Seventy-six or one hundred and twelve. That is the GPIO count of the LPC2214FBD144 depending on whether the external memory bus is enabled, and it is a neat summary of why this part is awkward to work with on a production board. The device carries 256 KB of on-chip flash, 16 KB of SRAM, a 60 MHz ARM7TDMI-S core, an 8-channel 10-bit ADC and an EMC, all in a 144-pin LQFP. A readout of encrypted LPC2214FBD144 firmware has to account for the pins that the bus has already taken.
What The Bus Consumes
A readout encrypted LPC2214FBD144 firmware enquiry should begin with the GPIO budget, not with the debugger.
The EMC exposes 24 address lines, 32 data lines, four byte-lane selects, output enable, write enable and four chip selects. Those signals are multiplexed with ports P2 and P3, so a design using the full 32-bit bus gives up a large share of the package. The four banks sit at 0x80000000 through 0x83000000 and are configured through BCFG registers beginning at 0xFFE00000; bank 0 can be the boot source under the control of P2.26 and P2.27.
JTAG needs TCK, TMS, TDI, TDO and TRST. The Embedded Trace Macrocell needs a wider set of trace pins if instruction tracing is used. Neither group is guaranteed a header on a cost-reduced board. When the debug connector is absent, a non-invasive route through the debug port is unavailable for a mundane reason, and that should be established before anyone starts describing the part as locked.
The Internal Array
Two hundred and fifty-six kilobytes of on-chip flash uses 4 KB sectors at the bottom and 32 KB sectors above, with small sectors near the top. Sector 0 holds the exception vectors, the checksum word at 0x14 and the CRP word at 0x1FC. The boot ROM requires the eight vectors to sum to zero; otherwise it enters ISP instead of running user code. ISP and IAP are forbidden from writing, erasing or executing a go into the 8 KB boot block.
The protection word is a single 32-bit value. 0x12345678 selects CRP1: JTAG off, ISP read and compare off, sector 0 writes blocked, sector erase still available. 0x87654321 selects CRP2, where only a full-chip erase remains. 0x43218765 selects CRP3, which disables ISP entry via P0.14 when valid user code is present. Early bootloaders implemented only the middle level; a version query is the first serial command.
IAP, And Why It Survives Protection
In-application programming is a set of ROM routines entered at 0x7FFFFFF0 and called by code already executing on the chip. CRP does not disable it, because a shipped product must still be able to update its own firmware. Writes require a 256-byte-aligned destination and move 256, 512, 1024 or 4096 bytes at a time from SRAM. With only 16 KB of RAM, an updater on this part stages small blocks.
Finding that routine in a recovered image is useful for two reasons. It identifies which sectors the application treats as writable data, and it warns that a customer may already have an authorised path to reload the array. It also means the vector table may have been remapped to SRAM during updates, since flash cannot be read while it is being erased.
Two Arrays, Two Deliveries
A board can boot from internal flash and use external banks for fonts, waveforms or logging, or it can boot from external memory with the internal array holding a loader. We deliver the two separately, with the BCFG configuration and BOOT strap state recorded. A dump that stops at 256 KB is only complete if the disassembly confirms that nothing references the 0x80000000 range.
Verification
The image is read twice, the checksum at 0x14 is recomputed, blank sectors are marked rather than padded, and the CRP word and bootloader revision are logged. ARM and Thumb code can alternate at subroutine boundaries, so a flat 32-bit decode is not used for analysis.
Related Work
Our service scope describes intake and accepted device states. The protection walkthrough sets out the layers in order, and this AT32F435 case shows a different approach to protecting a large array. For the 128 KB sibling see the LPC2212FBD144; for the four-CAN, high-temperature member of the same 144-pin family see the LPC2294HBD144.