One megabyte of RAM behind 128 kilobytes of flash. That inversion defines the STM32H750IBT6, a 480 MHz Cortex-M7 in an LQFP176 body, and it is why any plan to open protected STM32H750IBT6 mcu has two targets. The on-chip array is big enough for a bootloader and little else; the application lives on one of the dual Quad-SPI interfaces and executes in place. Anyone quoting a readout from the MCU alone is quoting a fraction of the firmware.
| Resource | Size | Role |
|---|---|---|
| Internal flash | 128 KB | Bootloader, Quad-SPI setup, root of trust |
| TCM RAM | 192 KB | 64 KB ITCM plus 128 KB DTCM |
| User SRAM | 864 KB | Frame buffers, protocol stacks, staging |
| Backup SRAM | 4 KB | VBAT domain data |
Memory map consequences
The SRAM is large enough to hold an entire external application image, which changes what a debug session can observe. A running product may have decrypted or decompressed code staged in AXI SRAM, and on many STM32 devices a system reset under RDP level 1 would have opened that RAM to a debugger. STM32H7 does not allow it: ST documents that RAM stays closed to JTAG even at level 1. Expect to work with the flash and the external device, not with a convenient RAM snapshot.
Protection set on this line
The H750 security list names ROP, PC-ROP, active tamper, secure firmware upgrade support and secure access mode. RDP itself uses 0xAA for level 0, 0xCC for level 2, and any other value for level 1, programmed through FLASH_OPTSR_PRG with an option-byte reload and reset. Level 2 is permanent; it removes the debug port and the system bootloader with no path back. PCROP turns a flash region execute-only through FLASH_PRAR_PRG, aligned to 256 bytes, with no data reads, no DMA reads and no debug reads. On H7 the PCROP configuration survives the level 1 to level 0 regression that erases the array.
Secure access mode is the item most often overlooked. It gates debug access behind a credential during provisioning, which is useful on a production line and inconvenient on a returned unit. Check its state before assuming that a missing debug connection means RDP level 2; the two produce similar symptoms and very different options.
What is not here
There is no OTFDEC engine on this order code. AN5281 lists the H7B0, H7B3, H730, H733 and H735 families, and the H750 is absent. The dual Quad-SPI windows therefore carry plaintext in memory-mapped mode. A desoldered serial flash read in a programmer yields usable code, which makes the external half of this job considerably easier than it is on an H730 or H7B0 board. The OTP versus flash comparison is a good reference when a customer assumes the same applies to a one-time-programmable region.
Package and pin budget
The IBT6 is a 176-pin LQFP, 24 x 24 mm, with every signal brought to a package edge. That is a material advantage over the ball-grid value-line parts: SWD, JTAG, BOOT0 and NRST can be reached with a fine probe or an existing header, and the Quad-SPI traces are visible on the outer layers. It also means the boot straps are easy to disturb, so record their state before asserting reset. A part pulled into system-memory boot will not present the user flash to a debugger, even when RDP is at level 0.
Why the small internal array still matters
The 128 KB on-chip flash configures the Quad-SPI controller, sets the memory-mapped window and holds the root of trust before any external instruction executes. Reading only the serial flash gives you opcodes with no address map, no clock configuration and no indication of which image revision the board expects. A third-party Quad-SPI programmer will happily return a full binary, but without the internal setup bytes that binary cannot be relocated or reliably disassembled. Treat the internal dump as the index to the external one.
Deliverable shape
Provide the 128 KB internal dump, the option byte and secure-access state, the external serial flash contents, and a note matching the two halves to a single board revision. Verify the reset vector, read twice at a fixed supply and clock, and record which Quad-SPI device was fitted. The STM32F405VG program recovery case uses the same evidence chain on an older M4, while the AT32F435 sLib discussion is a useful comparison for a different vendor’s protected region.
If the debug port is closed or the board cannot be powered in-circuit, the contact route for chip-level work is the remaining option. For a related 280 MHz value-line part with on-the-fly decryption, see STM32H7B0ABI6Q memory extraction.