A 2 MB array under a hundred-ball lid is a rare combination, and the STM32H742VIH6 is exactly that: a 480 MHz Cortex-M7 holding a 2 MB array in two banks and 692 KB of SRAM in a TFBGA100, the smallest ball-grid body that still carries the full H742 memory. Like every H742 it omits the LTDC and the JPEG engine, so the graphics pipeline is absent while the protection logic stays standard. The density is what makes the VIH6 attractive for data-heavy logging or web-adjacent firmware where a smaller H7 would run out of room. The otp-versus-flash reference is worth reading here because the part mixes user flash, option bytes and backup registers, and knowing which domain holds a secret changes the read order. A locked STM32H742VGT6 read covers the 1 MB LQFP twin with the same lock map and the same word.
Density In A Small Body
Packing 2 MB into 100 balls means the external interface is thinner than on the larger parts, but the internal map is the same dual-bank structure as its siblings. A recovery that assumes a single bank will misplace the reset vector, because the SWAP_BANK_OPT bit can silently remap the two halves between resets. A restored STM32H725RGV6 program follows the same level scheme on a 550 MHz sibling that does carry crypto, which proves the lock levels travel unchanged across the family. With no cryptographic accelerator on the VIH6 there is no Secure Firmware Install region to hunt for, so the flash is the whole target and the capture is simpler than on a crypto part. For the older-core equivalent, decrypting an STM32F205 array shows a similar idea on a Cortex-M3 device.
Two Banks, One Vector
The bank layout is the one trap on a 2 MB part. Eight sectors per bank means the live firmware could be in either half, and a board that updated in the field may have flipped SWAP_BANK_OPT without leaving any other trace. Reading both banks and comparing them against the density code is not optional; it is the only way to know which image is current. Teams that dump a single bank and ship it often discover the clone boots into the bootloader and stops, because they captured the stale half. A two-bank read takes minutes longer and prevents a failed recovery, and it also reveals whether the device was ever reflashed in the field.
Protection Byte Explained
One byte decides whether the probe can read the part. 0xAA means unlocked, 0xBB is the standard level 1; 0xCC, by contrast, fuses the debug path permanently. That byte is programmed through FLASH_OPTSR_PRG and latched with OPTSTART, and the new state appears only after a reset has reloaded the option block. At level 1 the probe loses the array, the backup registers and the backup SRAM, and the H7 family seals on-chip RAM after each reset as well, defeating a staging trick that older cores allowed.
PCROP is set in FLASH_PRAR_PRG, aligned to 256 bytes, which means only code fetches get through; plain reads, DMA transfers and debug taps all return nothing. The write lock for each sector lives in FLASH_WPSN.
Sector Layout At Two Megabytes
Sixteen sectors of 128 KB each fill the 2 MB array, split evenly between two banks, and SWAP_BANK_OPT can remap them. The thin TFBGA100 interface hides none of this, but the reader still has to determine the active half before the reset vector means anything. SRAM totals 692 KB here, partitioned into tightly coupled blocks and ordinary system memory, the whole of it sealed at level 1 on a locked device. Derive the PCROP and bank edges from the actual density code rather than guessing, or the boot vector lands in the wrong half and the clone never starts.
Start with the option byte, not the array. Record the readout level, the PCROP area and the WRP mask, then dump the full sixteen sectors.
Reading the array twice at the same supply lets ECC errors report via FLASH_ECCR rather than damage the data. A clean 1.2 V supply from the internal LDO keeps ECC quiet, so bench supply and VCAP decoupling decide read quality.
Bench Steps For The VIH6
Once the debug interface is shut, the contact channel handles the board and chip work without a bench. A TFBGA100 is reflowed rather than lifted, so the read happens after the lid is removed and the die is presented to the socket. The two-bank layout is the only subtlety; with the running half identified, the sixteen-sector dump is unremarkable.