The PIC16F18054 opens the 28-pin tier of the PIC16F180 family: 7 KB of flash, 512 bytes of SRAM, 128 bytes of data EEPROM and twenty-five I/O lines, with a 10-bit ADC giving twenty-four external plus four internal channels. Its ADC with computation, capacitive voltage divider support and charge pump mark it as the generation’s sensor-interface part. When code protection is engaged, our decrypt protected PIC16F18054 program service recovers the image from hardware you own.

Protection policy before bytes

The 180xx generation stores its protection as programmable code and write protection on the three flash partitions – application, boot and storage area – while the device information area keeps factory reference data and the Microchip unique identifier. Those configuration words are read first, because a part can be sealed on the application block yet still yield parameter storage. Every decrypt protected PIC16F18054 program job follows that order: map the policy, read what answers in its locked state, and never run the bulk erase that clearing protection would require.

ADCC settings are part of the program

What separates this generation from its predecessors is how much behaviour lives in the ADC’s computation logic: accumulation cycles, filtering, threshold interrupts and the capacitive voltage divider sequencing are all register-configured, and the registers are initialised from constants in flash. A recovered image therefore has to be verified at the analogue boundary, not just at the checksum. Our bench fixture replays representative sensor inputs through the clone and the donor side by side, comparing converted values and interrupt timing before anything ships. Customers using the image for re-design receive a note on which constants drive the ADCC setup, so their engineers can retune thresholds without disassembling the whole application. Handling discipline for this class of array is covered in the microcontroller firmware instruction reference, and bounded recovery work on the partial microcontroller chip cloning page.

Capacitive voltage divider sequencing

The automated CVD technique this generation supports measures touch and proximity by reordering the ADC’s own sampling, and the sequence is configured from constants in flash. Touch products built on this part tune those sequences per housing: panel thickness, overlay material and guard layout all shift the optimal pattern. Our recovery therefore treats CVD constants as first-class content – captured, checksummed and verified with actual touch events on the donor’s panel where the fixture allows. A clone that boots and reads keys is not enough; keys must register with the donor’s sensitivity and rejection behaviour, or the product feels different to every user the day it ships.

Threshold interrupts in the cloned unit

ADCC threshold comparisons offload the CPU from polling, which is why this part appears in battery products: the processor sleeps until the converted value crosses a configured window. Those thresholds are constants, and their behaviour is observable – a clone’s interrupt should fire at the same measured value as the donor’s. Our verification checks exactly that, driving the input through the threshold on both units in parallel. On one occupancy-sensor job the first clone attempt’s threshold sat two counts off, enough to wake the controller spuriously and halve battery life; the parallel test caught it before delivery, and the fix was a single captured byte that an image-level clone would have had right all along only if the capture had included the configuration space – which ours always does.

Pin budget planning with recovered maps

The PPS assignments our reports extract double as a pin-budget document for redesigns. Engineers planning a cost-down board can see which of the twenty-five I/O lines the firmware actually claims, which are static inputs, and which the peripheral pin selection moved away from their default ports. Two customers pruned unused decoupling and pull-ups based on those maps alone, and one discovered a pin the firmware repurposed mid-life – a revision the schematic had never captured. The map costs nothing extra to produce and routinely becomes the most-referenced page of the delivery.

Duplication

Verified images go into matching 28-pin blanks with flash, EEPROM and configuration words restored, through the MCU flash EEPROM data cloning pipeline with read-back comparison on every unit. Analysis context for larger investigations is in the MCU reverse engineering concept article.

Family links

The 14 KB sibling is on the PIC16F18055 code page, the 20-pin flagship on the PIC16F18046 memory recovery, and the 40-pin members on the PIC16F18075 MCU page.

Scope

Only devices you own or are authorised to service are accepted. Send the locked PIC16F18054 and we will confirm the package, quote a fixed fee, and return a verified program with its ADCC and EEPROM notes.