Sixteen kilobytes of flash and four kilobytes of SRAM, in the same 48-pin body as its smaller and larger brothers: the LPC2102FBD48 sits in the middle of NXP’s entry LPC2000 trio and inherits both of their constraints. The core runs to 70 MHz, the flash is organised in four-kilobyte sectors, and the whole array is available to the application because the boot block lives at 0x7FFF_E000 rather than inside the map.

It is a common part in appliance control boards, small inverters and access-control readers, usually with a serial port on the edge of the PCB and nothing else exposed. Unlocking one usually means getting back a program that no longer exists anywhere else, on a board that must keep working afterwards.

The SRAM budget is the real limit

Everything that can be done without opening the package depends on how much code can be made to run from SRAM. On this device that budget is four kilobytes, and the stack, the buffers and the loader all come out of it. A routine that reads flash and pushes bytes out of a UART needs perhaps two kilobytes if it is written tightly, which leaves very little room for error and none for a comfortable protocol.

That is why the approach is chosen after measuring, not before. If the protection level in use still permits writing to RAM and jumping to it, a small loader is the cleanest path and the part stays intact. If it does not, the answer is on the die, and the SRAM question stops mattering.

Which level is set, and how it is read

The protection word lives at 0x0000_01FC. Four values are defined across the family: 0x4E69_7370 for the no-ISP case, 0x1234_5678, 0x8765_4321 and 0x4321_8765. Each one closes a different set of doors. Under the strictest setting the ISP port will not accept a jump into RAM at all, and under the no-ISP setting the part will not even sample the pin that would put it into the bootloader, so the board boots straight into the application no matter what is held low at reset.

Deciding between these is not guesswork. The behaviour at reset, the return codes on the serial line and the response of the debug port together identify the level without writing anything. Writing the wrong value while experimenting is how devices are lost, so the identification step is done with the flash untouched.

Working through an LPC2102FBD48

1. Document the board first: supply rails, reset topology, crystal frequency, and whether the ISP pin is pulled in a way the bootloader will see.
2. Capture the reset sequence on the serial port to see whether the bootloader answers and which commands it accepts before any protection error appears.
3. If RAM execution is still open, build a loader that fits well inside four kilobytes, place it through the bootloader and let it stream the flash out in small blocks with a checksum on each.
4. If RAM execution is closed, go to the package: decapsulate, locate the array and its ECC region, and read the sectors in order, keeping the correction bytes alongside the data.
5. Reconstruct the vector table and recompute the word at 0x0000_0014 so the image will start on a clean device.
6. Verify by running the rebuilt program on an equivalent board and comparing peripheral behaviour, not just the checksum of the file.

Deliverables and the shape of the file

The handover is a HEX file with an address map, a report of which of the four sectors held code and which were blank, and a statement of the protection level found. Blank sectors are reported rather than filled with zeros, because on this part a zero-filled block and an erased block mean different things to the bootloader. The microcontroller unlock service page covers the general case, and the vector-table rebuild is described there in more detail.

What to include with the shipment

A photograph of the part marking, the crystal value, and a note on whether the board is expected to run afterwards. If the device is already dead, say so, because a part that no longer boots narrows the diagnosis to the supply or the reset circuit before any memory work begins. Related work on the same die family is described for LPC2101FBD48 and LPC2103FBD48, and the step up to the eight-kilobyte sector geometry is covered under LPC2114FBD64.

Authorisation

Recovery is offered for equipment the customer owns or has a documented right to repair. Ownership or a service contract is confirmed before the part is touched, and the confirmation stays with the job file. Nothing recovered is reused in another product, and the same rule applies to every request that arrives through microcontroller unlock.