AT32F437 is AT32F435 with one block added. Artery states it directly: the 437 gains a media access controller compatible with IEEE 802.3-2002, with its own DMA and 4 KB of dedicated SRAM, and everything else — the 288 MHz core, the megabyte of flash, the 384 KB of SRAM, the QSPI and XMC controllers, the three ADCs — carries over.
One Block Apart
That single addition changes the product category. An F435 design is an industrial controller with a fast core; an F437 design is a networked device. For a recovery the array work is identical, but the questions around it are not, because a networked device usually has a firmware update path and often has an external PHY whose configuration pins share the package.
RMII On Sixty-Four Pins
MII needs sixteen signals. RMII needs seven plus a clock. On a 64-pin LQFP there is no realistic way to bring out MII, so a 64-pin F437 design uses RMII and a PHY that supports it. The VGT7, with a hundred pins, can do either. This is a packaging decision that has nothing to do with the silicon and everything to do with what a technician can observe: an RMII bus is narrow enough that its traffic is easy to miss in a capture dominated by the rest of the system.
The MAC’s Own Four Kilobytes
The controller’s 4 KB buffer is separate from the 384 KB of system SRAM. Descriptors and packets live there at runtime, and none of it appears in a flash read. The consequence is practical: if the customer’s question is about network behaviour rather than code, a flash image will not answer it, and the work is a live capture, not a dump.
For a code recovery it is the opposite — the buffer is irrelevant, and the valuable part is the stack that builds and parses frames, which is ordinary firmware in the array.
Firmware That Talks
A networked design almost always includes a remote update path, and that path is where the image layout becomes interesting. Two patterns dominate: a bootloader that receives a new image over the network and writes it to the upper region, and a single application that rewrites itself through a jump table. In the first case the array contains two identifiable images; in the second the boundary is soft and the map has to be reconstructed from the linker’s own tables.
Neither pattern weakens the protection. It only changes how the dump is interpreted afterwards, and it is why we ask for the product’s update procedure before starting.
Protection Is The Family Standard
Whole-array access protection, per-sector erase and program protection, sLib with a password-protected execute-only range, 4 KB sectors, and the second 512 KB behind its own register pair. The F435 and F437 share this completely. Notably, neither offers the irreversible advanced access protection mode that the smaller families expose, so there is no state here in which the debug interface has been permanently destroyed.
A protected library on a megabyte part can be large. Middleware stacks of several hundred kilobytes are common, and the boundary is always on a 4 KB multiple, which makes it visible in a dump even before the registers are read.
Reading A Networked Part
The board is usually powered and connected during diagnosis, which adds two hazards: an external PHY that holds lines during reset, and a supervisor that may brown-out the part mid-read. We remove or isolate the PHY where the layout allows and confirm the supply before the first pass.
The sequence is unchanged: configuration byte, protection bytes, EPP map, library range, unique ID, bank one, register switch, bank two, then a checksum from the part against a staging copy. The MAC is not touched at any point.
Output
Two bank images plus a merged binary, the SRAM configuration byte, a sector and library map, and a short note identifying whether the design used a bootloader-plus-application layout. If the update path implies a second copy of the application somewhere in the array, the report points at it.
The 100-pin version, where MII becomes practical, is at restoring a protected AT32F437VGT7 microcontroller; the part without the MAC is at hacking secured AT32F435RGT7 firmware. The layering of protection mechanisms in general is described in reading an IC to bypass protection, and commercial terms are on the services page.