The LPC2106FBD48 is the odd one in its family, and that is precisely why it is worth writing about. It carries the same 128 kilobytes of flash as the LPC2104 and LPC2105, and the same 60 MHz ARM7TDMI-S core, but it pairs them with 64 kilobytes of SRAM. Half as much RAM as flash, in a 48-pin package, in 2003, was an unusual statement: this part was meant to run code from RAM.

Designs that used it did so for buffering, for protocol stacks, and for routines that had to execute quickly without waiting on flash. That history changes the recovery problem, because on these boards part of the program may never have been in flash at all.

When the RAM is the program

A device with 64 kilobytes of SRAM can hold a complete application image. Some products built on this part load their main program from flash into SRAM at boot and then run entirely from there, erasing or overwriting nothing. Others keep a small resident loader in flash and pull the working code over a serial or CAN link from a host.

For recovery this means two separate questions. The flash image answers what the device was built with. The SRAM image at runtime answers what it was actually doing. On a board where the loader is minimal and the real program arrives over the wire, only the second question recovers anything useful, and the answer exists only while the device is powered.

The protection word and its limits

The word at 0x0000_01FC governs external access. With the read-protection value in place, the debug port closes and the ISP handler declines Read Memory, Write to RAM, Go and Copy RAM to Flash, while leaving a full erase of all user sectors available. Note what that set does not include: it does not stop the CPU from reading its own flash. Protection here is a rule enforced at the boundary, not an encryption of the array.

That distinction is what makes a small loader possible at all when the level permits it, and what makes the die-level route necessary when it does not. On a part with this much SRAM, a loader is comfortable, which is why the boundary is usually where these jobs are decided.

Getting the program back

1. Establish the revision and the protection level from the reset behaviour, without writing anything to the part.
2. Record a live boot: what the serial port emits, when the flash accesses happen, and whether control transfers to SRAM early.
3. If RAM execution is permitted, place a loader, run it, and read the flash in eight-kilobyte sectors with per-block verification.
4. For boards that run from SRAM, capture the loaded image while the device is executing, which is the only copy that exists.
5. If the boundary is closed, decapsulate and read the array and its ECC region directly, then rebuild.
6. Reconstruct the vector table, fix the checksum at 0x0000_0014, and prove the image on a reference board before handover.

Why the bigger RAM helps the recovery

A loader that fits in four kilobytes has to be terse. A loader that can use sixty-four can hold a complete sector in a buffer, compare two reads, and retry a failing block without touching the host. On a part that has been in service for two decades, that margin is the difference between one pass and three.

The same margin applies to verification: a full 128 kilobyte image fits in SRAM twice over, so a checksum can be computed on the device and compared before anything is transmitted. Details of the transfer formats are on the MCU crack service page, and the die-level route is described under firmware extraction service.

Sending one in

A photograph of the marking, the crystal value, and a note on whether the board boots. If the application loads code at runtime, mention it, because the recovery plan changes. The same array with less RAM is covered for LPC2104FBD48, the no-lead version of this part is described under LPC2106FHN48, and the smaller geometry is treated for LPC2103FBD48.

Authorisation

Recovery is performed on hardware the customer owns or is contracted to maintain, with that standing confirmed in writing first. The output is for repair and continued operation of existing equipment, not for the manufacture of a competing product. Requests outside that scope are declined, and the reasoning is recorded rather than left implicit. Package work is described under IC decapsulation service.