Using an STM32H735G-DK (MB1520-H735I-C02), I was using the HDP_Boot/HDP_Appli examples and I think I fat-fingered the SEC_AREA_START and SEC_AREA_END addresses, setting both to the same value which effectively secures all of internal flash. Neither the on-board STLINK nor an external J-Link can connect, but the board seems to be executing the Dhrystone test out of external Flash a few moments after a reset, which seems to be impossible.
I see that the external flash is connected to OCTOSPI1 and that the OCTOSPIx peripherals can be mapped into memory where they are treated as if they are internal memories, but between 0x08000000 (internal flash) and 0x90000000 (OCTOSPI1) there are reserved regions, SRAM regions, the bootrom itself and of course ALL of the memory-mapped peripherals. AN5601 says that reading the protected memory areas will return 0x00000000 which is just two ARM THUMB LSL R0, R0, 0 instructions, but with all those other regions in the way (and many of them exeception-inducing if attempted to access and/or execute) I don't see how it's possible to execute the Dhrystone test, yet it is very clearly running.
Is it possible to recover this dev board, short of removing the external flash and replacing it with a pre-programmed one which can clear the secure boot as per Section 1.4 of AN5601?
