A board built around the GD32F303CCT6 carries a Cortex-M4 with FPU @120 MHz with 256 KB code array and 48 KB runtime memory inside a LQFP48. Our recovery desk handles the LQFP48 capture and returns a verified image.
Where The Read Protection Lives
The GD32F303CCT6 stores its readout-protection level in the flash option bytes, managed by the FMC peripheral rather than a one-time fuse. On the GD32F303CCT6 the protection state lives in the option bytes region and is handled through the FMC block, so it stays reversible. A bypass methodology covers the non-destructive approach for a GD32F303CCT6 in detail.
Flash And Working Memory
With 256 KB code array the GD32F303CCT6 executes in place, so the reset vector and interrupt table sit at the bottom of the user region. The 48 KB runtime memory on the GD32F303CCT6 sits below the peripheral bus and often caches a calibration table a cold dump misses. The RX24T hex note documents a 64-pin cousin with the same debug-ID convention.
Bench Routine
We read 256 KB code array first, then the option bytes bytes, then a live RAM snapshot if the assembly boots, followed by a confirming second pass. The bench order for a GD32F303CCT6 is fixed: flash, then option region, then any live RAM, then two full reads for a checksum.
Peripheral Set
The LQFP48 body also exposes two CAN controllers and a USB OTG interface on the F3xx line, details that matter for a clone. A GD32F303CCT6 design leans on the Cortex-M4 with FPU @120 MHz FPU for motor maths, with CAN and USB handling the off-board traffic. The LPC2378 MiniBus note is a contrast where external bus carried part of the image.
Reporting And Hand-Off
Customers receive an Intel HEX sized to the full map, one binary per region, and a report listing the RDP level and oscillator. Delivery is one Intel HEX at the true addresses, separate binaries, and a short report for the LQFP48 with the protection state. The GD32F305RET6 note is the matching entry for another member of the GD32F303CCT6 line.
Where decapsulation was needed the bare die of the GD32F303CCT6 is photographed before the lid is fully removed.
The 48-pin GD32F303CCT6 is logged against its order code so a repeat job reuses the same bench setup.
For a 48-pin GD32F303CCT6 the alternate-function pins are decoded from the dump, not guessed from the silk.
We archive a checksum per region so a future read of the GD32F303CCT6 can be compared byte for byte.
We record the supply rail used on the LQFP48, because the GD32F303CCT6 flash timing is sensitive to voltage.
The customer gets a plain summary with the GD32F303CCT6 files, written for a non-engineer to follow.
A GD32F303CCT6 that has been partially read elsewhere often arrives with the option bytes region already corrupted.
The Cortex-M4 with FPU @120 MHz clock source is noted for the GD32F303CCT6, because a clone with the wrong PLL will not start.
A LQFP48 GD32F303CCT6 sent cold in foam reads more reliably than one that travelled powered and warm.
We keep the GD32F303CCT6 away from strong fields on the bench, since flash can be disturbed by magnets.
A small reference card travels with the GD32F303CCT6 so the read bench knows the expected die orientation.
The recovered files for the GD32F303CCT6 are named by order number, never by the chip marking alone.
For field units the GD32F303CCT6 usually has no source; the recovered image is the only copy that survives.
The delivery keeps the original protection state of the GD32F303CCT6, so a later comparison reuses the same settings.
The LQFP48 outline of the GD32F303CCT6 matches other group members, so the marking confirms the exact die fitted.
For the LQFP48 GD32F303CCT6 we confirm the pin one mapping against the data sheet before closing the job.
The customer receives the files with a short note on reflashing the LQFP48 without tripping the code lock again.
The 48 KB runtime memory on the GD32F303CCT6 is captured live only when the assembly still comes up on power.
Where the GD32F303CCT6 arrived with corroded pins, we clean the LQFP48 before the first bench attempt.
The 256 KB code array on the GD32F303CCT6 is read at the true addresses, not a relocated image a tool might invent.
We note any CAN or USB use on the LQFP48, because the GD32F303CCT6 peripheral setup lives in the flash.