The LPC2141FBD64 is the smallest part in NXP’s USB-equipped LPC2000 line: 32 kilobytes of flash, 8 kilobytes of SRAM, a USB 2.0 full-speed device controller with 2 kilobytes of endpoint RAM, and a single ten-bit converter with six analog inputs. The core is the familiar 60 MHz ARM7TDMI-S and the package is the 64-pin LQFP the family uses throughout.

Eight kilobytes of SRAM next to a USB stack is a tight arrangement, and the designs built around it show the strain: small endpoint buffers, short control transfers, and firmware that does one job at a time. Copying the firmware out is straightforward in principle; the interesting part is recovering the interface definition that the host expects.

The descriptor is part of the program

Every USB device announces itself with descriptors: vendor and product identifiers, the configuration, the interfaces, and the endpoints with their transfer types and packet sizes. Those bytes are compiled into the firmware, so they come back with the array. What does not come back automatically is their meaning, and without it a copied board enumerates and then fails to work with the original host software.

Reading the descriptors out and writing them down is therefore part of the job rather than a bonus. It also gives an independent check on the image: a device that claims two bulk endpoints in its descriptor table should show two configured endpoints in the code that initialises them.

Suspend and resume behaviour is worth recording for the same reason. A device that draws a specific current in suspend, and wakes on a defined event, is telling you how its clock tree is configured. Those settings are in the image, but confirming them from the outside first makes the code easier to read afterwards.

Protection and the endpoint RAM

The setting word sits at 0x0000_01FC and is applied by the bootloader at reset. Read protection closes the debug port and makes the ISP handler refuse Read Memory, Write to RAM, Go and Copy RAM to Flash, leaving an erase of all user sectors as the only accepted command. The array itself is plain flash and the core reads it normally.

One consequence of the small SRAM is worth stating: a loader that runs from RAM has eight kilobytes to work with, and part of that is needed for the transport buffers. It is workable, but only with a reader written for the constraint. On the larger members of the family the same code is comfortable; here it is not, and that shapes the order in which blocks are read.

Copying an LPC2141FBD64

1. Confirm the type and revision from the die, since the package and pinout are shared with parts that have more flash and a different converter set.
2. Capture the boot dialogue to establish the protection level before anything is written.
3. Where execution from SRAM is permitted, load a compact reader, read the array in sector-sized blocks, and checksum each before sending.
4. Where it is not, decapsulate and read physically, retaining the ECC bytes for each sixteen-byte group.
5. Rebuild the vector table and the checksum at 0x0000_0014, then confirm the image starts on a replacement device.
6. Extract and document the USB descriptor set, the endpoint configuration, and the class requests the firmware answers.

What is handed over

A HEX file, a binary, a sector map, and a written interface summary covering the USB descriptors and the endpoints in use. For a product whose host software cannot be changed, that summary is the part that makes the copy usable. The general method is described on the firmware extraction service page, and the package access under IC decapsulation service.

Before sending a board

Photograph the marking, note the crystal and the USB connector wiring, and say whether the device still enumerates. A unit that still enumerates allows the descriptor set to be read from the host side as well, which is the cleanest possible confirmation. The next parts up are covered for LPC2142FBD64 and LPC2144FBD64, and the non-USB equivalent of this memory size under LPC2131FBD64.

Authorisation

Copying is performed on hardware the customer owns or is contracted to maintain, and that standing is confirmed before the package is opened. The result supports repair and spare production for equipment already installed. It is not provided for the manufacture of a competing product, and requests that imply otherwise are refused with an explanation. Terms are set out under IC clone service.