 1 enables read protection while still allowing debug access under restricted conditions, and a mass erase is triggered if an attacker attempts to downgrade the protection. Level 2 is the maximum protection setting, which permanently disables debug access and cannot be downgraded through any software means. The RDP configuration is stored in the option bytes region of flash memory, which is itself protected from arbitrary modification. When RDP Level 1 is active, the chip blocks reads from flash memory through the debug interface and the serial bootloader, but it still allows the CPU to execute code normally from flash. This distinction between execution permission and read permission is precisely what creates the vulnerability window that glitch attackers exploit.
Voltage glitching, also known as voltage fault injection, is a physical attack technique that involves momentarily disrupting the power supply to a microcontroller during a critical operation. By introducing a carefully timed voltage drop or spike, an attacker can cause the CPU to skip instructions, corrupt register values, or alter the outcome of conditional branch operations. In the context of the STM32F103 RDP bypass, the goal is to glitch the chip during the boot sequence when it reads and evaluates the RDP level from the option bytes. If the glitch is precisely timed, the chip may incorrectly determine that RDP is at Level 0 even though the option bytes indicate Level 1, thereby allowing full flash read access through the debug interface. The attack requires physical access to the target device and the ability to control the power supply pin, typically by decoupling the chip's VDD pin from the main power rail and inserting a glitch generation circuit in series. The Raspberry Pi Pico, with its programmable I/O (PIO) state machines, has proven to be an exceptionally capable and affordable platform for generating the precise nanosecond-scale pulses required for successful glitching. The PicoPwner project, developed by security researcher CTXz, packages this entire attack methodology into an open-source tool that costs less than ten dollars to assemble.
The PicoPwner attack proceeds in several carefully orchestrated stages. First, the attacker connects the Raspberry Pi Pico to the target STM32F103 board, wiring the Pico's GPIO pins to the target's SWD (Serial Wire Debug) interface and power control circuitry. The Pico is programmed with custom firmware that can both generate glitch pulses and communicate with the STM32 over SWD. In the initial phase, the attack attempts to exploit a condition where the RDP lock is caused by the debug probe being connected during power-up. By carefully disconnecting and reconnecting the debug interface at specific moments during the boot sequence, the attacker can cause the chip to enter a state where the RDP lock from one condition is cleared while another condition remains active. Once the first RDP lock condition is eliminated, the attack moves to Stage 1, where exploit firmware is loaded into the chip's SRAM and executed. This stage faces the second RDP lock condition, which is triggered by the bootloader's protection checks. The glitch is applied at this precise moment, causing the CPU to skip the instruction that would normally enforce the read protection. With the protection effectively bypassed, the attacker can then read the entire contents of the flash memory through the SWD interface, word by word, until the complete firmware binary is extracted. The entire process typically takes several minutes to complete, with the glitch parameters being automatically swept across a range of values to find the optimal timing and duration for a successful attack. The success rate of the glitch depends on factors such as the chip's silicon revision, operating temperature, and the quality of the power supply decoupling on the target board.
The fundamental weakness in the STM32F103 RDP Level 1 implementation lies in the timing gap between when the option bytes are read and when the protection is actually enforced. During the boot sequence, the chip's boot ROM reads the RDP level from the option bytes and configures the memory protection accordingly. However, this read-and-configure operation is not atomic, meaning there exists a brief window where the RDP value has been loaded into a register but the protection circuitry has not yet been fully activated. A precisely timed voltage glitch during this window can corrupt the register value that holds the RDP level, causing it to be interpreted as Level 0 (unprotected) even though the actual option bytes still indicate Level 1. Furthermore, the STM32F103's debug interface does not continuously re-evaluate the RDP level after boot; instead, it checks the protection state only at specific moments, such as when a debug connection is first established. This means that if the glitch succeeds during boot, the debug interface remains unlocked for the entire power-on session. Researchers have also discovered that the attack can be made more reliable by using a technique called "cold boot stepping," where the chip is repeatedly reset and each reset allows one additional word of flash to be read before the protection re-engages. This incremental approach, while slower, significantly increases the success probability and works even when a single full-dump glitch is not achievable. The STM32F103's Cortex-M3 core also lacks the more sophisticated glitch detection and countermeasures that were introduced in later STM32 families, such as the STM32L4 and STM32H7 series, which include voltage monitoring circuits and redundant protection checks.
The ability to extract firmware from STM32F103-based devices has significant real-world consequences across multiple industries. In the industrial control sector, firmware extraction can reveal proprietary control algorithms, safety interlock logic, and network credentials that attackers can use to develop counterfeit products or launch targeted attacks on critical infrastructure. In consumer electronics, extracted firmware often contains hardcoded encryption keys, API tokens, and authentication secrets that can be used to compromise user privacy or enable device cloning. The gaming and entertainment industry has also been affected, with STM32F103 chips commonly found in arcade machines, slot machines, and entertainment systems where firmware protection is essential for preventing cheating and piracy. Several commercial services now offer STM32F103 firmware extraction as a paid service, advertising the ability to read protected flash memory without damaging the original chip. These services, often marketed as "chip decryption" or "firmware recovery" tools, cater to legitimate use cases such as recovering lost source code from legacy devices, but they are equally accessible to malicious actors. The low cost of the PicoPwner setup, which can be assembled for under ten dollars using readily available components, has democratized this attack capability to the point where even amateur hardware enthusiasts can perform successful extractions. This democratization represents a fundamental shift in the threat model for embedded systems, as firmware protection that was once considered adequate against skilled adversaries is now vulnerable to anyone with basic soldering skills and a Raspberry Pi Pico.
While the STM32F103 RDP Level 1 vulnerability cannot be fully patched through software updates due to its physical nature, several mitigation strategies can significantly reduce the risk of successful firmware extraction. The most immediate step is to upgrade from RDP Level 1 to RDP Level 2, which permanently disables the debug interface and cannot be bypassed through the same glitch techniques. However, RDP Level 2 is irreversible and prevents future firmware updates through the debug interface, so it must be carefully evaluated against maintenance requirements. For devices that must remain field-upgradable, designers should consider moving to newer STM32 families that include enhanced security features such as the Secure Boot and Firmware Upgrade (SBFU) mechanism, hardware unique keys, and active tamper detection. At the system level, implementing firmware encryption ensures that even if an attacker successfully dumps the flash, the extracted binary remains unreadable without the decryption key. The encryption key should be stored in a separate secure element or in the chip's one-time programmable (OTP) memory region, rather than alongside the encrypted firmware. Physical tamper resistance measures, such as applying epoxy potting to the PCB, using security meshes that detect probing attempts, and placing the chip on an inner PCB layer, can also raise the bar for physical attacks. Additionally, designers should avoid storing sensitive information such as passwords, encryption keys, and API tokens in plaintext within the firmware, and should implement runtime integrity checks that verify the firmware has not been modified. Finally, regular security audits and penetration testing of embedded devices, including physical attack surface assessment, should be incorporated into the product development lifecycle to identify and address vulnerabilities before deployment.
The STM32F103 RDP bypass has been replicated and refined by numerous researchers and hobbyists since its initial disclosure, leading to a rich ecosystem of tools and techniques. The PicoPwner project, in particular, has been ported to various low-cost microcontroller platforms, and open-source firmware for glitch generation is widely available on GitHub and other code repositories. The attack has also been adapted to work with the STM32F103's larger variants, including the 100-pin and 144-pin packages, which are commonly found in industrial control equipment and high-end consumer products. Researchers have demonstrated that the success rate of the glitch attack can be significantly improved by using a technique called "glitch parameter shaping," where the voltage drop is not a simple square wave but a carefully crafted waveform that matches the impedance characteristics of the target chip's power supply network. This technique, which requires a high-speed arbitrary waveform generator, can achieve success rates exceeding ninety percent on some STM32F103 variants. The attack has also been combined with other techniques, such as clock glitching and temperature manipulation, to create hybrid attacks that are effective against chips with partial voltage glitch countermeasures. In the field of hardware security training, the STM32F103 RDP bypass has become a standard lab exercise, taught in university courses and professional training workshops to introduce students to the concepts of fault injection and physical security. The relative simplicity and low cost of the attack make it an ideal teaching tool, allowing students to gain hands-on experience with physical attacks without requiring expensive equipment. The STM32F103's continued popularity in educational and prototyping environments means that a new generation of engineers and security researchers is being introduced to the chip and its vulnerabilities, ensuring that the attack techniques remain well-documented and accessible. For forensic investigators, the STM32F103 RDP bypass provides a reliable method for extracting firmware from devices that may contain evidence of criminal activity, such as counterfeit electronics, modified gaming devices, or unauthorized industrial control modifications. The non-destructive nature of the attack is particularly valuable in forensic contexts, as it allows the original device to be preserved as evidence while still enabling firmware extraction. In the academic research community, the STM32F103 has served as a testbed for developing new fault injection techniques, including machine learning-based glitch parameter optimization, automated attack frameworks, and novel side-channel analysis methods that combine power measurement with fault injection. The chip's well-documented architecture and the availability of detailed reference manuals make it an ideal platform for this type of research, and many published papers use the STM32F103 as a case study for evaluating new attack and defense techniques. The ongoing research into STM32F103 security ensures that the attack surface continues to be explored, and new vulnerabilities and attack techniques are regularly disclosed, keeping the chip relevant in the hardware security community despite its age.
The STM32F103 remains one of the most widely deployed Cortex-M3 microcontrollers in industrial and consumer products. Its RDP Level 1 protection is vulnerable to voltage glitching attacks that can be performed with equipment costing under ten dollars. The PicoPwner project has democratized this attack by providing open-source firmware for the Raspberry Pi Pico. A successful glitch during the boot sequence can cause the chip to misidentify its RDP level, allowing full flash access. The attack is non-destructive and does not damage the target chip. RDP Level 2 provides stronger protection but is irreversible and prevents field updates. Newer STM32 families include enhanced security features that address these vulnerabilities. Firmware encryption should always be used in addition to readout protection. Physical tamper resistance measures can raise the bar for attackers. Security audits should include physical attack surface assessment. The STM32F103 case demonstrates that cost and security are often in tension. Manufacturers must balance maintainability against protection requirements. The attack has been replicated on multiple STM32F103 silicon revisions. Commercial chip decryption services routinely offer STM32F103 extraction. The lessons from this case apply broadly to ARM Cortex-M microcontrollers. Defense-in-depth is essential for protecting embedded firmware. No single protection mechanism provides absolute security. Physical access fundamentally changes the threat model. Continuous security evaluation is necessary throughout the product lifecycle. The STM32F103 will remain a relevant case study for years to come.
The STM32F103 readout protection bypass serves as a compelling case study in the ongoing cat-and-mouse game between chip designers and hardware security researchers. The PicoPwner attack demonstrates that even widely deployed and ostensibly secure microcontrollers can be compromised with minimal equipment and technical expertise when physical access is available. The vulnerability highlights the importance of defense-in-depth strategies that go beyond relying solely on a chip's built-in readout protection mechanism. As the Internet of Things continues to expand and embedded devices become increasingly integrated into critical infrastructure, the security of these systems will only grow in importance. Manufacturers and developers must remain vigilant, continuously updating their security practices and migrating to newer, more secure chip families as vulnerabilities in older devices are disclosed. The STM32F103, despite its age and known vulnerabilities, remains a testament to the enduring challenge of securing embedded systems against determined physical attackers, and its story offers valuable lessons for anyone involved in the design and deployment of secure embedded devices.