The STM32H743ZIT6 sits in the middle of the H743 range: a 480 MHz M7 core carrying a 2 MB flash split into two banks and the 1 MB SRAM pool in an LQFP144, the LTDC and JPEG pipeline present, and still no cryptographic accelerator. With a 2 MB array it is the higher-density sibling of the 1 MB BGT6, which makes the bank layout the one thing to watch during a read. The LQFP144 trades some pins for a manageable leaded package, while keeping the full graphics pipeline, which is a good compromise between the 208-pin part and the denser BGAs. Where a design parked its secrets is worth checking against the nvram extraction note, since flash, OTP and the backup domain all answer to one byte. A locked STM32H743AII6 read documents the 2 MB UFBGA169 relative and its matching sector map.
Middle Of The H743 Range
The reverse-engineered STM32H745BIT6 chip is a two-core crypto relative running an identical lock byte, so the discipline plainly extends to dual-processor devices. For an older part with a comparable idea, decrypting an STM32F205RBT6 OTP shows the Cortex-M3 ancestor of this scheme on a device where the secret lived in OTP. On a graphics part the most revealing configuration is often in the panel and blitter configuration rather than the flash array alone, so the capture plan is flash plus the display registers plus the alternate-function table. Framebuffers for the LTDC live in that 1 MB RAM pool, and without their setup registers a rebuilt binary cannot reproduce the panel output.
Two Banks, Two Firmware Images
The two-bank split is the subtlety that catches teams on the ZIT6. Unlike the 1 MB parts, this one can run from either half, and a field update may have left the inactive bank holding the previous firmware revision. A recovery that dumps only what looks live can miss the backup image that the bootloader falls back to, so both banks belong in the archive. Comparing the two also reveals whether the part was ever reflashed, which is often the answer to why a board behaves differently from its siblings on the line and saves a fruitless search through the application code. The SWAP bit is the first thing to check before trusting the vector.
One Word For Both Domains
Level 1 and level 2 both live in one option byte here. 0xAA is unlocked, 0xBB is level 1, whereas 0xCC is the point of no return. The setting passes through FLASH_OPTSR_PRG and is locked by OPTSTART, applying after a reload of the option block on the next reset. Level 1 removes the array, backup registers and backup SRAM from the debug window and the 1 MB RAM is sealed at reset, which means the data has to come from the array rather than a memory grab.
Code-readout protection lives in FLASH_PRAR_PRG with a 256-byte alignment; instruction fetches therefore become the only accesses that land while data paths, DMA and the debugger are refused. FLASH_WPSN does the write lock per block.
Active Half First
Two eight-sector banks of 128 KB apiece account for the whole 2 MB, with SWAP_BANK_OPT free to remap them. A point worth flagging here: a field update may leave the inactive bank holding the previous firmware, so both halves belong in the archive and a comparison between them shows whether the device was ever reflashed. Establish the running half, check the start address against the density marking, then save the panel registers held in that 1 MB RAM pool before the session ends.
| Half | Address role | What to archive |
|---|---|---|
| Active | boot source | current firmware |
| Inactive | rollback slot | previous revision |
Start from the option byte, not the array. Pull the RDP setting, the code-readout region and the write lock bitmap, then read out the full sixteen-sector array.
The read should be done twice at the same power state, letting ECC faults surface through FLASH_ECCR instead of corrupting the image. The 1.2 V core rail from the internal LDO is sensitive to supply noise, so VCAP decoupling drives read quality.
Archiving Both Revisions
When the part is sealed and the bench is not an option, the extraction service handles the two-bank read end to end. The LQFP144 is hand-reworkable when the debug port is closed, which keeps bench risk low, and identifying the running half first makes the sixteen-sector dump plus display registers a routine job. Bank selection is the only part needing judgement here.