CTRLSTAT = 0xffffffff

FLASH_OPTCR looks good to me; excellent!

I think your PWR_CR looks good too. Mine is also 0x0000c000.

err....sorry.... I don't think I can help in this STM32F4 specific question.

Well, it was worth the try, thank you for taking the time to look at it, Joseph.

I do not have any flowchart myself, but I do have some important information, which you will need, in order to unlock the device.

The RM0090 is a great help here. it may not be a flowchart, but I think you might be able to pull the entire programming off by using RM0090 as reference.

One thing I know you would benefit from, is to make a "block write"; eg. create a small function, which sends data to the target. For instance:

uint32_t write_block(const char *aDataBlock, uint32_t aLength);

A function like this should check the FLASH_SR register for errors. For instance, bit 4, WRPERR means that the target is write-protected., but there are other errors that can occur as well. Bit 16 is the BSY bit, and means that an operation is in progress; you'll have to wait until the BSY bit is cleared, before you issue another operation. (see section 3.9.5 for the F405 and F407 - note: there are also information about the F41x, F42x and 43x devices, so make sure you read the correct sections).

You'll need to familiarize yourself with these registers (I've included some example values from my device):

0x40023C00, FLASH_ACR:        00000000

0x40023C04, FLASH_KEYR:       00000000

0x40023C08, FLASH_OPTKEYR:    00000000

0x40023C0C, FLASH_SR:         00000010

0x40023C10, FLASH_CR:         00000004

0x40023C14, FLASH_OPTCR:      00aaaae1

0x40023C18, FLASH_OPTCR1:     110000c0

You can find detailed information about them in RM0090, section 3.

The first thing you want to know, is what is in the FLASH_CR register.

You then want to know how to unlock the FLASH_CR register (by default, it has bit 31 set, which is a lock-bit. You can't just write a zero to this bit, you'll have to ask the microcontroller to zero it for you).

The following two commands are commands I've used in OpenOCD, they read and write 32-bit values.

The 'mww' command means Memory Write Word.

The 'mdw' command means Memory Display Word:

First you'll want to read FLASH_CR (this sequence is shown in section 3.6.1 and is essential, before you can proceed):

mdw 0x40023C10

Next, you'll want to write the value 0x45670123 to FLASH_KEYR, then write the value 0xCDEF89AB to FLASH_KEYR.

mww 0x40023C04 0x45670123; mww 0x40023C04 0xcdef89ab

After this, bit 31 in FLASH_CR should be zero (we'll start by displaying the FLASH_SR register to see if there were any problems):

mdw 0x40023C0c; mdw 0x40023C10

You're now allowed write access to the FLASH_CR register, but you're not allowed to change the option register.

To do so, you'll need to write a sequence to the FLASH_OPTKEYR, followed by a write to FLASH_OPTCR, which will unlock your Flash-memory.

Note: You do not need to unlock FLASH_CR, if you only need to work with FLASH_OPTCR.

First, let's see the contents of the option register, followed by the FLASH_SR register:

mdw 0x40023C14; mdw 0x40023C0c

I recommend reading the old value of FLASH_OPTCR, parsing it and writing back a new value with the bits set for the sectors you want to modify, in case you need to set any bits. Perhaps they're already set, and if they are, it's a good idea not to change the register contents.

This is the sequence that unlocks your Flash-memory (see section 3.7.2):

mww 0x40023C08 0x08192A3B; mww 0x40023C08 0x4C5D6E7F; mww 0x40023C14 0x0fffaaed

mdw 0x40023C0c; mdw 0x40023C10; mdw 0x40023C14

You will need to "mass erase" (section 3.6.3) before you write your program data (section 3.6.4).

These sources might be helpful (I didn't have a look at them yet):

Unfortunately I'm not an expert in this area, so I don't know much about breakpoints and watchpoints.

Please try ARMv7-M Architecture Reference Manual. You need to register on ARM web site to download this document.