The LPC2210FBD144 has no flash memory at all. It is an ARM7TDMI-S microcontroller with sixteen kilobytes of SRAM, a 144-pin package, an external memory bus and a full set of peripherals, designed for systems where the program lives in a separate device on the board. That single fact changes the entire recovery problem, and it is the reason this part is treated separately from its siblings.

Everywhere else in the LPC2000 family the discussion is about the protection word and what the bootloader will allow. Here there is no on-chip array to protect, no protection word to read, and no ISP flash commands to refuse. The program is in a chip next to it, and the work is about that chip.

Where the code actually is

A board built on this part usually carries a parallel NOR flash, sometimes an SRAM for code shadowing, and sometimes both. The controller boots from the external memory according to the state of its boot configuration at reset, and from that moment the code is fetched over the external bus. The internal SRAM holds data, stacks and whatever the firmware copies in for speed.

So the first task is not decryption, it is inventory. Identify every memory device on the bus, read their markings, and establish which one the controller boots from. On older boards this is a 29-series or 39-series NOR device in a TSOP package, and on later ones it may be a small SRAM loaded by a host processor, in which case the program may never exist in non-volatile form on the board at all.

What protection means on a flashless part

Because there is no internal array, the familiar mechanism does not apply. The external device may have its own protection: sector lock bits on a NOR flash, a one-time-programmable region, or a boot-block lock. Those are properties of the memory chip, not of the controller, and they are dealt with by reading the device directly or by lifting it.

The controller contributes two things to the problem. It may be configured to fetch from external memory only, in which case a substitute board has to match the bus timing exactly. And its own SRAM contents at runtime are the only place where decrypted or decompressed code exists, which makes a live capture valuable on designs that shadow code into SRAM before running it.

Retrieval sequence

1. Inventory every memory device on the board: type, package, marking, and which chip select it answers on.
2. Establish the boot configuration from the board, not from the schematic, since strapping resistors are often changed during production.
3. Read the external flash directly where it can be accessed in circuit, or lift it where bus contention makes that unsafe.
4. Reconstruct the image in the address space the controller expects, respecting any bank configuration the firmware relies on.
5. Where code is copied into internal SRAM at boot, capture it live and keep it as a second reference for the external image.
6. Verify by running the reconstructed image on an equivalent board with the same memory timing.

What comes back

An image of the external non-volatile memory in the address space the controller uses, a binary of any SRAM-resident code captured at runtime, and a written note on the boot configuration and bus timing needed to reproduce the board. That note is essential: an image that is correct but programmed into a device with different timing will not boot. The wider process is on the firmware extraction service page, and physical access under IC decapsulation service.

Before sending a board

Photograph every memory device, note the crystal and the boot strapping, and say whether the board still starts. Boards that still run are strongly preferred here, because the SRAM capture is only possible while the device is executing. The flash-carrying version of this package is covered for LPC2212FBD144, the larger one for LPC2214FBD144, and the other flashless member under LPC2220FBD144.

Authorisation

Retrieval is carried out on equipment the customer owns or is contracted to maintain, confirmed in writing before any device is lifted. The output supports repair and spares for installed systems. It is not a route to reproducing another company’s product, and requests that amount to that are refused with the reason stated.