The slowest H7 in this batch has the most SRAM. The STM32H7B0ABI6Q runs its Cortex-M7 at 280 MHz, carries about 1.4 MB of on-chip RAM and only 128 KB of flash, and it is the part where the internal array is deliberately tiny. To extract encrypted STM32H7B0ABI6Q memory you need to understand both halves of that design: a small, finely divided boot array inside the chip and an encrypted application image outside it.
01 / Eight-kilobyte sectors
Most H7 flash is organised in 128 KB sectors. ST cut the H7B0 array into 8 KB sectors instead, specifically to make over-the-air updates and a dedicated boot sector practical. For a readout this changes the arithmetic. Write protection is applied per sector, so the protection bitmap has sixteen entries rather than one or two, and a partial erase can target a single 8 KB block without disturbing the rest. A script written for 128 KB granularity will misreport the protected range and may skip the one block that holds the bootloader.
| Parameter | H7B0 | H743/H745 |
|---|---|---|
| Internal flash | 128 KB | 1 MB to 2 MB |
| Sector size | 8 KB | 128 KB |
| OTP | 1 KB | present |
| User SRAM | 1.18 MB | 864 KB |
02 / Two decryption engines
This order code has two OTFDEC instances, one per Octo-SPI interface, each applying AES-128 in counter mode to memory-mapped reads. It also carries a crypto/hash accelerator covering AES in ECB, CBC, CTR, GCM and CCM modes, MD5, SHA-1, SHA-2 and HMAC, plus a true random generator and secure firmware install, secure boot and SBSFU. AN5281 documents the encryption flow: the image is encrypted before it is placed in external memory, and the key never leaves the MCU. Desoldering the serial flash produces ciphertext.
03 / SECURITY, HDP and DMES
Beyond RDP there is a SECURITY option bit. AN5601 describes the hidden delivery protection area for this family: with SECURITY enabled the device boots into a secure area first, and the DMES setting decides whether that area is erased when execution leaves it. CubeProgrammer requires RDP at 0xAA and SECURITY unchecked before a full chip erase is permitted. That combination is easy to misread as a broken debugger, so record both bits before touching anything. RDP remains 0xAA for level 0, 0xCC for level 2 and any other value for level 1, written through FLASH_OPTSR_PRG with a reload plus reset. Level 2 is irreversible.
04 / Power and retention
The -Q variant uses the internal SMPS, and ST quotes about 32 microamps in Stop mode with the full 1.4 MB of RAM retained. That retention has a practical consequence for a readout: configuration state, keys and runtime buffers can survive what looks like a power cycle. A board that appears freshly booted may still be holding data from a previous session in SRAM. Treat VCAP and VBAT as live rails during any attach, and do not assume a reset has cleared the memory you are about to inspect. The NVRAM content notes cover the same class of problem in battery-backed parts.
04b / The 1.4 MB is not one pool
ST describes the H7B0 RAM as scattered: 192 KB of TCM split into 64 KB of ITCM and 128 KB of DTCM, 1.18 MB of user SRAM, and 4 KB in the backup domain. One megabyte of the user space is contiguous, which is what allows a full graphical frame buffer to sit on-chip instead of in external memory. For a readout the distinction matters because these pools have different bus masters and different visibility to a debugger attached through one access port. A dump of one region is not evidence that another region was empty.
04c / Graphics hardware is not program storage
LCD-TFT control, Chrom-ART, Chrom-GRC and a JPEG codec make this part look as though it must be holding a large image bank internally. When a customer says the product contains graphical assets, confirm whether those bytes are in the encrypted external image, in on-chip RAM at run time, or in a separate storage device before adding them to the deliverable list.
05 / Scoping the delivery
Ask for the serial flash part number, the OTFDEC region configuration and the SECURITY bit state. Deliver the 128 KB internal image, the 1 KB OTP, the option bytes and the raw external dump labelled as encrypted. The ARM7 STM32F107 case shows a board where external memory dominated the job, and the STM32F358RC protection notes cover another ST part with a non-obvious protection layer.
For the LQFP144 member of the same line, see STM32H7B0ZBT6 source code recovery. Where the 169-ball body leaves no test points, the device-level readout service handles package and die work.