The debugger connects and the memory window stays empty. That is a common first report on a dual-core STM32H7, and it is usually not a protection failure at all. With the STM32H745IGT6 there are two processors behind one debug port, a Cortex-M7 at 480 MHz and a Cortex-M4 at 240 MHz, and the access port you select determines which address view you get. Anyone trying to read protected STM32H745IGT6 data should settle that question before concluding the part is locked.
Which AP Is The Debugger Attached To?
| Access port | Core | Clock | Cache |
|---|---|---|---|
| AHB-AP 0 | Cortex-M7 | 480 MHz | 16 KB I + 16 KB D |
| AHB-AP 1 | Cortex-M4 | 240 MHz | ART accelerator |
CubeProgrammer asks which core to connect to. Select the wrong one and peripherals clocked in the other domain appear absent, and some SRAM regions look empty even though the flash is untouched. Add the three power domains to the picture: D1 hosts the high-performance logic, D2 the communication peripherals and timers, D3 the reset, clock and power control. D2 can be clock-gated independently, so a debugging session that arrives while the M4 domain is asleep sees a different chip than one that arrives at full run.
How Much Flash Is Actually Present?
The G in IGT6 is a density code and it means 1 MB. The 2 MB figure quoted for the H745 family belongs to the I-coded parts such as the BIT6, not this one. Reading 2 MB from an IGT6 produces a second half that is either a bus error or a constant pattern, and a disassembler will happily turn that pattern into nonsense instructions. Recompute the sector map, the write-protection bitmap and any PCROP boundary against the real 1 MB ceiling before assembling the image. The OTP and memory-type comparison is a useful reference when someone assumes the missing megabyte is one-time-programmable space.
What Protection Is Shared?
RDP is one word for the whole device, not one per core: 0xAA for level 0, 0xCC for level 2, any other value for level 1, written through FLASH_OPTSR_PRG with an option-byte reload and reset. Level 1 closes flash, backup SRAM and backup registers to the debugger, and on H7 also closes RAM access after a system reset, so staging a reader in the 1 MB of SRAM is not a shortcut. Level 2 is irreversible and removes the debug port and the system bootloader permanently.
PCROP adds an execute-only region through FLASH_PRAR_PRG, aligned to 256 bytes and limited to one region per bank. Instruction fetches work; data reads, DMA and debug access do not. This order code is not on the AN5281 OTFDEC list, so its Quad-SPI window carries plaintext rather than an AES-128-CTR stream. Active tamper and ROP complete the security list.
Shared flash, separate starts
Both cores execute from the same 1 MB array, but they do not start together. The M7 normally boots first and releases the M4 from reset, and the option bytes contain separate domain reset controls such as NRST_STOP_D1 and NRST_STBY_D1. A debugger that attaches while the M4 is still held sees a half-initialised device: peripherals in D2 are unclocked, and parts of the SRAM appear blank. Record the domain state at attach time, and do not interpret an empty window as evidence of readout protection before checking whether the second core has been released.
Recomputing the sector map
The 1 MB ceiling changes more than the file length. Write protection is applied per 128 KB sector, so the bitmap size, the erase granularity and any PCROP boundary all have to be recalculated against the real array rather than copied from a 2 MB project. Reading past the top of the array returns a bus error or a repeated pattern that a disassembler will turn into plausible-looking nonsense. Compare the recovered reset vector and the highest non-empty address with the density code before declaring the image complete.
What A Complete Delivery Looks Like
Capture both cores’ view of the memory map, the full 1 MB flash, the option byte state and the D1/D2/D3 clock configuration at the time of the read. Note which core held the debug session and which AP was selected. Verify the reset vector and compare two reads at a fixed power state; ECC on the array means marginal cells fail explicitly rather than flipping quietly. The STM32F103RB recovery case shows the simpler single-core version of the same check, and the F205ZET7 extraction notes cover another ST part where the memory map decided the outcome.
For the 2 MB, 208-pin member of this family, see STM32H745BIT6 reverse engineering. Where the debug port is closed, the device-level readout service covers package and die access.