Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
At the IO USA 2025 security conference, researchers Mark Omo and James Rowley from Marcus Engineering unveiled a groundbreaking attack technique called STM32-TraceRip that achieves one hundred percent flash memory recovery on the STM32G0 microcontroller without relying on any traditional fault injection methods. Unlike previous attacks that required voltage glitching, UV light exposure, or exploitation of silicon bugs, TraceRip operates purely by observing the CPU state during normal execution. This novel approach represents a paradigm shift in microcontroller security research, as it demonstrates that even chips with robust glitch countermeasures can be compromised through side-channel observation of the processor's internal state. The STM32G0 series, introduced by STMicroelectronics as a next-generation low-cost Cortex-M0+ platform, was designed with improved security features specifically to address the vulnerabilities discovered in older families like the STM32F1. The fact that TraceRip can defeat these protections without any physical perturbation of the chip's operating conditions raises profound questions about the fundamental limits of microcontroller security. This case study explores the TraceRip attack in detail, examining its methodology, the CPU features it exploits, and its implications for the broader embedded security landscape.
The STM32G0 series is built on the ARM Cortex-M0+ processor core, which represents an evolution of the Cortex-M0 architecture with improved energy efficiency and several security enhancements. The chip features up to 512 KB of flash memory, up to 128 KB of SRAM, and a comprehensive set of peripherals designed for cost-sensitive IoT and industrial applications. In terms of security, the STM32G0 includes an upgraded Readout Protection mechanism with three levels similar to the STM32F1 family, but with important hardening measures. The option bytes that control RDP are stored in a dedicated secure area of flash with error correction coding, and the boot ROM includes additional checks to prevent the type of timing attacks that plagued earlier STM32 devices. The chip also incorporates a brownout reset circuit with tighter tolerances, making voltage glitching significantly more difficult, and the debug interface implements more aggressive lockout behavior when suspicious activity is detected. Despite these improvements, the STM32G0 retains the ARM CoreSight debug infrastructure, which includes the Serial Wire Debug (SWD) interface and, crucially for the TraceRip attack, the Instrumentation Trace Macrocell (ITM) and Data Watchpoint and Trace (DWT) units. These debugging features, while essential for software development, provide a window into the CPU's internal operation that can be exploited even when readout protection is active. The TraceRip researchers recognized that the fundamental assumption underlying RDP, namely that preventing direct memory reads is sufficient to protect firmware contents, is flawed when indirect observation of CPU behavior can leak the same information.
The TraceRip attack is built on a deceptively simple insight: when a CPU executes code from flash memory, the instructions it processes and the data it manipulates must necessarily be represented in the CPU's internal registers and pipeline state. Even if an external observer cannot directly read the flash memory, observing the CPU's behavior as it executes can reveal the contents of the instructions being processed. This is analogous to a side-channel attack, but instead of measuring power consumption or electromagnetic emanations, TraceRip leverages the chip's own debug infrastructure to observe the CPU state. The key enabler is the Data Watchpoint and Trace (DWT) unit, which is part of the ARM CoreSight debug architecture and is designed to provide real-time visibility into CPU operation for debugging purposes. The DWT unit can generate trace packets when specific events occur, such as instruction fetches, data memory accesses, or exception entries. While the STM32G0's RDP mechanism blocks direct memory reads through the debug interface, it does not completely disable the DWT unit's ability to report CPU events. The researchers discovered that by carefully configuring the DWT unit through the SWD interface, they could observe patterns in the CPU's instruction fetch behavior that indirectly revealed the contents of the flash memory. This approach is entirely non-invasive in the physical sense, requiring only a standard SWD connection and no modification to the chip's power supply or clock signals.
The TraceRip attack proceeds through several sophisticated stages that collectively transform observed CPU behavior into a complete flash dump. In the first stage, the attacker establishes an SWD connection to the target STM32G0 and configures the DWT unit to generate trace output for specific CPU events. Because RDP is active, the debug interface operates in a restricted mode that prevents direct memory access, but the DWT configuration registers remain writable. The attacker then resets the chip and allows it to boot normally, executing the protected firmware from flash. As the CPU fetches and executes instructions, the DWT unit generates trace packets that are captured through the SWD interface. These trace packets do not directly contain the instruction opcodes, but they reveal information about the program counter value, the type of instruction being executed, and the timing of instruction fetches. In the second stage, the researchers use a technique derived from the "Cold-Boot Stepping" approach originally developed by Obermaier and colleagues, which involves repeatedly resetting the CPU and observing its state as it begins execution from different starting points. By controlling the reset vector and observing the DWT trace output, the attacker can effectively step through the flash memory one instruction at a time, with each reset revealing a small amount of additional information about the instruction at the current program counter. The third stage involves sophisticated signal processing and machine learning techniques to decode the observed trace patterns into actual instruction opcodes. The researchers trained a classification model on known instruction sequences, teaching it to recognize the distinctive trace signatures produced by different ARM Thumb-2 instructions. Once the model is calibrated, it can classify the instructions being executed on the target chip with high accuracy, effectively reconstructing the entire firmware binary from observed CPU behavior.
The ARM Cortex-M0+ DWT unit provides several features that are collectively exploited by the TraceRip attack. The DWT includes four comparators that can be configured to trigger on program counter matches, data address matches, or data value matches. When a comparator triggers, the DWT can generate a trace packet that is emitted through the Instrumentation Trace Macrocell (ITM) or captured in the DWT's own registers. The STM32G0's RDP implementation, while blocking direct flash reads, does not prevent the DWT comparators from being configured or from generating trace events. The researchers discovered that by setting up a DWT comparator to trigger on every instruction fetch (by configuring it to match a range that covers the entire flash address space), they could receive a continuous stream of trace packets indicating the program counter at each instruction boundary. While the trace packets do not include the instruction opcode itself, the sequence of program counter values, combined with the known behavior of the Cortex-M0+ pipeline, provides enough information to infer instruction lengths and branch targets. More importantly, the DWT's cycle counter and the timing of trace packet generation reveal information about the type of instruction being executed, as different instruction classes take different numbers of clock cycles to complete. By combining program counter traces, cycle count information, and the known ARM Thumb-2 instruction set encoding, the TraceRip system can reconstruct the instruction stream with remarkable accuracy. The researchers also exploited the ITM's stimulus port mechanism, which allows software to write trace messages that are captured by the debug interface. By causing the CPU to execute specific instruction sequences and observing the resulting ITM output timing, they could further refine their instruction classification. The entire attack is performed without ever reading a single byte directly from flash memory, making it fundamentally different from all previously published STM32 attacks.
What sets TraceRip apart from every prior microcontroller firmware extraction attack is its complete independence from physical perturbation techniques. Voltage glitching, electromagnetic fault injection, laser fault injection, and UV light attacks all require specialized equipment to physically disturb the chip's operation, and they all carry a risk of damaging the target device. TraceRip, by contrast, uses only a standard SWD debug probe and operates entirely within the chip's normal operating parameters. This means the attack is non-destructive, repeatable, and can be performed with equipment that costs less than fifty dollars. Furthermore, because the attack does not rely on exploiting a specific silicon bug or a particular RDP level configuration, it is far more difficult to patch through firmware updates or silicon revisions. The vulnerability is inherent in the architecture of the ARM CoreSight debug system and the fundamental principle that CPU execution must necessarily represent the contents of memory in the processor's internal state. The researchers demonstrated that the attack works across multiple STM32G0 silicon revisions and against all three RDP levels, including the supposedly irreversible Level 2. While Level 2 disables the SWD interface entirely, the researchers showed that a variant of the attack can be performed using the chip's built-in bootloader interface, which remains accessible even when RDP Level 2 is active. This means that even the maximum protection setting offered by the chip is not sufficient to prevent firmware extraction through the TraceRip methodology.
The disclosure of the TraceRip attack sent shockwaves through the embedded security community, as it undermined many of the foundational assumptions about microcontroller readout protection. STMicroelectronics acknowledged the research and issued a security advisory noting that the attack requires physical access and a debug connection, and that customers requiring higher levels of security should consider the STM32H5 and STM32H7 series which include additional isolation between the debug subsystem and the application core. However, the broader implication is that any microcontroller with a CoreSight debug interface that remains accessible when readout protection is active may be vulnerable to similar state-tracing attacks. This includes not only STMicroelectronics products but also chips from NXP, Microchip, Texas Instruments, and other vendors that implement the ARM debug architecture. For industries that rely on firmware confidentiality as a primary security mechanism, including automotive, medical device, and industrial control manufacturers, the TraceRip attack represents a significant escalation in the threat level. The attack's low cost and non-destructive nature make it accessible to a much wider range of adversaries than traditional fault injection attacks, and its architecture-level nature means that point fixes are unlikely to be sufficient. The research has already spurred new work in the academic community on techniques for obscuring CPU execution traces, including instruction set randomization, dummy instruction insertion, and dynamic code obfuscation that makes it harder to correlate observed behavior with actual instruction contents.
Mitigating the TraceRip attack requires a fundamental rethinking of how microcontroller debug interfaces interact with readout protection mechanisms. The most straightforward mitigation is to completely disable all debug and trace functionality when RDP is active, including the DWT and ITM units, rather than merely blocking direct memory access. Several chip vendors have already begun implementing this approach in newer product lines, where activating maximum readout protection also permanently disables the entire CoreSight debug subsystem. For existing devices that cannot be redesigned, software-level mitigations can reduce the effectiveness of trace-based attacks. These include inserting dummy instructions and NOP sleds into critical code sections to disrupt the correlation between program counter traces and actual logic, implementing self-modifying code that changes instruction patterns at runtime, and using code obfuscation techniques that make the instruction stream harder to classify. At the system level, encrypting firmware before storing it in flash ensures that even if an attacker successfully reconstructs the instruction stream, the resulting code remains unintelligible without the decryption key. The key should be stored in a hardware security module or secure element that is separate from the main application core and cannot be accessed through the debug interface. Looking forward, the TraceRip research is likely to drive significant changes in how microcontroller vendors design their security architectures. Future chips may include dedicated "debug firewalls" that completely isolate the debug subsystem from the application core when protection is active, or they may implement dynamic instruction tracing that deliberately injects noise and false signals into the debug output to confuse state-observation attacks. The ongoing arms race between attackers and defenders in the embedded security space ensures that techniques like TraceRip will continue to evolve, and that no single protection mechanism can be relied upon as a complete solution.
The STM32-TraceRip attack represents a paradigm shift in microcontroller security research, and its implications extend far beyond the specific STM32G0 chip that was the initial target. The fundamental principle behind the attack, that observing CPU execution behavior can leak the contents of protected memory, is applicable to any microcontroller that retains debug or trace functionality when readout protection is active. Researchers have already begun exploring similar attacks on other ARM Cortex-M microcontrollers from NXP, Microchip, and Texas Instruments, and preliminary results suggest that many of these chips are also vulnerable to state-observation techniques. The attack methodology is also evolving rapidly, with researchers developing more sophisticated classification models that can decode instruction streams with higher accuracy and fewer traces. One promising direction is the use of deep learning models, specifically recurrent neural networks (RNNs) and transformers, that can process the temporal patterns in trace data and reconstruct instruction sequences with greater accuracy than traditional correlation-based methods. These models can be trained on known firmware from the same chip family and then fine-tuned on a small amount of trace data from the target device, significantly reducing the number of traces required for successful extraction. Another area of active research is the combination of CPU state tracing with side-channel power analysis, where the trace data from the debug interface is correlated with power consumption measurements to create a multi-modal observation that leaks more information than either technique alone. This hybrid approach has the potential to extract firmware from chips that have partially disabled debug interfaces or that implement basic trace obfuscation. The TraceRip attack has also spurred research into defensive techniques, including dynamic instruction set randomization, where the CPU's instruction encoding is changed at runtime to make it harder to classify observed execution patterns, and "trace noise injection," where the debug interface deliberately generates false trace packets that obscure the true execution pattern. While these defensive techniques are still in the research phase, they represent a proactive response to the emerging threat of CPU state observation attacks. For the semiconductor industry, the TraceRip attack has prompted a reevaluation of how debug interfaces are designed and secured, with many vendors now considering complete debug disablement as the default for production configurations rather than relying on partial restriction. The attack has also contributed to the growing adoption of dedicated security controllers and hardware security modules in microcontrollers, providing an isolated execution environment that is not accessible through the main CPU's debug interface. As the Internet of Things continues to expand and as microcontrollers become increasingly integrated into critical infrastructure, the importance of understanding and defending against CPU state observation attacks will only grow. The STM32G0 TraceRip case will likely be remembered as the catalyst that brought this class of attacks to the forefront of embedded security research, and the techniques developed for this attack will form the foundation for future research into both offensive and defensive aspects of microcontroller security.
The STM32-TraceRip attack achieves full flash recovery without any physical perturbation. It exploits the ARM CoreSight debug infrastructure to observe CPU execution. The DWT and ITM units leak information about instruction execution even when RDP is active. Machine learning classification decodes observed traces into instruction opcodes. The attack works against all three RDP levels including the irreversible Level 2. It requires only a standard SWD debug probe and no specialized equipment. The vulnerability is architectural and cannot be patched through firmware updates. Newer STM32 families may include debug firewalls to isolate the debug subsystem. Firmware encryption remains the most reliable mitigation. CPU state observation is a new class of attack distinct from glitching and side-channel analysis. The attack was presented at IO USA 2025 by Marcus Engineering researchers. It builds on earlier cold-boot stepping techniques. The non-destructive nature of the attack makes it particularly concerning. Chip vendors must re-evaluate how debug interfaces interact with readout protection. The TraceRip methodology may be applicable to other ARM Cortex-M chips. Instruction set randomization could mitigate future trace-based attacks. The research highlights the gap between logical and physical security. Embedded designers should assume debug interfaces are exploitable. This case marks a paradigm shift in microcontroller security research. The full implications of CPU state tracing are still being explored.
The STM32G0 TraceRip attack represents a landmark achievement in hardware security research, demonstrating that firmware extraction is possible without any physical perturbation of the target chip. By cleverly exploiting the ARM CoreSight debug infrastructure and applying machine learning to decode CPU execution traces, the researchers achieved one hundred percent flash recovery on a chip that was specifically designed to resist the glitch attacks that compromised its predecessors. The attack serves as a powerful reminder that security through obscurity and reliance on a single protection mechanism are fundamentally flawed strategies in embedded system design. As the embedded world continues to grapple with the implications of this research, the lessons learned from TraceRip will undoubtedly shape the next generation of secure microcontroller architectures and the defense strategies employed by security-conscious manufacturers.