One hundred and twenty-eight kilobytes of flash, sixteen of SRAM, USB 2.0 full-speed, two ten-bit converters covering fourteen analog inputs and a single ten-bit output, in the 64-pin LQFP that carries the whole LPC214x family. The LPC2144FBD64 sits in the middle of that family and is the part most often used when a USB device also has to measure something.

Data loggers, instrument interfaces, USB-to-analog adapters and test fixtures are built on it. Dumping the firmware from one is a job where the array is only part of the answer: the measurement path and the USB interface are what the product actually is.

Fourteen inputs and one output

The second converter is what distinguishes this part from the two below it in the family, and it is normally used for a second group of channels rather than for simultaneous sampling of the first. The program’s initialisation sequence shows which converter is triggered from where, and the result registers show the order in which values are read.

Because fourteen inputs are more than most single products need, the extra channels are often brought to a connector and selected in firmware. That selection logic lives in a table, and the table is what an engineer needs when a unit arrives with no documentation and several sensors attached.

The USB side of this part has two kilobytes of endpoint RAM, which is enough for a handful of bulk and interrupt endpoints and not enough for anything clever. Firmware written for it therefore uses short transfers and a simple state machine, and that simplicity is an advantage during recovery: the descriptor table, the endpoint configuration and the buffer sizes all fit in a few dozen bytes of the image, and once they are found the interface can be described completely.

What the dump cannot supply is the host-side behaviour, so a working unit is asked to enumerate against a known host before the package is opened. The traffic that results confirms which endpoints are actually used as opposed to merely declared. That distinction is the difference between a list of endpoints and an interface specification.

Protection, and why the dump is not a read command

The bootloader consults the word at 0x0000_01FC at reset. With read protection active the debug port is closed and the ISP handler refuses Read Memory, Write to RAM, Go and Copy RAM to Flash; an erase of all user sectors is still accepted. Nothing about the array is encrypted, and the core accesses it normally.

So the dump either happens from inside, using code the device is willing to run, or it happens at the die. The first route depends on the level still permitting execution from SRAM; the second does not depend on the device’s cooperation at all, but requires the package to be opened and the array read with its correction bytes.

Dumping an LPC2144FBD64

1. Confirm the type and revision from the die, since three parts share this package with different converter configurations.
2. Capture the reset behaviour and the ISP refusals to establish the protection level before any write.
3. Use the SRAM route where permitted, reading in sector-aligned blocks with a checksum on each.
4. Otherwise decapsulate and read the array directly, keeping the ECC association for each sixteen-byte group intact.
5. Rebuild the vector table and the checksum at 0x0000_0014, and prove the image on a substitute part.
6. Extract the channel-selection table, the scaling constants and the USB descriptor set, and document all three.

What the dump includes

A HEX file, a binary, an address map that marks code, parameters and blank sectors, and a written summary of the measurement path and the USB interface. The summary is what allows a replacement board to be checked against a known input rather than merely powered up. The method is set out on the firmware extraction service page and the package side under IC decapsulation service.

Before shipping

Note the crystal, the sensors connected, and whether the unit still enumerates and measures. A working unit lets the channel table be confirmed against observed readings, which removes the main uncertainty in a fourteen-input design. The parts below are covered for LPC2142FBD64 and LPC2141FBD64, and the storage step up for LPC2146FBD64.

Authorisation

Dumping is carried out on hardware the customer owns or is contracted to maintain, confirmed in writing before any package work. The output serves repair, spares and documentation of equipment already in service. It is not a route to reproducing another company’s product, and requests that amount to that are refused with the reasoning recorded. General terms are on the microcontroller unlock service page.