R5F100FG raises the 44-pin row to 128 KB of code flash with 12 KB of RAM,
the 8 KB data flash and ten converter channels in the 10 by 10 mm LQFP at
0.8 mm pitch. It is the capacity where the RL78 core’s segmented one-megabyte
address space dominates the technical picture, inside the package that
makes every one of the family’s recovery techniques easiest to apply.

Segmented images and the rebuild discipline

The core addresses its megabyte through segment registers and far pointers,
and a 128 KB image uses them throughout. Reconstruction that flattens the
segments yields a binary that disassembles plausibly and runs nowhere, the
classic error at this capacity. The flash-side structure is simple, one
hundred twenty-eight one-kilobyte blocks with the boot cluster first, but
every call site carries segment context that must survive into any rebuilt
image.

Twelve KB of RAM and the update machinery

Twelve kilobytes hold the library, the updater and the application
together with room to spare, and the reservation at the top of the
space identifies an update-capable build in any recovered map. Both
boot copies are populated on boards that update in the field, the flag
byte in the first block names the live one, and the copy that is not
running preserves the firmware the product was born with. That pair of
copies is the field history of the board, free for the reading on
every capture.

Ten channels, forty I/O and the data array

The converter’s ten inputs and the forty I/O, nine of them open-drain at a
six-volt withstand, give this member the relay-bank-and-sensor profile that
industrial interface boards are built around. Calibration for the channels
lives in the 8 KB data flash with the fault and usage logs, and the array
is captured with the data-flash command set and its own protection flags.
Code without the array regulates like a stranger.

Protection and the passive opening

An emulator asks for one ten-byte secret and the TOOL0 programmer asks
for the other, and the option byte above them decides whether debugging
exists at all and what a failed comparison costs, up to an automatic
wipe of the whole array. Block protections including the boot-area
guard ship enabled, and where firmware confines its own updates the
shield window is recorded with the capture. The passive read of the
first kilobyte, before anything attaches, is what turns the security
question from a guess into a plan.

Access and the bench

Every physical route on this package is easy: fixtures at 0.8 mm,
adapters, lifts that the part shrugs off. The IC decapsulation service route exists
for the rare job where the image must be reached below the silicon, and
the streaming workflow is described on the firmware extraction service page.

Row context

The 44-pin siblings are in R5F100FA memory readout through R5F100FF embedded memory and
R5F100FH flash data to R5F100FL firmware decryption. The 128 KB die in other packages is the
32-pin R5F100BG flash data, the 36-ball R5F100CG flash heximal and the 40-pin
R5F100EG code flash extraction. For segmented-image handling lessons from an earlier
architecture, see MC9S08DZ128MLF encrypted microprocessor, and the family service index is
microcontroller unlock.

Bank-aware capture on forty-four pins

At 128 KB the image spans the banked address space, and the capture
flow treats the segment layout as image content. The array is walked
block by block with the lowest kilobyte archived first, the boot
region’s mirror read when present, and the bank boundaries recorded so
the reassembly step can rebuild a binary the core will actually run.
Constant tables in the upper windows make useful anchors when
comparing firmware generations, because they change far less often
than the code around them. None of this is visible in a flattened
dump, which is why the flattening step, if wanted at all, happens
last and from the structured original.

The boot region deserves its own note at this capacity: the lowest four blocks and their mirror from 02000H carry the security configuration twice when the swap feature is used, at 010C0H and 010C4H, and a flag in the first block selects the live copy. A capture that records both copies and the flag raw can answer, months later, which generation the unit was running and what the previous one contained, without re-opening the board. The mirror read costs seconds and closes the one gap that later costs a session.