@maehw read the firmware. so in principle, stopping the core and grabbing everything behind one MEM-AP should be enough to do it