R5F100GG pushes the 48-pin row to 128 KB of code flash with 12 KB of RAM and
the 8 KB data array, ten converter inputs and forty-four I/O unchanged in
the 7 by 7 mm LFQFP. The capacity matters for a structural reason: 128 KB is
twice the 64 KB logical window of the core, so this is the first 48-pin
member whose image cannot be addressed without segmentation, and that fact
reaches into every stage of a recovery, from how the capture is walked to
how the rebuilt binary is assembled.

One hundred twenty-eight blocks, one image, two windows

The array holds one hundred twenty-eight erase blocks of one kilobyte, with
the boot region in the lowest four and its mirror from 02000H. Above the
update zone the image is flat on the flash but not in the core: the CPU sees
64 KB at a time and reaches the rest through a segment register that banks
the upper address space. Firmware at this capacity lives half in the default
window and half in banked code and constant tables, so a capture is verified
block by block and then reassembled with its segmentation intact; flattening
the image produces a binary that looks right in a disassembler and never
runs.

Twelve kilobytes of working memory

The volatile memory carries the flash library, the field-update protocol and
the application’s buffers side by side, and the library’s reserved workspace
at the top of RAM is visible in any linker map recovered from the image. The
region is equally useful on the readout side: a streaming walker resident
below the reservation can serve blocks continuously while the sequencer owns
the array. Field-update designs at this capacity keep both boot copies
populated, and the flag byte in the first block records which generation is
live, which is how a capture dates the unit’s update history without any
external evidence.

Security as a pair of secrets and a gate

The emulator asks for one ten-byte secret, the serial programmer on TOOL0
asks for another, and the option byte that governs debugging also decides
what a wrong answer costs, up to and including an automatic wipe of the
array. Both secrets live in the first kilobyte alongside the vectors, which
makes that block the single most informative kilobyte on the chip: its
contents reveal the protection posture, the update configuration and the
reset vectors in one read. Passive capture of that block, before any tool is
attached, remains the opening move of every job here.

The data array and the industrial profile

The 8 KB data store holds the calibration revisions, fault histories and
usage counters that industrial firmware accumulates, protected by its own
flags and read with its own command set. With forty-four I/O, nine of them
open-drain six-volt-tolerant lines, and ten converter inputs, the member
drives relay banks and senses mains-synchronous signals in one package, and
the parameters that make that possible live in the data array as much as in
the code. A rebuilt controller gets both or it regulates like a stranger to
its own board.

The bench

A leaded 0.5 mm pitch keeps fixture work practical: the single-wire pad, the
UART pair and the regulator capacitor pin are usually reachable, and when
they are not, the part lifts and re-balls onto an adapter with little risk
at this body size. Only a damaged or deliberately obfuscated die sends work
to the physical layer, which is the IC decapsulation service route. The streaming capture
flow is described on the firmware extraction service page.

Context

In the 48-pin row the member below is R5F100GF embedded memory and the row begins at
R5F100GA memory readout; capacities above step toward the half-megabyte
R5F100GL firmware decryption. The same 128 KB die in smaller packages is the 32-pin
R5F100BG flash data and the 44-pin R5F100FG memory dump. Segmentation discipline from
an older architecture is compared in MC9S08DZ128MLF encrypted microprocessor.

What the two windows mean for tools

Host-side tooling is where segmentation bites. A reader that assumes a
flat 64 KB binary silently drops the upper window, and a writer that
ignores bank boundaries corrupts the call sites that cross them, both
failures invisible until the chip is back on its board. Working at this
capacity means the toolchain, capture, assembly and write-back, is
bank-aware end to end, and the 12 KB of volatile memory that hosts a
generous in-circuit walker is what makes the verification loop quick
enough to run on every session rather than only the careful ones.