STM32F4 jump to bootloader without boot0 pulled up

It doesn't quite work that way. You'd need to set a marker in RAM, let the Watchdog expire, and catch that early in your ResetHandler, and vector off into the System ROM.

https://my.st.com/public/STe2ecommunities/mcu/Lists/STM32Java/Flat.aspx?RootFolder=https://my.st.com/public/STe2ecommunities/mcu/Lists/STM32Java/jumping%20to%20the%20bootloader%20via%20software%20does%20not%20permit%20dfu%20mode&FolderCTID=0x01200200770978C69A1141439FE559EB459D758000F9A0E3A95BA69146A17C2E80209ADC21&currentviews=928

So if I understand correctly, I have to do something before I expire the watchdog and do something in the reset interrupt routine? How can I get the reset interrupt routine function in HAL?

I presume the HAL still uses startup_stm32xxx.s? You add code there to react to the reset which recognizes a setting you have left in an agreed location in RAM. Ideally one outside of the linker's scope

/public/STe2ecommunities/mcu/Lists/cortex_mx_stm32/Threaded.aspx?RootFolder=/public/STe2ecommunities/mcu/Lists/cortex_mx_stm32/Jump%20to%20internal%20bootloader&FolderCTID=0x01200200770978C69A1141439FE559EB459D7580009C4E14902C3CDE46A77F0FFD06506F5B&currentviews=1653

In application.c
// 1FFF0000 -> 2000xxxx -> SP
// 1FFF0004 -> 1FFFxxxx -> PC
printf(''Entering Boot Loader..

'');
*((unsigned long *)0x2001FFF0) = 0xDEADBEEF; // 128KB STM32F4xx
// NVIC_GenerateSystemReset(); // Explicitly Reset (SPL/CMSIS)
while(1); // Wait for Watchdog to fire
In startup.s
; Reset Handler
Reset_Handler PROC
EXPORT Reset_Handler [WEAK]
IMPORT SystemInit
IMPORT __main
LDR R0, =0x2001FFF0 ; Magic Location
LDR R1, =0xDEADBEEF
LDR R2, [R0, #0]
STR R0, [R0, #0] ; Invalidate
CMP R2, R1
BEQ Reboot_Loader
LDR R0, =SystemInit
BLX R0
LDR R0, =__main
BX R0
ENDP
Reboot_Loader PROC
EXPORT Reboot_Loader
LDR R0, =0x40023844 ; RCC_APB2ENR
LDR R1, =0x00004000 ; enable SYSCFG clock
STR R1, [R0, #0]
LDR R0, =0x40013800 ; SYSCFG_MEMRMP
LDR R1, =0x00000001 ; remap ROM at zero
STR R1, [R0, #0]
LDR R0, =0x1FFF0000 ; load ROM base
LDR SP,[R0, #0] ; assign main stack pointer
LDR R0,[R0, #4] ; load bootloader address
BX R0
ENDP

Yes, In my project there is a file startup_stm32f407xx.s

// 1FFF0000 -> 2000xxxx -> SP
// 1FFF0004 -> 1FFFxxxx -> PC

*((unsigned long *)0x2001FFF0) = 0xDEADBEEF;

You're using a Cortex-M4 processor, the two initial vector entries contain a Stack Pointer (SP) and a Program Counter (PC). The SP will be pointing into the RAM somewhere, and the PC will be pointing to some code deeper into the ROM image. When BOOT0 is High, the memory at 0x1FFF0000 maps at zero within the address space of the processor, as well as it's normal address. The Reboot_Loader effects this transfer of control, with the memory mapping/shadowing in this fashion.

http://infocenter.arm.com/help/topic/com.arm.doc.ddi0439b/DDI0439B_cortex_m4_r0p0_trm.pdf

http://www.amazon.com/Definitive-Cortex%C2%AE-M3-Cortex%C2%AE-M4-Processors-Edition/dp/0124080820

Thank you for the links and explanation. I will try this tommorow morning.

I tried to insert the assembler code now, but all the symbols (I dont understand them as well) are unrocognised, like PROC, EXPORT, IMPORT etc.

That would be because they are Keil assembler directives

.section .text.Reset_Handler
.weak Reset_Handler
.type Reset_Handler, %function
Reset_Handler: 
/* <<<< ADD CODE HERE TO CHECK AND BRANCH TO REBOOT_HANDLER <<<< */
 LDR R0, =0x2001FFF0 ; Magic Location
 LDR R1, =0xDEADBEEF
 LDR R2, [R0, #0]
 STR R0, [R0, #0] ; Invalidate
 CMP R2, R1
 BEQ Reboot_Loader

ldr sp, =_estack /* set stack pointer */

After the Reset Handler
Reboot_Loader:
LDR R0, =0x40023844 ; RCC_APB2ENR
LDR R1, =0x00004000 ; enable SYSCFG clock
STR R1, [R0, #0]
LDR R0, =0x40013800 ; SYSCFG_MEMRMP
LDR R1, =0x00000001 ; remap ROM at zero
STR R1, [R0, #0]
LDR R0, =0x1FFF0000 ; load ROM base
LDR SP,[R0, #0] ; assign main stack pointer
LDR R0,[R0, #4] ; load bootloader address
BX R0

Clive, your help is priceless! Thank you very much, I managed to get it working :)

This would be why people separate their own loader/app code, and then avoid erasing the loader portion and bricking the device.