The LPC2101FBD48 is the smallest member of the LPC2000 line: an ARM7TDMI-S core at up to 70 MHz, eight kilobytes of flash and two kilobytes of SRAM in a 7 by 7 millimetre LQFP48. NXP built it for designs that needed a 32-bit core but had been living with an 8-bit budget, so the part carries almost no margin anywhere. That is what makes it interesting when the firmware has to come back out. There is no spare kilobyte to hide a loader in, no second bank to fall back on, and no external bus to watch.

Most of these devices sit in small motor drives and metering front ends, running code written years ago by an engineer who has since left. When the source is gone and the board still has to be serviced, the question is not whether the flash can be read but whether it can be read without destroying the only copy.

Two sectors, and one of them is the whole decision

NXP organised the flash on the LPC2101 as four-kilobyte sectors. Eight kilobytes means sector 0 at 0x0000_0000 and sector 1 at 0x0000_1000, and that is the entire array. The boot block sits outside it, at 0x7FFF_E000, so all eight kilobytes belong to the application, which is unusual in this family and worth remembering.

The consequence is that any operation phrased as “erase sector 0” is phrased as “erase half the firmware”. An unlock attempt that half-succeeds on a 512 kB device leaves most of the image intact; the same attempt here leaves four kilobytes of the program missing, and the vector table with it. Protection on this part is not a wall to climb, it is a single switch with no middle position.

What the word at 0x1FC actually does

Code Read Protection on the LPC2100 family is one 32-bit word stored at address 0x0000_01FC, inside sector 0, in the space left free so that the FIQ handler can still be placed at the top of the vector region. The bootloader reads it on every reset. With 0x8765_4321 written there, the part disables the JTAG debug port and the external memory boot path, and refuses the ISP commands that matter: Read Memory, Write to RAM, Go, and Copy RAM to Flash. Erase still works, but only as a full-chip erase of all user sectors.

Parts marked Revision A and later add the finer three-level scheme with 0x1234_5678 and 0x4E69_7370, which is why two boards that look identical can behave differently. On the earlier silicon there is no partial level at all, and the only routes left are the two that do not go through the bootloader.

How an LPC2101FBD48 is recovered in practice

1. Read the marking and the date code, then confirm from the die which silicon revision is present. The revision decides whether a bootloader-level route exists at all, so it is checked before anything is powered.
2. Bring the board up on a bench supply with the reset line under control and capture the first hundred milliseconds of activity on the serial port, so the ISP handshake and the boot behaviour are documented rather than guessed.
3. Decapsulate the package and expose the flash array. On a 48-pin LQFP with this die size the access window is small, and the ECC array beside the main array has to be located before any read is attempted.
4. Read the array in four-kilobyte blocks and keep the ECC bytes with the data. This part stores one ECC byte for every sixteen bytes of user flash, and a read that ignores it produces a file that looks correct and verifies wrong.
5. Rebuild the image with the vector table at 0x0000_0000 and the checksum word at 0x0000_0014 recalculated, because the bootloader will not start code whose first eight vectors do not sum to zero.
6. Compare the rebuilt image against a second read from a different angle, then run it on a reference board before it is handed over.

What comes back

A binary and an Intel HEX file covering 0x0000_0000 to the end of the used area, a memory map that marks which sectors were programmed and which were blank, and a note on the silicon revision that was actually found. Where the ECC layer had to be reconstructed, that is stated explicitly rather than hidden behind a clean checksum. Further detail on the process is on the firmware extraction service page, and the package work is described under IC decapsulation service.

Before the board is sent

Photograph both sides of the PCB, note whether the part has been reworked before, and say whether the device still runs. A working board is worth more than a dead one because the boot behaviour can be recorded first. If the plan is to clone the design rather than repair it, the same silicon work feeds LPC2102FBD48 and LPC2103FBD48, which share the die family and the same four-kilobyte sector map, while LPC2104FBD48 moves to the larger eight-kilobyte geometry.

Authorisation

Work starts only on equipment the customer owns or is contracted to repair, and the written confirmation is kept with the job. The output is a file for maintenance and legacy support; it is not a route to copying someone else’s product. Requests that cannot show that standing are declined, and the reasoning is given in writing so that nobody has to guess later. For the wider service list see MCU crack service.