PostHeaderIcon Reverse Engineering NXP MCU LPC2138FBD64 Locked Flash: The Five Hundred Kilobyte Case

The largest member of this branch is also the one where a customer is most likely to assume the worst. Half a megabyte of flash sounds like a large amount of intellectual property, and a locked device sounds like a large amount of it lost.

Neither assumption survives contact with the sector map. What matters at this density is not how much is stored but how the array is divided, because the division determines what a failure costs and what a partial recovery can still deliver.

The map, and why the first sector is still the only one that matters

The array is built from two sizes of block: a group of small sectors at the bottom and a run of large ones above them. The small ones exist so that the vector table and the protection word can be erased as a unit without destroying the application, and the large ones exist so that a big image can be erased quickly.

Everything about protection is decided by the small end. The control word sits at the end of the first sector, the vector table sits at the start of it, and the boot loader’s decision to run the application or wait for a command is made by reading four bytes inside it.

Region Size class Role Consequence if lost
sector 0 small vectors, checksum, protection word device will not boot and cannot be unlocked
sectors 1 to 7 small start of the application first functions lost, remainder orphaned
large sectors above large bulk of code and tables partial image, often still usable
top of array reserved factory boot loader must never be written

That last row is more dangerous at this density than at any other, because a full read of half a megabyte is exactly the kind of file somebody writes back without inspecting. The reserved region is not part of the product and writing over it costs the device its programming interface.

What a lock at this density actually protects

The same control word, with the same three values, producing the same four states described in LPC2101FBD48 protection states. Nothing about the mechanism scales with density.

What scales is the amount of code behind it, and that changes the commercial picture rather than the technical one. A half-megabyte image is unlikely to be entirely hand-written application logic; it usually contains a protocol stack, a file system, a display font set, or a table of measured calibration data. Those components have different values to different customers, and knowing which one is present shapes the recommendation.

A product whose array is mostly a font table is a product whose secret is small. A product whose array is mostly a protocol stack is a product whose secret is licensed from somebody else, and the customer may not have the right to have it recovered at all. Establishing which is which before quoting is part of the job.

Reading time changes the procedure

Half a megabyte through a serial port at a modest rate is not instantaneous, and the practical consequence is that a read should be done in one session rather than resumed across power cycles. A device that is power-cycled mid-read may return to the application, and the next sync has to start over.

Through the debug port the read is faster, and there the constraint is different: a long halt on a running product may trip a watchdog. On a device of this size the firmware is more likely to have one.

Neither issue is a problem in itself. Both become problems when the operator is not expecting them and starts improvising in the middle of a capture.

Partial recovery is where this density pays

With eight small sectors and a run of large ones, the loss of a single large sector still leaves most of the image. That is not true at the bottom of the family, where a lost sector is a lost eighth.

Two practical uses follow.

The first is targeted work. A customer who needs the calibration tables knows roughly where they are, usually in the upper half. Reading only the sectors that hold them is quicker, and it produces a smaller artefact with a clear boundary.

The second is salvage. A device with a failing sector at high addresses can still yield a coherent application if the damage is confined to data rather than code. Reporting which sectors are verified, which are reconstructed and which are missing, in the three-level form described in LPC2132FBD64 data recovery, is the difference between a useful salvage and a file nobody dares to use.

The parameter store at this size

Larger arrays tend to carry a larger settings block, and the top of the array very often holds it. On this device the store is still an emulated log built from erased sectors, and it is still the cheapest thing to recover and frequently the most valuable.

The structure is the same one described in LPC2119FBD64 parameter store work: records with markers and sequence numbers, compacted between sectors as they fill. At this density there is more room for history, which is good news, because a compaction that happened months ago may still leave the previous copy of every record intact in the sector that was not yet erased.

Looking for those older copies is a routine step, and it is the reason a device whose current settings are corrupt can still be restored.

When the array does not answer

Then the options narrow to the ones in LPC2104FBD48 erase behaviour, and the headline is unchanged at every density: the only route that clears the protection also clears the content, and the only route that preserves content does not go through the protection at all.

The difference at half a megabyte is the size of the loss, and the conversation with the customer should be proportionally more careful. Losing eight kilobytes of control loop is one thing. Losing a stack, a font set and three years of measured calibration is another, and the decision deserves to be made deliberately rather than in the middle of a procedure.

A short summary of the trade

The first eight kilobytes decide whether you can work at all. The rest decides how much of the product you can describe. On the largest part in the family those two facts are separated by four hundred and ninety-six kilobytes of distance, which is exactly why the small end deserves all of the caution and the large end deserves all of the patience.

Comments are closed.