[4] Shamus, P. (2023). "Reverse engineering ARM Cortex-M firmware." Journal of Hardware Hacking , 7(2), 45-67.

to enter the Recovery Menu, then selecting "Wipe data/factory reset". FRP Bypass:

The USB device stack (custom usb_gadget driver) copies vendor IDs from a USB stick into a 64-byte stack buffer using strcpy() . A USB stick with a malicious model string triggers a stack overflow, allowing ROP execution.