Put the same question to the 48-pin member of the F425 line and the answer is arithmetic rather than physics. A 64 KB array with a 1 KB sector size has sixty-four protection decisions, and two of them are not available to the vendor: sector zero, which holds the vector table, and the rest of the first four kilobytes, which cannot be inside a library at all.
Forty-Eight Pins, Thirty-Nine Signals
The C-package brings out 39 GPIO against 55 on the 64-pin part, and ten of the sixteen ADC channels. The USB pair, the CAN pair, four USARTs and three SPI blocks are all still there, remapped onto fewer pads. For a read this is the ordinary trade: fewer observation points, same silicon. Where the 64-pin board can be entered through a loader on a spare UART, the 48-pin board sometimes cannot, and the part comes off.
One thing that does not shrink is the USB device controller. It has 1280 bytes of buffer and runs without an external crystal in device mode, which is why this part shows up in dongles and small peripherals where there is no room for a resonator.
The Four Kilobyte Floor
Artery’s rules are explicit about two exclusions: the library may not include the first sector, and protected code must not sit in the first four kilobytes. The reasoning is mechanical, not arbitrary — the vector table is fetched as data, and a region that answers instruction fetches but returns 0xFF to data reads would break the part at the first interrupt.
So four kilobytes always read back. On a 64 KB part that is six percent of the array, and it is the most valuable six percent at the start of a job: reset vector, stack pointer, startup code, the addresses of every interrupt handler the design actually uses, and usually the version string of the toolchain that built it.
Sixty-Four Sectors, One Password
Above that floor, protection is a range with a password. A vendor who wants to protect a motor control algorithm typically places the library in the upper half and leaves the lower half for the customer’s application code and parameters. That produces a very characteristic shape in a dump: readable code from address zero, a clean boundary at a 1 KB multiple, and 0xFF from there to the top.
The boundary is a fact worth reporting precisely. It tells the customer where their own code ends, and it tells us how much of the array is genuinely unavailable rather than merely unused.
Where Readable Code Ends
Two configurations produce a boundary that is not a boundary. If the EPP bytes also lock the sectors above the library, a data read may fail differently — a protected-against-erase sector still reads, so the visible 0xFF run is shorter than the locked range. And if the whole-array access protection is set, nothing reads at all through the bus, including the four-kilobyte floor.
Separating those three states from outside is the first task on every part in this family. It takes minutes and decides the method.
USB Without A Crystal
Crystal-less operation has a small consequence for recovery: the internal oscillator is trimmed and the trim values live in the part, so a board that boots over USB is telling us its clock path is intact. That is a useful health check before a read, and a reason to prefer a USB-based entry over a serial one when both are available.
Reading A Part That Has Little To Hide
Sixty-four kilobytes reads quickly. We run two passes with different supply settings and then have the part checksum its own array against a staging copy in the 20 KB of SRAM — a check that catches a marginal cell which would pass a comparison of our own two passes, because both would be wrong in the same place.
The reported output lists the library range in sector numbers, the EPP map, whether the four-kilobyte floor was intact, and any run of 0xFF that could not be attributed to either erasure or protection.
Handover
A binary at original addresses, the sector map, and a one-page note on what the protection configuration was. If the 4 KB system block had been converted to user memory, the image is delivered at 68 KB and the note says the factory loader is gone.
The 64-pin version, including why its density code does not exist, is discussed in readout of a locked AT32F425RCT7 binary. The 32-pin value-line part is at extracting protected AT32F421K8U7 program. Send board photographs and a schematic extract through contact and we will confirm the part before you ship it.