Doubling the flash on the LPC2114 does not simply double a number: the LPC2124FBD64 carries 256 kilobytes, and past the first sixty-four the array stops being uniform. The first eight sectors are eight kilobytes each, the remainder is divided into sixty-four kilobyte sectors, and the top of the map is reserved for the bootloader. A tool that treats the array as one continuous run of equal blocks will produce a file that reads back cleanly and will not program correctly.

These devices are found where the program outgrew the 128 kilobyte parts: protocol stacks, small file systems in flash, menu-driven instruments with several languages in the image. Unlocking one usually means recovering all of it, not just the part that matters.

A geometry that changes halfway

The practical effect of mixed sector sizes is on erase. Erasing eight kilobytes and erasing sixty-four take very different amounts of time, and the bootloader’s prepare-and-copy sequence has to be issued once per group rather than once for the whole image. On a device where the protection setting permits only a full-chip erase, that difference is academic, because the only accepted operation destroys everything.

For recovery it matters in the other direction. Reading the array is straightforward, but rebuilding it is not, because the linker script has to reproduce the same boundaries. An image placed across a sixty-four kilobyte boundary that the original code avoided will run, then fail when the application writes its own parameters into what it believes is a spare sector.

The setting word and what it closes

At 0x0000_01FC the bootloader reads one word and applies it. With read protection active, JTAG is closed and the ISP handler declines Read Memory, Write to RAM, Go and Copy RAM to Flash; erase remains, but only as an operation on all user sectors. The device will still answer on the serial port, which is why an operator who expects silence concludes the chip is dead when it is only refusing.

Identifying the level is a matter of reading the refusals: which commands return the protection error, whether a jump into RAM is accepted, whether the debug port responds at all. All of it happens before anything is written, and that order is the difference between a recovery and a replacement.

Unlocking an LPC2124FBD64

1. Read the marking and establish the revision, since the option set changed across revisions of this family.
2. Map the board: supply rails, crystal, reset supervisor, and the pin the bootloader samples at reset.
3. Record the boot dialogue and fix the protection level from the refusals rather than from assumptions.
4. If execution from SRAM is open, place a loader and read the array in blocks that respect the real sector boundaries, not in uniform chunks.
5. If it is closed, decapsulate and read directly, keeping the ECC bytes for each sixteen-byte group so that later verification is possible.
6. Rebuild the vector table, recompute the word at 0x0000_0014, and place the code back within the same sector boundaries as the original.

What the file looks like

A HEX file whose records follow the real geometry, a binary image, and a map that distinguishes the eight-kilobyte region from the sixty-four kilobyte region and marks the reserved top. Where the application keeps parameters in a dedicated sector, that sector is identified separately so it can be preserved during a partial restore. The workflow is described on the microcontroller unlock service page and the package access under IC decapsulation service.

Before it is sent

State whether the device still runs, give the crystal value, and mention any external memory on the board. If the plan is to keep a spare board in service rather than repair the original, say so, because the same image then has to be proven on a second unit. The smaller array is covered for LPC2114FBD64, the two-controller version for LPC2129FBD64, and the 144-pin parts with the same core under LPC2214FBD144.

Authorisation

Work is carried out on hardware the customer owns or maintains under contract, confirmed in writing before the package is opened. The purpose is repair and legacy support of equipment already in service, and the output is returned to that customer alone. Requests that do not meet that condition are declined, with the reason given rather than implied. The full service scope is on the firmware extraction service page.