How can I retrieve the firmware that has been loaded onto a device?

[Bevan.1]

The STM32 Cube Programmer lets me read memory, but the address is required. It is not clear *where* the DFU loader puts a .hex file. What I want is to recover the hex file.

[Tesla DeLorean]

What STM32 are we talking about?

Typically 0x08000000 is the FLASH base address

The tools would need to read out the binary data, and save that back out to a .BIN or .HEX

Your build process should output .MAP files during the LINK, and the .HEX/,ELF would be extracted/converted into a .DFU file. The DFU file is an object format, ST has fully documented the format in the past.