Take the AT32F405RCT7, remove sixteen pins and the larger body, and you have the CCT7: same 216 MHz Cortex-M4F, same 256 KB of flash, same 102 KB of SRAM, same two USB controllers. From the outside the two parts look like a packaging decision. From the bench they are not, because every method that depends on reaching a signal depends on those sixteen pins existing.
Same Silicon, Fewer Witnesses
A 48-pin LQFP brings out the buses, the debug port, the USB pairs and a working set of GPIO, but it drops the pins a designer would have used for a parallel bus, extra UARTs, or a second CAN. That has a practical consequence for a read: the number of independent places where execution can be observed at the pin level is smaller, so more of the work shifts from passive monitoring to active access on the die itself.
It does not change the array. The flash geometry, the sector size, the sLib rules and the protection bytes are identical to the 64-pin part, which is why we quote the two together and only separate them when the board layout matters.
What The Pin Count Actually Costs
Inside the 48-pin body the part still has three I²C, three SPI, six USART plus two UART, one CAN and both USB controllers. Those peripherals are multiplexed onto fewer pads, so any given board exposes a fraction of them. If the customer’s board uses CAN on the pins that also carry the SWD lines after remap, the debug port may be unavailable in circuit and the part has to come off.
We ask for the schematic before quoting, not because the silicon differs, but because the escape route does.
Boot Pins And The First 200 Milliseconds
Artery’s boot configuration is sampled at reset, and the sampler decides whether the part starts the user application or the system bootloader. In circuit, holding those pins during power-up is often the easiest way to see whether the flash is readable at all through the factory loader. It is also the step most often ruined by a board that ties the pins to a divider and a capacitor.
sLib Does Not Care About Packaging
A library region set through sLib behaves the same here: instruction fetch runs, data reads return 0xFF, the range is sector aligned (2 KB on a 256 KB part), and the first sector is excluded because the vector table is fetched as data. What changes is only how much of the region a 48-pin board lets you examine without decapsulation.
Mass erase is worth restating because it surprises people: erasing the main array does not remove the library, and clearing the library requires the password and triggers a full erase of everything. There is no configuration in which an erased chip still contains the protected block.
Where The Code Usually Sits
On this class of part the application tends to fill the lower half of the array, with a bootloader or an update stub in the first sectors and constants near the top. The 20 KB boot block is often left as a loader. Reading the vector table first tells us which of those patterns applies, and the 96-bit unique ID tells us whether the board we received is the same batch as the one the customer profiled.
A Note On Advanced Protection
The tool chain for this series exposes an advanced access protection mode that disables the debug interface permanently. It is offered on the F405, and once set it cannot be reversed by any tool, including the vendor’s own. When a customer says the part “cannot be connected”, this is one of the two explanations we check first; the other is a supply that never reaches the minimum for the debug logic to respond.
Handover
Output is the raw image, a comparison between two independent passes, a repaired file if any block disagreed, and a map showing which sectors were protected and which were merely blank. For the CCT7 we also record whether the boot block was still a loader, since that decides whether the linker script has to be rebuilt with an extra 20 KB.
The 64-pin version of this die is described in extracting secured AT32F405RCT7 firmware; the mid-range part with the parallel bus is covered under recovering encrypted AT32F423RCT7 source code. Our services and contact details are one click away if you want a quote against a specific board.