# STM32_FlashLoader.axf Recovery Notes

Generated from `STM32_FlashLoader.axf`.

## Files

- `recovered_main.c` - C-like reconstruction of the loader business logic and the flash routines used by it.
- `recovered_startup.s` - recovered ARMASM/Keil-style startup entry from `stm32f10x_vector.s`.
- `flash_info_protocol_analysis.md` - detailed host/loader mailbox protocol analysis for `Flash_Info`.
- `ghidra_decompiled.c` - raw Ghidra headless decompiler output for cross-checking.
- `compile_gcc/` - ARM GCC buildable reconstruction with linker-fixed `Flash_Info` address.
- `STM32_FlashLoader.disasm.txt` - full Thumb disassembly from `llvm-objdump`.
- `STM32_FlashLoader.symbols.txt` - ELF symbol table.
- `STM32_FlashLoader.readobj.txt` - ELF headers, sections, and symbols.
- `STM32_FlashLoader.dwarf.txt` - DWARF debug information.

## ELF Summary

- Format: `elf32-littlearm`
- CPU/code: Cortex-M3 Thumb
- Load/start address: `0x20000000`
- Code section: `ER_RO`, `0x20000000`, size `0x0cd8`
- RAM data: `ER_RW`, `0x20000cd8`, size `0x0c`
- BSS: `ER_ZI`, `0x20000ce4`, size `0x269c`
- Original compiler: ARM/Thumb C/C++ Compiler RVCT3.0 Build 441

## Important Symbols

- `Flash_Info`: `0x20000ce4`, type `volatile FLASH_INFO`, size `8252`
- `EraseCounter`: `0x20000cd8`
- `NbrOfPage`: `0x20000cdc`
- `FLASHStatus`: `0x20000ce0`
- `MemoryProgramStatus`: `0x20000ce1`
- `HSEStartUpStatus`: `0x20000ce2`

## Startup Notes

The startup code in this AXF is not a normal flash vector table. The ELF entry is
`0x20000000` in SRAM. `Reset_Handler` loads `SP` from a literal value
`0x20002f20`, calls `Main()`, then leaves the loader to set `Flash_Info.Result`.

`__user_initial_stackheap` matches the ARM two-region memory hook:

- heap base: `0x20002f80`
- stack top: `0x20003380`
- heap limit: `0x20003180`
- stack limit/base: `0x20003180`

## Loader Commands

`Main()` reads `Flash_Info.Command`:

- `0`: program halfwords from `Flash_Info.Buf` to `Flash_Info.TargetAddr`
- `1`: erase all configured pages
- `2`: erase pages covering `Flash_Info.TargetAddr..TargetAddr+Length`
- `3`: set `Flash_Info.Result = 1`, named `ReadChipID` in symbols
- default: set `Flash_Info.Result = 0`

## Limitations

This is a reconstruction, not the original source tree. The AXF contains debug names and types, but not the original comments/macros. ST library code is mostly identifiable and can be replaced with matching STM32F10x standard peripheral library sources if exact source compatibility is needed.