Enquiries about how to unlock locked GD32F330C4T6 flash heximal data are enquiries about 16 kilobytes, and the number matters twice: it is small enough that a recovered image can be reviewed page by page, and small enough that the destructive unlock route — which mass-erases the whole array — destroys nearly everything there is to save. The C4T6 is the 48-pin entry of the GD32F330 value line: a Cortex-M4 at 84 MHz with zero-wait-state access, 4 KB of SRAM, a 10-channel ADC, two USARTs, one SPI and one I2C, in an LQFP body that is friendly to fixtures.

The lock and the one-read diagnostic

Protection state lives in the SPC byte of the option byte area at 0x1FFFF800. At 0xA5 the array is open; at any other value the device is protected, and from debug, SRAM boot or the system bootloader every read of the main flash returns a bus error. Because the option bytes stay readable in every mode, the first bench transaction is definitive: one read of 0x1FFFF800 tells you the state, and the state tells you the price. The destructive escape — rewriting the SPC byte to 0xA5 — is quoted only when the customer confirms no sibling board, update image or programming log survives, because on a 16 KB part that route erases the entire programme. The unlock notes on the 20-pin F4P6 cover the same mechanism in the smallest package of the line.

A heximal worth delivering

Where a copy survives, the extraction is a comparison dump and the 16 KB image is reviewed exhaustively — vector table, constants, boot path — before delivery, because at this size “complete” is checkable rather than assumed. The delivered heximal carries the option byte configuration as found, so the customer can decide deliberately whether replacement parts inherit the lock. Firmware on value-line parts like this typically drives a charger, a sensor or a small motor, and the analogue routine is exercised on real hardware during verification; the small-AVR analysis pages describe the same exhaustive review at comparable code size, and the readout standards define the verification terms. The unlock arrangement and the controller service pages cover the commercial side.

Sixteen kilobytes under exhaustive review

There is a threshold below which a recovered image can be reviewed completely rather than sampled, and 16 KB sits comfortably under it. Every page of a C4T6 image gets read by an analyst, not just a script: the vector table is checked against the peripherals the board actually uses, constant tables are traced to their consumers in the code, and the boot path is walked instruction by instruction to confirm nothing executes from uninitialised space. The review sounds slow and is not — at this code size it is an afternoon — and it catches the two failure modes that checksums never will: a page captured from the wrong address boundary, and a parameter region that the original firmware relocated after production. The payoff is a heximal that a maintenance team can act on immediately, because the report says what each region is rather than leaving them to rediscover the layout from a datasheet and a debugger. For customers migrating away from this part — common now, as successor value-line families tempt redesigns — the reviewed image doubles as the specification for the port. We charge for the review explicitly rather than bundling it, because some customers genuinely only need the bytes; ask for the review when you want the annotations, and skip it when the heximal is feeding an automated reprogramming line that already knows the layout. The review also has a quiet second use: it is how we detect when the 16 KB image is not the whole story. Small applications sometimes branch on data that lives in the option bytes or in a bootloader stub left by the programming house, and an analyst who has read every page will notice the reference; a script will not. When that happens the project grows a small second stage, scoped and quoted before it begins, and the customer hears about it before the bench work rather than after the invoice.

Send the marking and whatever you know about the original programming. On parts this small the honest answer often arrives before the sample does, and it is usually cheaper than expected.