5-pin header on the main board, goes right to the main STM32F429ZI processor...  utilizing the Serial-Wire Debug interface from the chip.

** Note: ** developers enabled the 'read protection', so can't easily dump the main flash of the chip to capture the main firmware, not sure how this firmware in the cpu's 2MB flash releates to the FW update files.. but would have been nice to try and understand the correlation.