A leaded LQFP is far friendlier than a ball grid when the debug port is closed and the package has to come off, which is exactly why the STM32H742VGT6 exists: a 480 MHz M7 core with a single-bank 1 MB flash and 692 KB of SRAM in an LQFP100, the same headless H742 feature set as the VGH6 but in a package you can lift with hot air instead of a reball. The pins are visible and reballing is simply not part of the job, which is why the VGT6 shows up in lower-volume and prototype hardware. A locked STM32H742VIH6 is the same core with a 2 MB array in TFBGA100, so the package is the main practical difference and the readout logic is shared. The bypass-protection overview explains why these mechanisms behave the way they do across the STM32 range.
Leaded Over Ball Grid
The single biggest practical difference from a BGA sibling is reachability. When the debug port is closed on a TFBGA part, the lid usually has to come off, which means hot-air rework, a stencil and a reball — slow, and risky on a 0.8 mm pitch grid. On the LQFP100 the part can be lifted with a standard hot-air tool, dropped into a test socket, or even read in place with a clamp on the exposed leads, so a closed port is far less of a barrier. A locked STM32H723ZEI6 read follows the same option-byte logic on a 550 MHz core with a smaller array, and the steps transfer cleanly. For the older-core version of the same procedure, a locked STM32F405 read shows how the execute-only window looked before dual-bank flash existed.
Reachability On The Bench
Reading in place with a lead clamp is the option that saves the board. Many service jobs are on a device that must go back into the field, and lifting the package is a last resort. With the LQFP100 the clamp makes contact on the exposed pins while the part stays soldered, so the firmware comes off without the risk of damaging the pads or the surrounding components. The trade is signal integrity: a clamp read needs a clean supply and patience, because a poor contact looks exactly like a protection fault and can send the recovery down the wrong path for an afternoon. A stable bench supply and a fresh clamp tip turn that risk into a routine operation.
In-Place Clamp Reads
Guarding the firmware is one option byte. 0xAA keeps it readable, 0xBB switches on level 1; 0xCC instead closes level 2 with no undo. It is stored in FLASH_OPTSR_PRG and applied via the OPTSTART bit, with the change visible once the part reboots and the lock page reloads. Under level 1 the flash plus the backup SRAM and backup registers are absent from any probe, and system RAM here is frozen at reset, which is exactly why an in-place dump cannot be staged from running memory.
The execute-only region comes from FLASH_PRAR_PRG, 256-byte aligned, and write locking works on a per-128-KB-sector basis via FLASH_WPSN.
Eight Sectors, One Bank
Eight 128 KB sectors form the array, and with no second bank the reset vector is set purely by the density code. A closed port changes nothing about the count; it only changes how the die is reached. There is no display framebuffer and no Chrom-ART DMA2D to model, which keeps the register set small, and the 692 KB SRAM pool is part TCM and part ordinary memory, all of it behind the same level 1 gate as the flash. The leaded body is the feature that makes the whole job tractable without a rework station.
Read the option-byte word before anything else. Grab the protection level, the PCROP boundary and the write-protection table, then dump the eight sectors.
ECC faults are reported by FLASH_ECCR and never silently corrupt the data. The 1.2 V domain supplied by the on-die regulator is sensitive to supply noise, so a stable VCAP is part of the bench plan.
Service And Repair Work
If the port will not open, the contact channel does the package and substrate recovery. The leaded body means a socket or in-place clamp read is practical without removing the part, and the eight-sector dump with the option bytes captured first is a routine capture. That is why this variant turns up in service, repair and low-volume hardware where someone may need to read a part that is already soldered down.