The VCT7 is the 100-pin member of the AT32F423 family: 14 by 14 millimetres, 87 usable I/O, and the same 256 KB array, 48 KB SRAM and 150 MHz core as the 64-pin part. Customers assume the larger package makes a recovery easier. It usually does, but not for the reason they expect.
Why Pins Matter To A Read
Every read ends with a decision about how much of the work happens electrically and how much happens optically. Pins are where the electrical side gets its information, and a part that exposes 87 of them offers more independent observation points than one that exposes 51. In practice that changes three things:
1. The debug port can be reached without disturbing a peripheral that the smaller package forces onto the same pins. 2. Boot mode can be selected externally, so the factory loader can be entered without cutting traces. 3. Bus activity can be captured while the application runs, which is how we confirm that a recovered region is the code actually executed rather than a stale copy.
None of that removes the protection. It removes uncertainty about what the protection is hiding.
The Same Array, More Witnesses
The flash is unchanged: 256 KB, 2 KB sectors, 128 protection decisions, sLib range expressed in sectors, the first four kilobytes permanently outside the library because the vector table is read as data. What the larger body adds is the ability to watch the part work while keeping it in a state where it can still be interrogated.
Reset, Boot And Pin States
A hundred pins mean a hundred states at reset. Several of them are sampled to choose the boot source, and on a populated board those pins are usually driven by something — a divider, a supervisor, a second device holding a line low. On the 64-pin part there may be no alternative pin for the function; on the 100-pin part there usually is, which is why we can sometimes keep a board alive and enter the loader through a route the designer never intended.
That is also the most common source of wasted time: a capture that looks like noise because one pin was held in the wrong state by a neighbouring circuit.
Where The Extra Pins Mislead
Eighty-seven I/O does not mean eighty-seven signals are relevant. On a real product most of them are static, some are analogue, and a few toggle in patterns that look like a bus but are a display refresh or a PWM carrier. We spend the first hour classifying pins rather than capturing them, because a capture that includes everything is a capture that answers nothing.
The 12-bit converter on this part reaches 24 channels at 5.33 Msps, and eight UARTs plus two CAN buses are typically all in use on a design that needed 100 pins. Expect the visible activity to be dominated by serial traffic.
Sector And Library Layout Unchanged
Because the array is the same, the protection report is the same shape: a readable lower region, a library beginning on a 2 KB boundary, and EPP bytes that may additionally lock sectors the library does not cover. Two independent locks on one array is common — a vendor locks the algorithm with sLib and the production area with erase protection — and they have to be reported separately because they fail differently.
Bench Setup For A 100-Pin Part
A 0.5 mm pitch LQFP is friendly to a SOIC clip only in the imagination. We use a socketed carrier and treat the board as a donor. The larger body also means more thermal mass during removal, so the pad temperature profile matters more than on a 48-pin part.
Once mounted, the sequence is the familiar one: protection bytes, unique ID, two array passes, checksum from the part, comparison. The difference is that on this package we can usually do the second pass with the application still running under a debugger-free setup, which catches a marginal read that a static sweep would report as clean.
What We Return
A binary at original addresses, a sector-level protection map, a list of pins that were active and what they appeared to be doing, and a statement of any region that could not be recovered. If the 20 KB system block had been converted to user memory, the extended image is included as well.
The 64-pin version is at recovering encrypted AT32F423RCT7 source code. If your design needed 100 pins for memory expansion rather than I/O, the megabyte part with an external controller is described in hacking secured AT32F435RGT7 firmware. Timelines are on the services page, and board-specific questions go through contact.