A board built around the GD32F305RET6 carries a Cortex-M4 with FPU @120 MHz with 512 KB code array and 64 KB of SRAM inside a LQFP64. The contact form books the bench slot for a GD32F305RET6 that has locked its debug path.
Bench Routine
We read 512 KB code array first, then the option bytes, then a live RAM snapshot if the assembly boots, followed by a confirming second pass. The bench order for a GD32F305RET6 is fixed: flash, then option region, then any live RAM, then two read passes for a checksum.
Reporting And Hand-Off
Customers receive an Intel HEX sized to the full map, one binary per region, and a report listing the RDP level and oscillator. Delivery is one Intel HEX at the true addresses, separate binaries, and a short report for the LQFP64 with the protection state. See the GD32F303CCT6 page for a parallel treatment of this silicon family.
Flash And Working Memory
With 512 KB code array the GD32F305RET6 executes in place, so the reset vector and interrupt table sit at the bottom of the user region. The 64 KB of SRAM on the GD32F305RET6 sits below the peripheral bus and often caches a calibration table a cold dump misses. An AT32 firmware note shows a password region that returns fill bytes on data reads.
Where The Read Protection Lives
The GD32F305RET6 stores its readout-protection level in the code flash option bytes, managed by the FMC peripheral rather than a one-time fuse. On the GD32F305RET6 the protection state lives in the option region and is handled through the FMC block, so it stays reversible. The readout-protection overview frames why a locked part still yields to a careful bench routine.
Peripheral Set
The LQFP64 body also exposes two CAN controllers and a USB OTG interface on the F3xx line, details that matter for a clone. A GD32F305RET6 design leans on the Cortex-M4 with FPU @120 MHz FPU for motor maths, with CAN and USB handling the off-board traffic. The RX24T motor note is a different vendor’s take on fast ADCs plus timers for control.
A LQFP64 GD32F305RET6 that locked mid-project is common; the code array is intact, only the debug path is closed.
For a 64-pin GD32F305RET6 the alternate-function pins are decoded from the dump, not guessed from the silk.
Where a live LQFP64 board is supplied we trace the serial lines before removing power from the GD32F305RET6.
The GD32F305RET6 is photographed next to a scale so the package size is unambiguous in the archive.
Where a bootloader stage exists that region is captured in full for the GD32F305RET6, the usual third-party omission.
Where decapsulation was needed the bare die of the GD32F305RET6 is photographed before the lid is fully removed.
A LQFP64 GD32F305RET6 sent cold in foam reads more reliably than one that travelled powered and warm.
Our report flags any external memory the LQFP64 board carried, since the GD32F305RET6 image may span parts.
For the LQFP64 GD32F305RET6 we confirm the pin one mapping against the data sheet before closing the job.
Where the GD32F305RET6 arrived with corroded pins, we clean the LQFP64 before the first bench attempt.
The customer receives the files with a short note on reflashing the LQFP64 without tripping the read lock again.
The 512 KB code array on the GD32F305RET6 is read at the true addresses, not a relocated image a tool might invent.
A second confirming read is offered when a customer wants proof no weak cell moved on the GD32F305RET6 LQFP64.
Photographs of the 64-pin board are filed with the cover report so the GD32F305RET6 package can be audited later.
The Cortex-M4 with FPU @120 MHz clock source is noted for the GD32F305RET6, because a recovered copy with the wrong PLL will not start.
A small reference card travels with the GD32F305RET6 so the bench knows the expected die orientation.
The Cortex-M4 with FPU @120 MHz on the GD32F305RET6 is documented in the cover report so a replacement part boots identically.
The recovered files for the GD32F305RET6 are named by order number, never by the chip marking alone.
A recovered GD32F305RET6 is cross-checked against the order photo so the marking matches the report.
The delivery keeps the original protection state of the GD32F305RET6, so a later comparison reuses the same settings.
The Cortex-M4 with FPU @120 MHz on the GD32F305RET6 runs the extracted code in place, so the cover report notes the boot setup for a spare LQFP64.