The first question about this part has an answer that surprises most people: there is no firmware inside it. The LPC2210FBD144 is a ROMless ARM7TDMI-S microcontroller in a 144-pin LQFP, with 16 KB of on-chip static RAM and an external memory controller but no on-chip flash program memory at all. Recovering locked LPC2210FBD144 source code is therefore a board-level job. The device executes code from a separate memory chip, and that chip is what has to be read.
Boot Pins Decide Everything
At reset the state of P2.26 and P2.27, labelled BOOT0 and BOOT1, selects the width of the memory device attached to chip select 0. Both pins have internal pull-ups, so a board that leaves them unconnected boots from a 32-bit-wide device.
| BOOT1 | BOOT0 | CS0 boot device |
|---|---|---|
| 0 | 0 | 8-bit memory |
| 0 | 1 | 16-bit memory |
| 1 | 0 | 32-bit memory |
| 1 | 1 | 16-bit memory |
The boot ROM initialises the external memory controller according to that choice, reads the first eight words from the external device, and transfers control to the reset vector. If the code was built for a 16-bit bus and the board straps a 32-bit one, nothing runs. Documenting the strap state is therefore part of any successful recovery, and it is a detail that a schematic or a careful photograph of the pull-up resistors can settle.
Four Banks, Sixteen Megabytes Each
The EMC supports four independently configured banks at 0x80000000, 0x81000000, 0x82000000 and 0x83000000. Each can hold SRAM, ROM, flash EPROM, burst ROM or memory-mapped peripherals, and each can be 8, 16 or 32 bits wide. The four BCFG registers starting at 0xFFE00000 set wait states, idle cycles, write protection and bus width. The 144-pin package brings out address lines A[23:0] and data D[31:0], while bank selection uses address bits A[25:24].
This means a single board can carry program code on a parallel flash in bank 0, a large data table on a second device, and scratch RAM on a third. A request that says “read the firmware” has to specify which of those is the code store, because the microcontroller cannot tell you.
Why CRP Is Not The Issue Here
A recover locked LPC2210FBD144 source code ticket should really be addressed to the memory chip beside the MCU.
Code Read Protection on the LPC2000 family is a word at 0x1FC inside sector 0 of on-chip flash. This device has no on-chip flash, so there is no such word and no boot ROM policy blocking a read of program memory. The protection problem moves to the external device: a parallel flash may have its own sector protection, a ROM may be mask-programmed, and an SRAM-backed design loads code from somewhere else entirely at every power-up.
That shift also changes the risk. An erase command sent to the wrong chip destroys code that the MCU itself cannot replace. We identify the memory device by its marking and pinout before applying any programming signal, and we read it directly rather than through the microcontroller.
What A Board-Level Read Looks Like
The external device is usually a straightforward parallel flash with a documented command set. Where it is socketed, removing it and reading it in a programmer is the least invasive option. Where it is soldered, an in-circuit read has to account for the MCU driving the bus, so reset is held and the pin states are controlled. Byte-swapping matters: a 16-bit-wide boot device stores the ARM vector table in a particular lane order, and a dump taken with the wrong assumption produces a plausible-looking but unusable image.
The 8 KB boot block inside the MCU, the ISP and IAP routines in it, and the JTAG and EmbeddedICE-RT debug interfaces all remain available, but none of them contains the application. The 16 KB of on-chip SRAM is volatile and holds nothing after power-down.
Delivery
The result is a binary and an Intel HEX covering the external code device, a note on the BOOT strap state and bus width, and a map of which banks were populated on the board. If more than one non-volatile device is present, each is identified separately. Where a chip has its own protection feature, that is recorded rather than quietly worked around.
Related Work
Our service scope covers board-level intake. The memory-type comparison is useful here because the code may sit in flash, ROM or an OTP device, and this AT32F405 case shows the opposite situation where everything is on one die. Compare the LPC2212FBD144, which adds 128 KB of internal flash to the same bus, and the LPC2290FBD144, the other ROMless member with two CAN channels.