The AT32F421C8T7 is a 48-pin value-line part: 64 KB of flash, 16 KB of SRAM, a 120 MHz Cortex-M4 with DSP instructions but no floating-point unit, and fifteen ADC channels brought out on the larger body. It is the sort of chip that ends up in a motor drive or a small appliance, protected by sLib, and sent to us two years later when the supplier has gone quiet.
The Value Line, Honestly Described
Artery sells the F421 as a Cortex-M4, and it is one, but the FPU is absent. That single omission shapes both the firmware and the read. Code compiled for this part calls the soft-float library instead of using VFP instructions, so the disassembly is full of helper routines with names like __aeabi_fadd and __aeabi_fmul. If a customer sends a board and is unsure whether it carries an F421 or an F423, the presence of those calls in the recovered image is the fastest answer.
Sixty-Four Sectors Of One Kilobyte
AT32F4 parts below 256 KB use 1 KB sectors. On a 64 KB device that means sixty-four erase units, and every protection decision — sLib range, erase/program protection bytes — moves in 1 KB steps. It is fine granularity, and it makes the protection map easy to describe precisely: we can tell a customer exactly which sectors were locked and which were left writable, sector by sector, without guessing at a larger granularity that does not exist here.
Why Sector Zero Always Reads
sLib may not include the first sector, because the vector table is fetched as data and an execute-only region that contains data would break the part at reset. Protected code is also barred from the first four kilobytes. Those two rules together create a floor: whatever the configuration, the opening four kilobytes stay readable.
For a read this is the anchor. The initial stack pointer and reset vector confirm the image base, the startup code confirms the compiler and the library version, and the interrupt table shows which peripherals the firmware actually uses. We use that block to validate everything read afterwards.
What The Library Looks Like From Outside
Inside an sLib instruction region, instruction fetches succeed and data reads return 0xFF. A tool that only performs block reads therefore reports erased flash, which is the single most common misdiagnosis on this family. The distinguishing test is simple: an erased sector and a protected sector both read 0xFF, but only one of them executes.
The library cannot be removed by erasing. Clearing it requires the password, and the clear operation erases the whole main array, including the part the customer wanted. That is by design: even a leaked password does not yield a copy of the code.
Two Protection Bytes, Two Outcomes
Beyond sLib, the F421 offers access protection over the entire array — debug and in-system programming are blocked, and removing it wipes the chip — and an advanced mode that additionally disables the debug interface permanently. The second is offered through the vendor’s ICP tool and is irreversible. If a board arrives with the debug port dead and no response to the bootloader, that byte is the first thing we check, before suspecting the part itself.
Reading A Small Part Quickly
Because the array is only sixty-four kilobytes, the whole read takes minutes rather than hours, and we run it twice with an independent supply setting to catch marginal cells. The 16 KB SRAM is small enough to hold a full staging copy, which lets the part run its own checksum over the array; matching that checksum against our dump is the cheapest end-to-end confirmation available.
The 4 KB boot block is usually still a loader on these parts. When it has been converted to user memory, the usable total is 64 plus 4 KB and the vendor’s loader is gone, which changes how a board can be reflashed after the read.
What Comes Back
A binary with the original addresses, a sector-level report, and a note on whether the boot block held a loader or user code. We also list the peripheral set the image configures, since on a 48-pin board that is often the only way to confirm the recovered code matches the product variant.
For the smaller QFN in the same family see extracting protected AT32F421K8U7 program. The layer-by-layer explanation of what protection does and does not stop is in reading an IC to bypass protection; our services page covers turnaround and pricing bands.