The board is seven millimetres square and the debug pads are not on it. A UFBGA169 at 0.5 mm pitch puts every signal underneath the die, which is the practical starting point for anyone attempting to hack locked STM32H730ABI6Q flash. This is the 128 KB value-line member of the 550 MHz H730 family, and the -Q suffix marks the SMPS supply variant, so the first two things to locate on the schematic are the SWD breakout and the inductor network.
Where Is The Application, Exactly?
Not in the MCU. 128 KB of internal flash holds a bootloader, a root of trust and the setup code for the external Octo-SPI interface, while 564 KB of SRAM provides runtime space. The application executes in place from a serial flash on the board. That split is deliberate: it keeps the silicon cheap and lets the customer choose the density of the external device. It also means a readout scoped only to the MCU returns a few kilobytes of boot code and none of the product logic.
Why The External Chip Reads As Garbage
The H730AB is on the AN5281 list of parts with on-the-fly decryption. OTFDEC watches AXI and AHB read requests addressed to a memory-mapped Octo-SPI region and decrypts them with AES-128 in counter mode. The key sits in registers inside the microcontroller and is never transmitted to the serial flash. Desolder that flash and read it in a programmer and the result is ciphertext, byte for byte. Rebuilding a plaintext image requires either the key or a route through the running system that observes the decrypted stream, and at RDP level 2 there is no debug port and no system-memory bootloader to provide one.
Is The Bootloader Itself Worth Reading?
Yes, more than its size suggests. It contains the Octo-SPI configuration, the OTFDEC region boundaries, the secure boot public key or its hash, and the version marker that tells you which external image belongs with this unit. Those few kilobytes are also the only place where the mapping between external addresses and decrypted regions is defined. A raw external dump without them is a file with no address map attached.
RDP follows the H7 pattern: 0xAA for level 0, 0xCC for level 2, any other value for level 1, written through FLASH_OPTSR_PRG and activated by a reload plus reset. Level 2 is irreversible and disables SWD, JTAG and the bootloader together. PCROP can additionally mark an internal region execute-only through FLASH_PRAR_PRG with 256-byte alignment, and on this family that configuration survives a level 1 to level 0 mass-erase regression.
What The 169-Ball Package Costs You
A UFBGA169 measures 7 x 7 mm at 0.5 mm ball pitch. SWD, JTAG and NRST all terminate under the die, and the fine pitch leaves very little room for a hand-soldered probe. A production board normally routes the debug trio to a tagged test pad, a bed-of-nails fixture or a header on the reverse side; a cost-reduced revision sometimes drops those pads entirely. Locate the balls from the ST reference footprint before attaching.
Key Material That Never Leaves The Die
The OTFDEC key is programmed into registers inside the MCU, not written to the serial flash and not embedded in the encrypted image. Secure firmware install exists precisely so a contract manufacturer can load an encrypted binary without ever seeing the plaintext or the key. That means the external device cannot be used to work backwards to the key, and a production-line leak is not a route to recovery either. At RDP level 2 the debug port and the system bootloader are both gone, so the practical boundary of any software-only approach is the 128 KB internal array plus a correctly labelled external ciphertext dump. State that boundary in the quote rather than discovering it after the board has been stripped.
How Should The Job Be Scoped?
Split it into two evidence packages: the internal 128 KB with option bytes, and the external serial flash contents clearly labelled as encrypted. Record the ball-grid orientation, board revision and the fitted memory device, because a second unit with a different serial flash will not share the same address map. The readout bypass methodology describes how these packages are combined, and the STM32F103RB recovery case is a useful contrast with a part where all code really is on-chip.
For the 176-ball version of the same die, see STM32H730IBK6Q software copy. The Cortex-M3 F217 extraction notes cover another board where external memory decided the approach. Where no SWD test points exist, the device-level service covers package and die access.