I’m working on recovering a 4209 XR controller that got bricked after an accidental haptic buzz update prompt (it was powered on the bench through the charger port with no BMS attached). After the update attempt, the app reported corrupted firmware, and Bluetooth recovery/downgrading methods through FFMWheel haven't worked out.

I’ve got the controller fully disassembled on my bench and plan to hook up an ST-Link V2 over SWD to rewrite it.

I’ve been diving into the Rewheel docs (DumpFirmware.md & FlashFirmware.md), so I understand the general process:

Clearing the STM32's Read-Out Protection (RDP) will wipe the entire flash (including the original bootloader and settings data).

The extracted firmware images can't just be flashed raw over ST-Link, so I need to flash a valid bootloader-settings.bin first to restore Bluetooth update capabilities.

The missing piece for me right now is that bootloader/settings.bin image (or a full flash dump) from a working 4209 hardware XR.

A couple of questions for anyone who has done deep hardware recovery on these:

Does anyone have a bootloader/settings dump for a 4209 XR they’d be willing to share? (Strictly for personal use on my own bench—definitely won't be redistributing it).

Any specific gotchas to keep in mind when clearing RDP and flashing over SWD?

Appreciate any insight, tips, or files you guys might have. Thanks!