One hundred and twenty-eight kilobytes of flash, sixteen of SRAM, forty-seven I/O pins, and a pair of ten-bit converters feeding sixteen analog inputs: the LPC2134FBD64 is where the LPC213x line stops being a general-purpose controller and starts being a measurement device. The core is the same 60 MHz ARM7TDMI-S, the package is the same 64-pin LQFP, and the supply is a single 3.3 volts.

These parts are found in analysers, transmitters, weigh systems and medical front ends, where the converter configuration is as much a part of the product as the code that reads it. Recovering the flash is the visible half of the work; understanding what the converters were told to do is the half that decides whether a rebuilt unit measures the same numbers.

Two converters, one timebase

The two converters on this device can be triggered from the same source, so samples arrive together rather than in sequence. That arrangement is chosen when the difference between two channels carries the meaning, and it leaves a fingerprint in the program: a shared trigger configuration, a fixed order of result registers, and arithmetic that subtracts one reading from another before anything else happens.

When the image is recovered, that structure is what has to be recognised. A binary alone does not tell anyone that channel three is subtracted from channel five; the initialisation sequence and the table of scaling constants do. Reading them out and documenting them is the difference between a file and a working instrument.

Protection on this device

One word at 0x0000_01FC, read by the bootloader at reset. With read protection in place the JTAG port closes and the ISP handler refuses Read Memory, Write to RAM, Go and Copy RAM to Flash; erase survives, but only as an operation across all user sectors. The array is not encrypted, and the core reads it without hindrance, so the restriction is entirely about what can be asked from outside.

What that leaves is a choice between two routes, and the choice is made from evidence. If a jump into SRAM is still accepted, a loader placed there reads the array from within. If every command returns the protection error, the package has to be opened and the array read physically, with the ECC bytes that sit beside each sixteen-byte group taken out at the same time.

Recovery sequence

1. Confirm the type from the die, since the package is shared across the family and the converter count is not visible from outside.
2. Record the reset dialogue and the debug port behaviour to establish the protection level before any write.
3. Recover the array by the route the level allows, in blocks that follow the physical sector boundaries rather than arbitrary chunk sizes.
4. Rebuild the vector table and recompute the checksum at 0x0000_0014, then prove the image boots on a replacement part.
5. Extract the converter configuration: trigger source, channel order, result scaling, and any digital filtering constants.
6. Verify against the original board by comparing readings on a known input, not by comparing file checksums alone.

What is delivered

A HEX file and a binary, a sector map, and a written description of the measurement path: which channels are sampled together, how results are scaled, and where the calibration constants live in flash. For an instrument that is often more useful than the binary, because it lets a replacement board be validated before it is fitted. The recovery method is described on the MCU crack service page, and package access under IC decapsulation service.

Sending a unit

Photograph the marking, note the crystal and the analog front end, and state whether the instrument still measures. A live unit allows the converter readings to be captured as a reference, which is the fastest way to validate a copy. The parts either side of this one in the family are covered for LPC2132FBD64 and LPC2136FBD64, and the smallest member under LPC2131FBD64.

Authorisation

Recovery is performed on equipment the customer owns or is contracted to maintain, confirmed before the package is opened. The results support repair, spares and long-term maintenance of instruments already in the field. Requests aimed at reproducing another manufacturer’s product are declined, and the reason is put in writing rather than left to inference. General terms are on the firmware extraction service page.