Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
In February 2025, security researchers at PT Security's SWARM division published a comprehensive analysis of readout protection vulnerabilities in GigaDevice GD32 microcontrollers, dubbing the findings "GigaVulnerability." The research focused on the GD32F103 series, a popular drop-in replacement for the STM32F103 that is pin-compatible and software-compatible with STMicroelectronics' chip but is typically sold at a lower price point. The researchers demonstrated that the GD32F103's readout protection (RDP) mechanism can be completely bypassed regardless of the configured protection level, using techniques that are even simpler than those required for the original STM32F103. The GigaVulnerability research is particularly significant because it examines not just one chip but an entire ecosystem of drop-in replacement and counterfeit microcontrollers, demonstrating that the security posture of these chips is often significantly weaker than the originals they replace. This case study examines the GD32F103 RDP bypass, the unique vulnerabilities of drop-in replacement chips, and the supply chain security implications of using unverified microcontrollers in production products.
The GigaDevice GD32F103 is a 32-bit microcontroller based on the ARM Cortex-M3 core, designed to be a pin-compatible and software-compatible replacement for the STMicroelectronics STM32F103. The GD32F103 offers similar performance and peripheral sets to the STM32F103, with some models offering higher clock speeds and larger memory capacities, all at a significantly lower cost. This combination of compatibility and affordability has made the GD32F103 extremely popular in cost-sensitive markets, particularly in China and other Asian markets where price is a primary consideration. The chip is used in a wide range of products including consumer electronics, industrial controllers, IoT devices, and automotive accessories. The GD32F103 implements a readout protection mechanism that is conceptually similar to the STM32's RDP, with multiple protection levels that restrict debug access and flash reading. However, because GigaDevice designed the chip to be compatible with the STM32 ecosystem, the RDP implementation is not identical to ST's, and the researchers found that it contains significant vulnerabilities. The GD32F103 is part of a broader ecosystem of drop-in replacement microcontrollers that includes chips from manufacturers such as APM (APM32F103), CKS (CKS32F103), and several others, all of which aim to capture market share from ST by offering compatible chips at lower prices. The GigaVulnerability research demonstrated that many of these replacement chips share similar or identical vulnerabilities, raising concerns about the security of products that use them.
The PT SWARM researchers identified multiple techniques for bypassing the GD32F103's readout protection, ranging from simple debug interface manipulation to voltage glitching. The simplest technique involves exploiting a flaw in the GD32F103's debug interface that allows an attacker to read flash memory even when RDP Level 1 is active, without requiring any fault injection. The researchers discovered that the GD32F103's debug interface does not properly enforce RDP restrictions for certain memory access patterns, allowing reads to succeed where they should be blocked. This is a logical vulnerability in the chip's access control logic, rather than a physical attack, and it can be exploited using nothing more than a standard SWD debug probe. For RDP Level 2, which is supposed to be the maximum and irreversible protection level, the researchers found that a voltage glitch attack could downgrade the protection from Level 2 to Level 1, after which the simpler Level 1 bypass could be used to extract the firmware. The voltage glitch is applied during the boot sequence when the RDP level is being read from the option bytes, causing the chip to incorrectly identify the RDP level as 1 instead of 2. The researchers also discovered that the GD32F103's option bytes are more susceptible to corruption than those of the STM32F103, and that a technique called "cold boot stepping" can be used to incrementally read flash memory by repeatedly resetting the chip and reading one word at a time before the protection re-engages. Each of these techniques is simpler and more reliable than the corresponding attacks on the STM32F103, suggesting that GigaDevice did not fully replicate ST's security hardening measures when designing the compatible chip.
The GigaVulnerability research builds on earlier work published in the paper "One Exploit to Rule them All? On the Security of Drop-in Replacement and Counterfeit Microcontrollers," which examined the security of multiple STM32-compatible chips including the APM32F103, CKS32F103, and GD32F103. That research demonstrated that a single attack technique, originally developed for the STM32F1, could be adapted to extract firmware from all three replacement chip families, with extraction performance comparable to or better than the original STM32. The researchers found that the increasing coverage of the extraction (the percentage of flash memory that can be successfully read) results from the fact that more interrupt vectors allow extracting inaccessible table entries by exploiting the wrap-around behavior of the memory controller. The GD32F103 was found to be particularly vulnerable, with up to 93 percent of flash memory extractable using the basic attack technique, and 100 percent extractable when combined with additional techniques. The "One Exploit to Rule them All" research highlighted a systemic problem in the microcontroller ecosystem: drop-in replacement chips, which are designed to be compatible with established chips, often replicate the functional behavior but not the security hardening of the originals, creating a situation where products that are believed to be secure (because they use a "STM32-compatible" chip) are actually significantly more vulnerable. The GigaVulnerability research extended this analysis by providing a more detailed examination of the GD32F103 specifically and by demonstrating additional attack vectors that had not been previously documented.
The vulnerabilities in the GD32F103 and other drop-in replacement chips can be attributed to several factors related to the design and manufacturing of compatible microcontrollers. First, because the goal of a drop-in replacement is to achieve functional compatibility at the lowest possible cost, security features are often deprioritized or implemented in a minimal way that meets the letter of the compatibility specification but not the spirit of the security intent. The GD32F103's RDP mechanism, for example, provides the same programming interface and option byte layout as the STM32F103, but the underlying hardware enforcement of the protection is weaker, allowing access patterns that the STM32 would block. Second, drop-in replacement chips are often manufactured on older or cheaper process technologies that may be more susceptible to physical attacks such as voltage glitching and UV exposure. Third, the security testing and validation of replacement chips is typically less rigorous than that of the original chips, as the manufacturers focus on functional compatibility rather than security robustness. Fourth, the supply chain for replacement chips is often more opaque, with counterfeit and remarked chips entering the market alongside genuine products, making it difficult for buyers to verify the authenticity and security of the chips they purchase. The combination of these factors creates a situation where a product designer who chooses a drop-in replacement chip to reduce costs may inadvertently introduce significant security vulnerabilities that were not present in the original chip design. This is particularly concerning because the designer may assume that the replacement chip offers the same level of security as the original, given its compatibility claims.
The GigaVulnerability research has significant implications for supply chain security in the electronics industry. Many product designers and manufacturers are unaware that the microcontrollers in their products may be drop-in replacements rather than the original chips they specified, particularly when products are manufactured by third-party contract manufacturers who may substitute components to reduce costs or address supply shortages. This practice, known as "component substitution" or "second sourcing," is common in the electronics industry, but it can have serious security consequences when the substituted component has weaker security features than the original. The GD32F103 case demonstrates that a chip that is functionally identical to an STM32F103 may have dramatically different security properties, and that a product designed with the STM32's security in mind may be significantly more vulnerable if a GD32F103 is substituted without the designer's knowledge. The rise of counterfeit and remarked microcontrollers further complicates this issue, as it can be difficult to distinguish a genuine STM32F103 from a counterfeit or remarked GD32F103 based on external markings alone. For industries with strict security requirements, such as automotive, medical, and industrial control, the use of unverified replacement chips can lead to compliance failures and security breaches. The GigaVulnerability research highlights the need for supply chain verification and component authentication in secure products, and for designers to specify not just the functional requirements of microcontrollers but also their security requirements, and to verify that any substituted components meet those requirements.
The disclosure of the GigaVulnerability prompted responses from both GigaDevice and the broader microcontroller industry. GigaDevice issued a statement acknowledging the research and noting that the GD32F103 is an older product that has been superseded by newer GD32 families with improved security features. The company recommended that customers requiring strong firmware protection use the GD32A503, GD32H7, or other newer families that include enhanced security features such as hardware unique keys, secure boot, and improved readout protection. For the broader industry, the GigaVulnerability research has contributed to a growing awareness of the security risks associated with drop-in replacement and counterfeit microcontrollers. Several industry initiatives have been launched to address this issue, including the development of component authentication standards and the creation of databases that track the security properties of different microcontroller models. Security researchers have also begun to systematically evaluate the security of replacement chips, publishing their findings to help designers make informed decisions. The GigaVulnerability case has also prompted some product manufacturers to implement supply chain verification measures, including component authentication using chip-unique identifiers and cryptographic attestation, to ensure that the chips in their products are genuine and meet the required security specifications. While these measures do not eliminate the risk of component substitution, they can significantly reduce it and provide a basis for detecting and responding to substitutions when they occur.
Several strategies can mitigate the risks associated with GD32F103 and other drop-in replacement chip vulnerabilities. At the component selection level, designers should specify microcontrollers based on their security properties, not just their functional compatibility, and should avoid using replacement chips in security-sensitive applications unless their security has been independently verified. For products that must use the GD32F103 or similar chips, designers should implement defense-in-depth strategies that do not rely solely on the chip's readout protection. These include encrypting sensitive firmware and data with application-level encryption, storing encryption keys in a separate secure element or hardware security module, and implementing runtime integrity checks that verify the firmware has not been modified. At the supply chain level, manufacturers should implement component verification procedures to ensure that the chips in their products are genuine and meet the specified security requirements. This can include visual inspection, electrical testing, and cryptographic authentication using chip-unique keys. At the product level, physical tamper resistance measures such as epoxy potting, security mesh, and tamper switches can make physical attacks more difficult and can provide detection of tampering attempts. Finally, designers should stay informed about the latest security research and vulnerabilities affecting the chips they use, and should have a process for evaluating and responding to new vulnerabilities as they are disclosed. The GigaVulnerability case demonstrates that security is not a one-time design consideration but an ongoing process that requires vigilance throughout the product lifecycle.
The GigaVulnerability research on the GD32F103 has brought increased attention to the broader issue of supply chain security in the semiconductor industry, particularly the risks associated with drop-in replacement and counterfeit microcontrollers. The global semiconductor shortage of 2020-2022 led many manufacturers to seek alternative chip sources, and the use of drop-in replacement chips from lesser-known vendors became increasingly common as a way to maintain production. While these replacement chips can provide functional equivalence and cost savings, the GigaVulnerability research demonstrates that they may not provide the same level of security as the original chips, creating a hidden risk for products that require firmware confidentiality. The clone chip ecosystem is complex and multifaceted, ranging from legitimate second-source manufacturers who produce pin-compatible chips with full documentation and support, to gray-market vendors who sell remarked or counterfeit chips that may be of uncertain origin and quality. The GigaVulnerability research focused on legitimate drop-in replacement chips from GigaDevice, but the findings are also relevant to the counterfeit chip market, where chips may be re-marked to appear as a different model or manufacturer, potentially introducing additional security vulnerabilities. The research has prompted calls for greater transparency and standardization in the microcontroller market, including requirements for chip vendors to disclose security vulnerabilities and to provide security documentation that allows customers to evaluate the security properties of their chips. Several industry initiatives have been launched to address these issues, including the creation of databases that track the security properties of different microcontroller models and the development of testing methodologies for evaluating the security of replacement chips. The GigaVulnerability case has also highlighted the importance of component authentication in secure products, as manufacturers need to be able to verify that the chips in their products are genuine and meet the required security specifications. Techniques such as cryptographic attestation, where a chip proves its identity using a device-unique key, and physical unclonable functions (PUFs), which generate a unique identifier from the chip's physical characteristics, can provide a basis for component authentication. For the open-source hardware and maker communities, the GigaVulnerability research has raised awareness about the security implications of using clone or replacement chips, and has encouraged the development of best practices for evaluating the security of alternative chip options. The case also has implications for government and military procurement, where the use of counterfeit or compromised chips in critical systems could have national security implications. The growing recognition of supply chain security as a critical concern has led to increased investment in semiconductor manufacturing in key markets and to the development of regulations that require greater transparency and traceability in the semiconductor supply chain. The GigaVulnerability research, by providing concrete examples of the security differences between original and replacement chips, has contributed to this growing awareness and has provided a foundation for future research into the security of the broader microcontroller ecosystem. As the semiconductor industry continues to evolve and as new players enter the market, the lessons learned from the GD32F103 GigaVulnerability will be essential for ensuring that security is not sacrificed in the pursuit of cost savings or supply chain resilience.
The GD32F103 is a pin-compatible drop-in replacement for the STM32F103. Its RDP implementation is weaker than the original STM32F103. PT SWARM published the GigaVulnerability research in February 2025. RDP Level 1 can be bypassed without any fault injection. RDP Level 2 can be downgraded using voltage glitching. The attack works on APM32F103 and CKS32F103 as well. Drop-in replacement chips often replicate function but not security. Component substitution can introduce hidden security vulnerabilities. Supply chain security is critical for embedded products. Counterfeit and remarked chips compound the problem. Newer GD32 families include improved security features. Designers should verify security of any replacement chip. Component authentication can detect substitutions. The semiconductor shortage increased use of alternative chips. This case highlights the need for security transparency. Functional equivalence does not imply security equivalence. Physical attacks on clone chips are often simpler. The research used cold boot stepping for incremental reads. Defense-in-depth is essential when using alternative chips. This case has significant supply chain security implications.
The GigaDevice GD32F103 GigaVulnerability represents a significant contribution to our understanding of microcontroller security in the era of drop-in replacement and counterfeit chips. The research demonstrates that chips designed to be functionally compatible with established microcontrollers may have dramatically weaker security implementations, and that this difference can have serious consequences for product security. The GD32F103's RDP bypass, which is simpler and more reliable than the corresponding attack on the STM32F103, highlights the importance of evaluating the security of each component individually rather than assuming compatibility implies equivalent security. For the electronics industry, the GigaVulnerability case underscores the critical importance of supply chain security, component verification, and defense-in-depth design strategies. As the market for drop-in replacement microcontrollers continues to grow, driven by cost pressures and supply chain disruptions, the lessons learned from this research will become increasingly relevant. The ongoing collaboration between security researchers, chip vendors, and product manufacturers to identify and address these vulnerabilities is essential for building a more secure electronics ecosystem, and the GigaVulnerability research stands as an important milestone in that ongoing effort.