Five hundred and twelve kilobytes of flash in an ARM7 microcontroller, with thirty-two kilobytes of SRAM, two ten-bit converters, an analog output and 47 I/O pins in a 64-pin LQFP. The LPC2138FBD64 is the largest member of the LPC213x family and, for a while, one of the largest flash devices available in a part that was still a microcontroller rather than a system.

Designs that used it did so because the program had grown past a quarter of a megabyte: graphical interfaces, file systems in flash, multiple protocol stacks, or several product variants sharing one binary. Clone work on a device of this size is less about reading the array quickly and more about reading it in a way that can be checked.

Half a megabyte is not a uniform array

The first part of the map is divided into eight-kilobyte sectors; further up, the array switches to sixty-four kilobyte sectors; and the top is reserved for the bootloader. A tool that counts sectors from zero and assumes a constant size will miscalculate the address of everything above the changeover.

The reserved region at the top is easy to overlook when an image is examined in a hex viewer, because the last user sector does not end at the highest address the map allows. Anything written there by a rebuild is rejected by the next programming cycle, and the failure appears as a verification error rather than as a layout mistake.

Erase timing follows the same division. A sixty-four kilobyte sector takes substantially longer than an eight-kilobyte one, and the bootloader reports progress per sector, so a long pause at a high sector number is normal rather than a hang. Reading, by contrast, is uniform, which is why the recovery route is planned around reads and never around erases.

What the protection word governs

At 0x0000_01FC the bootloader finds the setting it will apply. Under read protection the debug port is closed and the ISP handler refuses Read Memory, Write to RAM, Go and Copy RAM to Flash, leaving a full erase as the only accepted operation. Since a full erase on this device removes half a megabyte in one command, no recovery plan may include one.

The alternative routes are the two that do not pass through the bootloader: code executing inside the device, or a physical read of the array. Which one applies is decided by the device’s responses at reset, and that identification is complete before any write is attempted.

Cloning an LPC2138FBD64

1. Confirm the type from the die: the 64-pin package is shared across the family and only the array size separates this part from its neighbours.
2. Fix the protection level from the boot dialogue and the debug port response, with the flash untouched.
3. Read the array in blocks aligned to the real sector boundaries, keeping the ECC association for each sixteen-byte group.
4. Verify each block twice by different paths before transmission, since a single bad block in half a megabyte is easy to miss and expensive to find later.
5. Rebuild the vector table, restore the checksum at 0x0000_0014, and reproduce the original sector layout in the linker script.
6. Prove the image on an equivalent device and compare runtime behaviour, not only the checksum of the file.

The delivered image

A HEX file whose records follow the true geometry, a binary, and a map that marks the boundary between the uniform region and the large-sector region as well as the reserved top. Where the application uses part of the array as a file system, that area is labelled, because restoring over it silently destroys stored data. Method notes are on the IC clone service page, and package work under IC decapsulation service.

Shipment notes

Give the crystal value, the supply arrangement, and whether the board still runs. On a device this size it also helps to know whether the program was ever updated in the field, since a field-updated unit may hold a different build from its siblings. The part below is described for LPC2136FBD64, the USB variant for LPC2148FBD64, and the mid-family device under LPC2146FBD64.

Authorisation

Cloning is carried out on equipment the customer owns or maintains under contract, confirmed in writing before the package is opened. The result exists to keep installed machinery serviceable and to provide spares from a known-good image. It is not a means of reproducing another company’s product, and requests to that effect are declined with the reasoning stated. The broader scope is on the MCU crack service page.