The second article on the R5F1006A follows the serial side of the family’s
protection: the TOOL0 single-wire link, the boot ROM conversation that runs
over it, and the ten-byte identifier that decides who may use it. This one
stays on the programming path,
because on the smallest member of the family that path is usually the only
one a board exposes.

One wire, one protocol

TOOL0 is a single pad on P40 that carries a clocked UART handshake. The
boot ROM listens on it after reset, synchronises on a specific pattern and
then speaks a command protocol: authenticate, erase, write, verify. The
same two UART pins on P11 and P12 that serve the application’s serial
port double as the debug receive and transmit lines, but the programming
path itself needs only the one wire plus ground and power. On a 20-pin
board that economy is deliberate: the factory needs one session, the
layout gives one pad, and everything else stays inside the package.

The ten-byte identifier at 000CEH

The serial programming security ID occupies 000CEH to 000D7H in block 0,
ten bytes that the boot ROM compares during authentication. An all-FF
pattern is legal and means no identifier, so a blank area is an open door
that stays open. When the bytes are populated, the programmer must present
the matching value or the conversation ends. Failures on this path do not
erase anything: the destructive option belongs to the debug side at
000C3H, which is why the serial route is the safer place to probe an
unknown board even when it is locked.

The half-configured boards

Production lines almost always populate the serial identifier, because the
programming station needs it once. The debug identifier at 000C4H is set
far less often on consumer products, and the erase-on-failure bit is
disabled by default in many tool flows. The result is a chip that refuses
the programmer and accepts the emulator, or the reverse, and the passive
read of block 0 distinguishes the cases before any tool connects. On this
20-pin member that read is a single careful probe on an exposed pad or a
lifted part on an adapter.

Reading through the serial path

When the identifier is blank, the boot ROM’s own protocol reads the array
out directly, and sixteen one-kilobyte blocks plus the 4 KB data flash
stream in seconds. When it is populated, the same protocol still serves as
an observation point: the authentication exchange reveals which
identifier is active, and the timing of the responses narrows the
firmware’s configuration without touching it. Neither use erases anything,
which is the property that makes the serial route the opening move on
this part.

The physical side of one pad

The 20-pin LSSOP and TSSOP bodies put the pins on 0.65 mm pitch, and the
single-wire pad is usually routed to a test point. Where it is not, the
lift-and-reball route onto an adapter is routine and reversible. The die
remains reachable through the IC decapsulation service service as the last resort, and
package-level examination is part of the chip reverse engineering service flow.

Family context

The 32 KB sibling
is R5F1006C code flash extraction and the 64 KB one is R5F1006E firmware decryption. The same
serial-path architecture on the leaded 30-pin package is described under
R5F100AA flash data. The imaging workflow is the firmware extraction service page, the
owner-authorised opening cases are on microcontroller unlock service, and the family index
is microcontroller unlock.

What the security setting command changes

Among the boot ROM’s commands is the one that writes the ten-byte
serial secret, and its behaviour explains a lot of production
accidents. Once written, the bytes cannot be read back, only matched;
a blank chip accepts the command, a programmed one refuses it, and a
host that sends the wrong sequence can leave the identifier in a state
the factory never intended. Legitimate owners recovering their own
boards should know that attempting to set or reset the secret is
pointless and irreversible, and that the read side of the protocol
needs no such step: either the chip authenticates and talks, or it
refuses, and refusal is information rather than an obstacle to
brute-force. Refusal, in other words, is a result to record rather
than a wall to hit.