The PIC16F18344 is the 20-pin member of the PIC16F18324/18344 pairing: an enhanced mid-range core executing 49 instructions from a 16-level stack at up to 32 MHz, with 7 KB of flash program memory, 512 bytes of SRAM and 256 bytes of true EEPROM. Seventeen ADC channels, four configurable logic cells, two complementary waveform generators and a data signal modulator make it a compact analogue-friendly controller, and peripheral pin selection lets firmware place those functions almost anywhere on the package. When the code-protect bits are set, our crack secured PIC16F18344 flash recovery reads the image out of hardware you own.

What its protection actually closes

Like the rest of the 183xx family, this part guards its program memory through configuration-word bits rather than a separate key store. Once code protection engages, an external programmer can no longer read the array, and the only path Microchip documents for clearing the setting is a bulk erase, which takes the application with it. A disciplined crack secured PIC16F18344 flash job therefore never issues that erase: the array is characterised in its protected state, read while the data is present, and the configuration words are restored bit for bit afterwards.

EEPROM identity data travels with the image

The 256-byte EEPROM on this die is more than spare storage in most designs we see. Serial numbers, calibration constants and licence tokens live there, and a clone without them may boot but refuse to behave like the original. Our capture therefore includes the EEPROM map alongside every flash word, and the delivered report marks which regions look like structured records versus free space. On one retrofit we handled, the difference between a working replacement and a persistent fault turned out to be a twelve-byte serial block that the customer had assumed lived in flash.

Reading the array without disturbing it

Bench work starts with the 20-pin package confirmed and the part powered inside its 2.3 to 5.5 V window, or the LF variant inside 1.8 to 3.6 V. The internal oscillator is left to run at its configured speed, and the programmer communicates without issuing erase or latch commands. General bench reasoning is documented in our how the MCU memory works guide, and the wider legal framing sits in the semiconductor chip hardware security overview. Every sector is read twice and checksummed before the image is accepted.

Auditing the peripheral pin selection map

Because PPS lets firmware move digital functions between pins, two boards with identical schematic blocks can behave completely differently, and the mapping lives only in the recovered image. As part of every delivery we extract the PPS assignments the code writes at boot and list them pin by pin in the report, so a replacement in a different package grade can be checked against the original wiring before it is soldered in. On retrofit jobs this single table has settled questions that would otherwise need a logic analyser and a day of probing – which pin carries the PWM, which the UART, and which the redundant shutdown path. Where the code computes assignments dynamically rather than writing fixed values, we note the routine that does it, because that is the function your engineers need to read first.

Configurable logic and the modulator path

Four logic cells and a data signal modulator give this part hardware-level glue that older generations had to build out of gates and software loops. Recovered images use those cells for things like encoder Debouncing, charge-pump gating and serial-stream shaping, and the cell configurations are register values initialised from flash constants. Our verification therefore exercises the logic paths with representative inputs rather than trusting register dumps alone, and the report records which cells were configured and from which constants. When a customer needs to port the design forward, that note is the difference between reusing the logic network and redesigning it from the schematic.

Family and service links

The 14-pin sibling is covered on the PIC16F18324 chip page, and the newer 180xx generation with its partitioned memory appears on the PIC16F18046 memory recovery. Duplicated parts are produced through the MCU flash EEPROM data cloning pipeline with read-back comparison on every unit.

Scope and next step

We accept only devices you own or are authorised to service, and the entitlement is recorded with the job. Send the locked PIC16F18344 or its board and we will confirm the package, quote a fixed fee, and return a verified image with the EEPROM contents attached.