The AT32F423 sits in the middle of Artery’s range and reads like a part designed by someone who was tired of running out of pins: 150 MHz with a single-precision FPU, 256 KB of flash, 48 KB of SRAM, twenty-four ADC channels at 5.33 Msps, two DACs, two CAN buses, eight UARTs, an external memory controller and a USB device port. On a 64-pin body that is a lot of function, and it changes what a recovery job has to look at.
The Bus At The Edge
XMC brings a 16-bit external bus out of the package and speaks to PSRAM, NOR flash, or an 8080/6800 style LCD. A design that puts its user interface in external memory still keeps its code on the die, but a design that streams fonts, waveforms or lookup tables from a NOR part does not. When we quote a recovery, we ask whether anything is stored off-chip, because the internal array will not contain it and no amount of work on the die will produce it.
The same controller can drive a parallel LCD. That is not memory, but it occupies the same pins, and it means the visible pin activity during a capture may be display traffic rather than bus traffic.
Twenty Kilobytes That May Be Yours
The F423 ships with a 20 KB system memory holding the factory bootloader. One configuration step converts that block into user program and data space, taking the usable total from 256 to 276 KB. Two consequences follow. First, the linker script of the original project may place constants above 0x08040000, so an image that stops at 256 KB can look truncated when it is not. Second, if the block was converted, the bootloader is gone and the board can no longer be programmed through the serial port.
We read the configuration before deciding how far up the array to sweep.
EPP Bytes Before Content
Erase and program protection is expressed per sector through the EPP bytes, and sLib is expressed as a range plus a password. Both are readable without touching the array, and both describe the job in advance. On a 256 KB device the sector size is 2 KB, so there are 128 sectors and 128 protection decisions — enough granularity for a vendor to lock the top half and leave the bottom open, which is exactly what most do.
Reading those bytes first is also how we answer the question customers actually ask: not “can you read it” but “how much of it is protected”.
What The Library Does To A Dump
A protected instruction region answers instruction fetches and refuses data reads, returning 0xFF. From a block-read tool the region looks erased. The tell is behavioural: an erased sector does not execute. If the part boots and runs its application while a sector reads as blank, that sector is protected, not empty.
Erasing does not help. The library survives a main-array erase, and clearing it needs the password and performs a full erase of everything including the protected block. This is the design intent: the password protects the vendor’s IP even from someone who can issue erase commands.
Eight UARTs And Two CANs
The peripheral count matters for a different reason: it tells us what the firmware is likely to be doing, and therefore which parts of the image are worth reconstructing first. A device with two CAN buses and eight UARTs is a protocol bridge or a controller hub; its tables are usually constant arrays near the end of the image, and its state machines are in the low half. Recognising the pattern shortens the disassembly work that follows a successful read.
Sequencing The Job
Access protection state, then EPP and sLib registers, then the unique ID, then two passes over the array with different supply settings, then a checksum executed by the part itself against our staging copy in SRAM. That last step is the cheapest independent confirmation and it catches a misread that a byte comparison between our own two passes would miss.
Output is a binary at original addresses, an extended image if the system block was converted, a sector report and a confidence map. If the design used external memory, the report says so explicitly, because that is the one limitation no recovery method removes.
The 100-pin version of this die is covered in dumping secured AT32F423VCT7 flash memory; the higher-clock part with two USB controllers is at extracting secured AT32F405RCT7 firmware. For background on why flash sectors behave differently from OTP, see how MCU program memory differs, and for scope and lead times see services.