Two CAN controllers and a 32-bit external bus both want the same port pins. That is the design tension behind the LPC2292FBD144: a 144-pin LQFP ARM7TDMI-S at 60 MHz carrying 256 KB of flash and 16 KB of SRAM on die, an 8-channel 10-bit ADC, two CAN channels and a full external memory controller. A copy protected LPC2292FBD144 program job is straightforward in principle and fiddly in practice, because pin multiplexing decides which interfaces a given board can actually expose.
Pin Function Selection Is A Design Decision
The pin connect block assigns each physical pin to GPIO, a peripheral function or the external bus. Enabling the full EMC consumes 24 address lines, 32 data lines and the control signals, leaving 76 of the nominal 112 GPIO. CAN transceivers, UARTs and the JTAG header compete for what remains. A board that uses all four EMC banks and both CAN channels may have no debug connector at all.
That matters for triage. A part with no accessible JTAG is not necessarily protected; it may simply be a cost-reduced layout. We ask for connector photographs and, where available, a schematic before assuming a lock.
The Internal Array Still Follows The Family Rules
The internal array is 256 KB, arranged as small sectors at the bottom and 32 KB ones above. Its opening 4 KB carries the exception vectors, the 0x14 checksum and the CRP word at 0x1FC. Unless those eight vector words add up to zero, boot ROM declines to start the application and drops into ISP instead.
Access to the internal array is a whitelist rather than a lock. The boot ROM reads 0x1FC at reset and decides which ISP commands still answer. At 0x12345678 the debug port and the read and compare commands are gone but sector erase survives. 0x87654321 cuts the command set down to a whole-chip erase. 0x43218765 closes the P0.14 entry pin entirely, provided the vector checksum says the application is valid. Older boot ROMs implement only the middle value, so our first serial exchange is a version query rather than a read request. A protection change takes effect after the supply has been cycled, not after a reset.
Four Banks That CRP Never Sees
The EMC maps four 16 MB banks at 0x80000000, 0x81000000, 0x82000000 and 0x83000000, configured through BCFG0 to BCFG3 in the 0xFFE00000 register block. Bank 0 may supply the boot image when P2.26 and P2.27 select an appropriate width during reset. None of those external addresses is covered by the on-chip CRP word. Code or constant tables placed there are governed by the external device’s own features, if any.
A recovered image that references the 0x80000000 range is a signal to go back to the board. We deliver internal and external contents as separate files, with the observed BCFG configuration and BOOT strap state noted, rather than concatenating them into one misleading binary.
What The CAN Channels Contribute
Dual CAN with a shared acceptance filter means two interrupt sources and one identifier table in the firmware. The message objects and filter configuration live in RAM and peripheral registers; a flash read returns only the code that sets them up. Recognising that initialisation block in a disassembly is usually enough to identify the protocol layer, which is often the part of a gateway program the customer actually needs.
Runtime state is gone at power-down. The watchdog, RTC, timers, PWM unit and vectored interrupt controller are configured by the recovered code, not captured with it.
Order Of Decisions
The boot ROM checks the vector checksum, applies the CRP word at 0x1FC, then samples P0.14. That order explains an otherwise contradictory result: a part whose sector 0 was partially erased fails the checksum and falls into ISP even when the protection word would have closed that path. Reading the first 32 bytes before any destructive command beats an assumption about the setting.
Verification And Handover
The array is read twice, the vector checksum at 0x14 is recomputed, and blank sectors are flagged, never filled with invented bytes. Where the on-chip flash carries Hamming correction, the check bytes are retained with the data so a marginal cell is not silently turned into a plausible instruction. The CRP word, bootloader revision and sector map are recorded alongside the binary.
Related Work
Our service scope covers board-level and device-level intake. The NVRAM article is useful background on volatile state, and this 32-bit ARM case shows a comparable workflow. Compare the LPC2214FBD144, which shares the 256 KB array but drops both CAN channels, and the LPC2294HBD144, which doubles them to four and raises the temperature grade.