Thirty-four kilobytes is not one block of memory on this part. The LPC2364FBD100 is the 128 KB flash member of the 72 MHz LPC23xx family, in a 100-pin LQFP with an RMII Ethernet MAC, a USB 2.0 full-speed device, two CAN channels, a six-channel 10-bit ADC, a 10-bit DAC and 70 GPIO. Its SRAM is split into four physically separate pools, and to recover encrypted LPC2364FBD100 code you must know which of them a routine can actually use.
The Four Pools, And Why They Are Separate
Eight kilobytes sit on the ARM local bus, sixteen serve the Ethernet controller, eight serve USB and general-purpose DMA, and two are powered from the RTC battery domain. The Ethernet and USB blocks can be used as ordinary SRAM when their peripherals are idle, but they are on a different AHB subsystem. That distinction is not cosmetic: the IAP routines in boot ROM require the source data to be in local-bus SRAM. A buffer placed in the USB or Ethernet block cannot be copied straight to flash by an IAP call.
With only 8 KB of local SRAM, an in-application updater on this device stages 256, 512, 1024 or 4096 bytes at a time, with the destination aligned to 256 bytes. Finding that loop in a disassembly identifies the field-update path and also tells you which sectors the application treats as writable data. The 2 KB RTC-domain block survives a main power loss, so it is the one place where customer state may persist outside flash.
Dual AHB Changes A Live Capture
The LPC23xx uses two AHB buses so that Ethernet DMA, USB DMA and instruction fetches from on-chip flash can proceed without contention. For a readout that means bus activity is not a simple linear stream of instruction fetches. A logic analyser on external pins sees peripheral traffic and GPIO toggling, not the code being executed from the internal array. The flash sits on the ARM local bus and is best approached through the array itself rather than inferred from external behaviour.
The Array And The Boot Block
One hundred and twenty-eight kilobytes is eight 4 KB sectors followed by three 32 KB sectors. The 8 KB boot block is at 0x7E000 to 0x7FFFF and holds the ISP, IAP and RealMonitor routines; ISP and IAP commands cannot write, erase or branch into it. Sector 0 contains the eight exception vectors, the checksum word at 0x14 and the Code Read Protection word at 0x1FC.
Protection here is a policy enforced by boot ROM code at reset, not an encryption layer over the array. The word at 0x1FC selects how much of the ISP command set survives. In-application programming is deliberately exempt: a shipped product must still be able to rewrite its own flash through the ROM entry at 0x7FFFFFF0, and that call is made by code already executing on the chip. Recognising an IAP wrapper in a recovered image tells us which sectors the application treats as writable, which is often where calibration values live. The vector checksum is evaluated before any of these rules, so the state of sector 0 is the first fact to establish.
What Ethernet And CAN Do Not Store
The RMII MAC needs an external PHY; the registers, descriptor rings and packet buffers are volatile. The two CAN controllers keep their acceptance filter in RAM. Neither contributes to a flash dump. What the array does hold is the initialisation code and any static configuration tables, and separating those from executable code is part of producing a usable delivery.
The PHY Is Off-Die
The external RMII PHY and the CAN transceivers hold only volatile registers and a little FIFO state. Ruling them out at intake keeps the scope on the one non-volatile array that actually contains the application.
Handover
The handover separates the internal array from anything found on a card. We ship a binary plus HEX for the programmed sectors with a blank-sector map, recompute the 0x14 checksum, and log the protection word and ROM revision. ECC bits captured with the data are kept alongside it; where a region had to be rebuilt rather than read, the manifest says so.
Related Work
The contact page handles intake. The NVRAM article explains the RTC-domain retention question, and this AT32F405 case is a contrast with a family that implements an execute-only region. The LPC2364HBD100 is the same die qualified to a higher temperature, and the LPC2368FBD100 is the 512 KB member with SD/MMC added.