R5F100CG tops the 36-ball wafer-level row at 128 KB of code flash with 12 KB
of RAM, the 8 KB data flash and eight converter channels in the 4 by 4 mm
package. It is the largest program store the family puts under a ball grid
at this size, and like every member at this capacity it is built around the
one-megabyte segmented address space of the RL78 core, which the recovery
tooling has to respect when the image is reconstructed.

Segmented images at 128 KB

Above one hundred twenty-eight blocks the image stops being flat. The
core reaches its megabyte through a segment register that banks the upper
space, and firmware at this capacity lives half in the default window and
half in banked code and tables. Reconstruction that ignores the banking
produces a binary that looks finished in a disassembler and never
executes, so the capture preserves block boundaries and the rebuild
carries the window assignments end to end.

Twelve KB of RAM and the update zone

Twelve kilobytes host the library, the updater and the application
together, and the reservation at the top of that space marks a build
that updates itself. Both boot copies are populated on maintained
boards, the flag byte names the live one, and the retired copy keeps the
firmware generation the unit shipped with. Their difference is the
update record, and it costs nothing extra to collect.

The 8 KB data flash as a log

At this capacity the separate data array is the 8 KB version, and firmware
uses it for long-lived records: fault histories, calibration generations,
usage counters. Recovering it with the data-flash command set, alongside the
code array, is standard, and the wear-levelled structure inside it dates the
unit’s service life in a way the code cannot. Ordering matters when
reading it: the allocation map near the front of the array says which
records are current and which were retired, and a dump taken without
that map looks self-contradictory when it is merely historical. On a ball
package, where a second session is expensive, that ordering discipline
is not optional.

Protection posture

The first kilobyte decides everything about how closed the chip is: four
option bytes with the debug gate and its wipe-on-failure choice, and the
two ten-byte identifiers for the two programming tools. The shield
window, common here, confines field updates to chosen blocks and is
recorded with the capture. Writing a repaired image back without the
original window and protections is a classic way to turn a recovered
board into a non-starter.

Access under the 4 by 4 body

Thirty-six balls at 0.5 mm pitch take a sprung-pin fixture when the layout
allows it, and the lift-and-reball route is routine when it does not. The
part survives the lift and returns to service, which matters when the
original unit must go back into the field. The die remains reachable through
the IC decapsulation service route when the package is the obstacle, and the broader
project handling is the chip reverse engineering service flow.

Row context

The 36-pin siblings are in R5F100CA flash memory through R5F100CF locked flash. The 128 KB
die in other packages is the
32-pin QFN R5F100BG flash data and the 44-pin R5F100FG memory dump. Cross-architecture
notes on handling large segmented images from an earlier generation are in
MC9S08DZ128MLF encrypted microprocessor, and the family service entry is the MCU crack service page.

Banked constants in a thirty-six ball part

At 128 KB this member’s application code spans the core’s banked address
space, and the constant tables, localisation strings and lookup curves
typically occupy the upper windows. That arrangement has a practical
consequence for any capture: the upper half of the array changes rarely,
so its checksums are stable across firmware revisions and serve as
anchors when comparing two generations of the same product. A capture
that preserves bank boundaries keeps those anchors meaningful, and the
write-back path for a repair needs them intact to place patched code
where the running image expects it. The doubled data store also
arrives as standard at this capacity, its extra room going to fault
logs and calibration revisions rather than to anything structural,
and on a ball package the second session costs far more than the
first, so it is never skipped.