The R5F100BD keeps the 5 by 5 mm 32-pin HWQFN of its row and raises the code
flash to 48 KB with the 3 KB RAM that marks the 48 KB class, the 4 KB data
flash and eight converter channels. Its claim to attention in recovery work
is the flash shield window: the family’s mechanism for confining every erase
and write of a self-programming session to a range of blocks the author
chose in advance. Boards that use it are common at this capacity, and the
window’s boundaries are part of what a complete image has to record.

What the shield window does

During self-programming, the sequencer accepts erase and write commands only
inside a configured window of blocks; outside it, commands fail. The
protections outside the window are what stand between a buggy updater and a
destroyed image, and Renesas ships the family with block protection enabled
so that the window has to be established deliberately. On a recovered board,
the window settings are visible in the update routine’s calls, and they say
precisely which blocks the author expected to change in the field. Everything
outside them was meant to be permanent.

Forty-eight blocks and the RAM that runs the library

The 48 KB array divides into forty-eight one-kilobyte blocks with the boot
cluster in the first four and the swap target at 02000H. The 3 KB of volatile
memory maps to FF300H through FFEFFH, and the flash library’s self-RAM
window on these parts starts at FF300H. That arrangement lets the update
code run from RAM while the array is busy, and it is visible in any recovered
linker map as a hard reservation at the top of memory.

Boot swap at this capacity

Eight percent of a 48 KB array is a reasonable price for a safe update path,
so the swap feature appears often here. Both clusters carry option bytes and
identifiers at 010C0H and 010C4H, the boot flag in block 0 picks the live
set, and a board that has seen field updates holds two firmware generations.
The differences between the clusters reconstruct the update history, and the
wear counters in the data flash date it. Capturing one cluster is a partial
job; capturing both plus the flag is the standard.

Reading around the window

Reads are never blocked by the shield window or by the block protections:
they gate erase and write only. A readout therefore proceeds normally, and
the window’s configuration matters afterwards, when a repaired image is
written back. Writing back without re-establishing the window and the block
protections exactly as found is how a recovered board dies on its first boot,
so the capture includes the security configuration as a separate artifact.

The converter and the QFN bench

Eight channels reach the pins, the standard spread for the 30 to 36-pin
members. On the bench the QFN’s 0.5 mm wings and bonded centre pad set the
access options: layout test features first, lift-and-reball second, and the
die as the last resort through the IC decapsulation service route. The single-wire TOOL0
pad on P40 is the pin most worth finding on the layout, because the serial
path it opens is the one that authenticates with the ten-byte identifier at
000CEH rather than the debug path that can erase on failure.

Row context

The 32-pin siblings are in R5F100BA locked flash, R5F100BC flash heximal, R5F100BE embedded memory,
R5F100BF memory dump and R5F100BG flash data; the leaded 48 KB equivalents are the
30-pin R5F100AD code flash extraction and the 24-pin R5F1007D locked flash. The swap mechanism at
the family level is described in the second article on the 44-pin 64 KB
member, R5F100FE boot cluster recovery, and the general service workflow is on the
MCU crack service page.

Duplicating a security posture across clusters

When the swap feature is enabled, the security configuration must exist in
both boot copies: the option bytes repeated at 010C0H and the ten-byte
identifiers repeated from 010C4H, with the chip treating each pair as a
set. Production programmers handle this automatically; hand-rolled field
updaters frequently do not, and a board whose two copies disagree is
diagnostic gold. The disagreement localises the last update attempt, and
the direction of the mismatch, which side is newer, tells whether the
updater died before or after the flag inversion that would have completed
it.