A megabyte of flash on a 64-pin package, a 288 MHz core with a single-precision FPU, and 384 KB of SRAM that can be stretched to 512. The AT32F435RGT7 is the top of Artery’s M4 range, and it is the first part in this family where the address map itself is part of the puzzle rather than a given.
Two Register Sets For One Array
Up to 512 KB the flash controller is driven through one register pair. Beyond that boundary a second pair takes over, and a programmer that only knows the first pair will silently format its block addresses against the wrong half. For a read this is not a theoretical concern: an image that appears to be half zeros usually means the upper half was addressed through the lower bank’s registers.
| Region | Address range | Control |
|---|---|---|
| Bank 1 | 0x08000000 – 0x0807FFFF | FLASH_CTRL / FLASH_ADDR |
| Bank 2 | 0x08080000 – 0x080FFFFF | FLASH_CTRL2 / FLASH_ADDR2 |
| Protection bytes | per sector | EPP registers, one bit per sector |
| Library range | per sector | sLib set-range and password |
The practical consequence is that a full read has to be planned in two halves with a register switch in the middle, and the switch is where bad dumps come from.
The SRAM Byte That Moves The Map
SRAM on this series is 384 KB as shipped and configurable up to 512 KB, with the split between flash and SRAM set through a system configuration byte — the vendor’s tool shows it as an EOPB0 field holding 384 KB or 512 KB. Change that byte and the boundary between the two memory types moves.
For recovery this matters twice. It changes how much contiguous RAM a staging routine can use, and it changes what a compiled image expects: a project built for 512 KB of SRAM will not run on a part configured for 384. When we reassemble a working part from a dump, that byte is part of the reconstruction, not an afterthought.
Four Kilobyte Sectors And A Block Erase
Sector size here is 4 KB, larger than on the 256 KB parts, and this is the only series in the family where the vendor’s programmer offers a block erase alongside the sector erase. Both matter for interpreting a dump: a 4 KB sector that reads as 0xFF is a coarser statement than a 1 KB one, and a block erase explains large uniform gaps that would otherwise look like missing code.
sLib At Megabyte Scale
The library mechanism is unchanged: a sector-aligned range, a password, instruction fetch allowed, data reads returning 0xFF, and the exclusion of the first sector because the vector table is fetched as data. What changes is scale: with 256 sectors of 4 KB a vendor can protect a large middleware stack and still leave room for a customer application. A library spanning hundreds of kilobytes is normal here.
Clearing it still requires the password and still erases the entire main array. On a megabyte part that is the whole product, which is why the operation is rarely attempted and a protected region here is usually resolved by other means.
No Advanced Access Protection Here
Unlike the smaller families, the F435 does not offer the irreversible advanced access protection mode. It offers whole-array access protection, which the vendor’s tool exposes through a protection byte, plus per-sector erase and program protection and sLib. For a recovery that is a meaningful difference: there is no permanent state in which the debug interface is destroyed, only states that erase everything when cleared.
Why 288 MHz Changes The Timing
At 288 MHz with a zero-wait-state arrangement, capture equipment that was adequate for a 96 MHz part starts missing events. We drop to a slower clock where the application permits, or capture on the peripheral side of the bus rather than the core side. Firmware that runs mostly from cache and prefetch is harder to fingerprint from outside than firmware that runs linearly.
Sequence For A Full Read
Configuration byte, access protection byte, EPP map, library range, then the unique ID, then bank one in two passes, then the register switch, then bank two in two passes, then a checksum computed by the part. The switch is repeated with a different supply setting on the second run so that a marginal read at the boundary cannot look consistent.
Delivered as two bank images plus a merged binary, a sector map, and the configuration byte values needed to rebuild the part.
The 100-pin version with the full external bus is at copying a protected AT32F435VGT7 flash; the same die with an Ethernet controller is covered under extracting encrypted AT32F437RGT7 code. Background on how flash differs from one-time-programmable memory is in this comparison, and commercial terms are on the services page.