Crack Renesas Microprocessor R5F21336TNFP Flash Memory and extract the embedded heximal from MCU’s memory, the original Microcontroller firmware can be recovered after disable the protection system;
Below Figure shows a Memory Map of R8C/20 Group. The R8C/20 Group has 1 Mbyte of address space from address 00000h to FFFFFh.
The internal ROM is allocated lower addresses, beginning with address 0FFFFh. For example, a 48-Kbyte internal ROM is allocated addresses 04000h to 0FFFFh.
The fixed interrupt vector table is allocated addresses 0FFDCh to 0FFFFh. They store the starting address of each interrupt routine.
The internal RAM is allocated higher addresses, beginning with address 00400h. For example, a 2.5-Kbyte internal RAM is allocated addresses 00400h to 00DFFh. The internal RAM is used not only for storing data but also for calling subroutines and as stacks when interrupt requests are acknowledged.