Two hundred and fifty-six kilobytes of flash, sixteen kilobytes of SRAM, four configurable external banks and 144 pins. The LPC2214FBD144 is the workhorse of the LPC2200 line: enough on-chip memory to hold a real application, and enough bus to attach whatever else the system needs.

Dumping the program from one of these is routine until the external banks are taken into account. On this package it is common for the internal array to hold the application while an external SRAM holds working data and an external flash holds a second copy, a configuration table, or a set of language resources. The dump has to account for all of it.

What the bank registers tell you

Each external bank has a configuration register that sets its width, its wait states and whether it is enabled. Those registers are written early in the boot sequence, and the values chosen describe the hardware around the controller precisely: an eight-bit device with three wait states is a slow peripheral, a thirty-two-bit device with one is fast memory.

Reading those writes out of the recovered image therefore produces a description of the board, which is useful when a unit arrives with no schematic. It also tells you whether the external devices matter to the program or are only used for bulk storage, and that decides how much of the job is flash recovery and how much is bus archaeology.

Bank configuration is also where a recovered image most often fails to reproduce a board. Two designs can use the same devices with different wait states, and the difference is invisible until the board is asked to run at temperature or with a marginal memory part. The values found in the image are recorded verbatim for that reason, rather than being replaced with faster settings that happen to work on the bench.

Protection on this device

The bootloader reads the word at 0x0000_01FC at reset. Under read protection the debug port closes, the ISP handler refuses Read Memory, Write to RAM, Go and Copy RAM to Flash, and only a full erase of all user sectors is accepted. The same setting also disables external memory boot, so a protected part will not start from the bus regardless of how the board is strapped.

Since the flash here is a quarter of a megabyte, that single accepted command is the end of the program. Nothing in the procedure may issue an erase. Recovery is either from code running inside the device, where the level permits it, or from the die after decapsulation.

Dumping an LPC2214FBD144

1. Inventory the external devices and their bus widths, then record the strapping that selects the boot source.
2. Establish the protection level from the boot dialogue and the debug port response, with the flash untouched.
3. Recover the internal array in sector-aligned blocks, verifying each block twice before transmission.
4. Read any external non-volatile device in use, and record the bank configuration that addresses it.
5. Rebuild the vector table and the checksum at 0x0000_0014, and reproduce the bank settings in the recovered image.
6. Prove the dump on an equivalent board with the same external memory and the same timing.

What the dump contains

A HEX file for the internal flash, images of the external devices, and a written description of the memory map as the firmware builds it: bank widths, wait states, and which regions hold code as opposed to data. For a 144-pin design that description is what makes the images reproducible. The method is on the firmware extraction service page and the physical access under chip reverse engineering service.

Before shipping

Photograph every memory device, note the crystal and the boot strapping, and say whether the board still starts. If the external memory can be read separately before shipping, include those files as a cross-check. The smaller array is covered for LPC2212FBD144, the flashless variant for LPC2220FBD144, and the four-bus version under LPC2294HBD144.

Authorisation

Dumping is performed on equipment the customer owns or is contracted to maintain, confirmed before any package work begins. The output is for repair, spares and documentation of installed systems. It is not a means of reproducing another manufacturer’s product, and requests that would require that are declined with the reason put in writing.