R5F100BG tops the 32-pin row at 128 KB of code flash with 12 KB of RAM, the 8
KB data flash and eight converter channels in the same 5 by 5 mm HWQFN. It is
the largest program store the family offers without giving up the QFN, and it
is the capacity where the one-megabyte address space of the RL78 core starts
to matter to the work: images this large are built with far pointers and
banked segments, and the recovery tooling has to understand that layout or
the reconstructed binary will not run.

One megabyte of address space

The RL78 core addresses one megabyte through segment registers and far
pointers, and at 128 KB the compiler starts using them seriously. A recovered
image is not a flat array: it is segmented, with call and jump sites that
carry segment context. Tooling that flattens the image produces a binary that
disassembles plausibly and runs not at all, which is the classic failure mode
on members of this capacity. The block structure underneath stays simple,
one hundred twenty-eight one-kilobyte blocks, but the logical layout above it
does not.

Twelve KB of RAM and the update machinery

The volatile memory maps below the SFR area with the self-RAM window the
flash library reserves, and at 12 KB there is room for the library, the
update protocol and the application’s state simultaneously. Boards at this
capacity are built to be updated: the swap clusters at 00000H and 02000H are
populated, the boot flag flips across field versions, and the inactive
cluster preserves the previous image. Capturing both clusters is standard,
and the differences between them date and explain every field update the
unit received.

Protection posture

The four option bytes, the ten-byte debug ID at 000C4H to 000CDH, the
ten-byte serial ID at 000CEH to 000D7H and the shipped block protections are
as on every member. At this capacity the shield window is common, confining
updates to the blocks the update protocol touches, and the boot-area
protection is load-bearing. All of it is recorded during the capture, because
writing a repaired image back without the original security configuration is
the fastest way to lose the board on first boot.

The QFN and the last electrical mile

The 5 by 5 mm body keeps 0.5 mm wings on four sides and the bonded pad
underneath. Layouts vary in how much they expose, and the lift-and-reball
route is routine when nothing is routed. At 128 KB the serial readout takes
seconds and the verification is per-block, so the marginal-contact failure
mode is localised and obvious. The die remains available through the
IC decapsulation service route when the package is not recoverable electrically, and the
examination-level work belongs to the chip reverse engineering service flow.

Row context

The 32-pin siblings are in R5F100BA locked flash through R5F100BF memory dump. The 128 KB
die in other packages is the 36-pin row R5F100CG flash heximal and the 44-pin member
R5F100FG memory dump. Older
architectures that needed external memory or bank switching for this program
space are represented by MC68HC11E9 encrypted heximal, and the family service overview is
the MCU crack service page.

The first banked image in the 32-pin row

At 128 KB the program exceeds the core’s 64 KB logical window, and the
segment register that banks the upper address space becomes the central
fact of the image. One hundred twenty-eight erase blocks carry it, the
lowest four with the boot region and its mirror at 02000H, and the
application above them runs half in the default window and half banked.
Recovery work inherits the consequence: a capture is not a binary until
the segment assignments are preserved, and a rebuild that flattens them
produces a file that disassembles beautifully and executes nowhere. Every
tool in the flow, from the capture walker to the write-back path, treats
the segmentation as part of the image rather than an afterthought.

The peripheral budget is unchanged by the capacity: twenty-eight I/O
lines, eight converter inputs and six external interrupts serve the
same sensing and actuation plan as the smaller members, so the added
program space goes into functionality rather than pins. On a board
that pairs a banked 128 KB image with a compact sensing front end,
the code usually carries protocol and localisation layers the smaller
siblings could not afford, and recognising those layers in a
recovered image is straightforward once the windows are mapped.