R5F1006E is the largest 20-pin member of the RL78/G13 line: 64 KB of code
flash, 4 KB of RAM, a 4 KB data flash array, six converter channels and 16 I/O
in a package barely a centimetre long. It exists for boards that needed a full
64 KB of program space but were never given more than twenty pins, and it is
one of those devices where the package says small while the memory map says
medium. The die is the same one Renesas uses across the whole 20-pin row, which
means everything that applies to its 16 and 32 KB siblings applies here, with
more blocks to account for.

Sixty-four blocks and a boundary at 4 KB

The array splits into sixty-four one-kilobyte blocks, numbered zero to sixty
three, and the first four of those blocks form the boot cluster that the swap
logic treats as a unit. At 64 KB the part sits exactly at the capacity where
the data flash is still 4 KB; from 96 KB upward Renesas moves to an 8 KB data
array, which changes how firmware lays out its logs. Knowing the boundary
matters for any examination because the two arrays behave differently under
erase and are protected by different flags.

Four KB of RAM changes the extraction playbook

The jump from 2 KB to 4 KB of volatile memory is what allows this part to run
the flash self-programming library from RAM while the code array is busy. The
library documents a self-RAM window starting at FEF00H on the 64 KB members,
and images built with the official tooling reserve exactly that area. A
recovered linker map that shows segments pinned to FEF00H is therefore
evidence that the image was built with the standard library, and it also hands
the analyst a known-good place to put a readout loader that will not collide
with anything the running application needs.

Protection posture, byte by byte

As on every member of the group, the four option bytes at 000C0H configure the
watchdog, the voltage detector and the oscillator, and the fourth byte at
000C3H decides whether the debug interface exists and whether a failed ten-byte
ID check wipes the array. The debug ID occupies 000C4H to 000CDH and the serial
programming ID occupies 000CEH to 000D7H, both inside block 0. Because that
block also carries the vectors, an author who wanted a closed chip has to have
written these bytes deliberately, and the two decisions are independent: open
debug with a closed serial path, or the reverse, is a common half-configured
state that leaves a workable route into the image.

The small-package quirk that matters

The 20, 24 and 25-pin members of this family have no 32.768 kHz subsystem
clock. The real-time counter runs from the 15 kHz low-speed on-chip oscillator,
which drifts noticeably with temperature. On a board this shows up as timestamps
that wander, and in the lab it shows up in the current signature: a part that
never exhibits the sharp 32.768 kHz startup transient of its larger siblings is
a small-package member, and that alone narrows the identification before the
marking is even read.

Reading strategy on a full 64 KB

Sixty-four kilobytes streams out over the serial link in seconds, and the block
structure makes verification natural: each kilobyte can be checksummed
separately, so a marginal contact on one pin produces a localised failure
rather than a corrupt whole. The data flash is read through the same loader
with a different command set, and a complete image for this part is code flash,
data flash and a note of the option bytes, in that order of importance.

Family context

The smaller 20-pin members are covered in R5F1006A flash memory and R5F1006C code flash extraction,
and the 24-pin row with the same memory range starts at R5F1007A memory readout. For
boards that need converter channels this package does not have, the 30-pin
entry is R5F100AC flash memory. The older 8-bit architectures that this part replaces
on cost, and whose protection model is a single lock bit by comparison, are
represented by MC68HC11E9 encrypted heximal. Physical-level work when the electrical path is
impossible belongs to IC decapsulation service, and end-to-end project handling is described
on the chip reverse engineering service page.