Extract locked STM32H723VGH6 firmware and the first obstacle is mechanical, not logical. The part ships in a TFBGA100 body measuring 8 by 8 mm with a 0.8 mm ball pitch, so the SWD and JTAG pads are buried under the package rather than presented as accessible pins. A board that routes PA13, PA14 and NRST to a test header makes the job straightforward; a board that leaves them under the ball array means the readout plan starts at the PCB layout, not at the debugger.
Where Does The 1 MB Actually Sit?
This is a 550 MHz Cortex-M7 with a double-precision FPU, 1 MB of embedded flash with ECC, and 564 KB of SRAM split into 128 KB of DTCM, 432 KB of system RAM and 4 KB of backup SRAM. The flash is internal and contiguous from 0x08000000, which is the good news: there is no external serial device to desolder before any of the code can be seen. Two Octo-SPI interfaces are present for XiP, but on this particular order code there is no on-the-fly decryption engine, so anything mapped there is plain ciphertext-free application data rather than a protected image.
The power tree is worth checking early. The H723 line is LDO-only, and the VGH6 code denotes the TFBGA100 variant rather than an SMPS option. Supplying VCORE from the wrong rail is a fast way to produce a readout that looks valid but fails its checksum.
Which RDP Level Is On The Part?
Readout protection on STM32H7 is an option byte with three states. 0xAA is level 0, 0xCC is level 2, and any other value, commonly 0xBB, is level 1. A change written through FLASH_OPTSR_PRG only takes effect after an option-byte reload followed by a reset, so a single snapshot taken before a power cycle can misreport the real policy.
The H7 family adds a detail that trips up people arriving from F1 or F4 parts: at level 1, RAM is still closed to JTAG even after a system reset. On older STM32 devices a reset under RDP1 opened the SRAM to the debugger and allowed code to be staged there for a dump. ST explicitly removed that path here. A technique that depends on loading a small reader into RAM and reading out flash from inside will not work on this die.
Level 2 is a different category altogether. It disables JTAG and SWD permanently, blocks the system-memory bootloader, and shields flash, backup registers and SRAM from external access. There is no regression from level 2, so any plan that assumes a later mass erase can reopen the debug port is wrong from the start.
What Does PCROP Protect In Practice?
Proprietary code read-out protection is independent of the RDP level. A protected region becomes execute-only: the instruction bus may fetch opcodes, while D-bus reads, DMA transfers, debugger reads, writes and erases all fail. The area is programmed through FLASH_PRAR_PRG, must be aligned to 256 bytes, and on this flash architecture only one region per bank can be defined. Code placed there has to be compiled with an execute-only option, because literal pools and jump tables would otherwise be fetched as data and return nothing.
On STM32H7 a further subtlety applies. Dropping from level 1 back to level 0 triggers a full flash mass erase, as expected, but ST documents that the PCROP configuration itself survives that regression. Erasing the array does not quietly return the proprietary region to a readable state.
Building A Defensible Image
A usable delivery is more than a hex file. Capture the vector table at 0x08000000, the full 1 MB address range, the option byte state, and the OTP area, then verify that the interrupt vectors point inside the recovered range. ECC means marginal bits tend to present as read failures rather than silent corruption, so repeat the read and compare before declaring the image complete. Our method notes on bypassing read protection describe how these checks fit together, and the STM32F407 readout case shows the same evidence chain applied to an older M4 part.
For boards where the debug pads are inaccessible or the protection level is already at 2, the IC readout service covers package-level and die-level approaches. Related material on Cortex-M3 F217 extraction and the STM32H725VGH6 power variant is useful when the schematic shows a different regulator than expected.