The PIC16F1938 lifts the 28-pin LCD family to 16384 words (28 KB) of flash with 1024 bytes of SRAM, keeping the sixty-pixel display driver, twenty-five I/O lines, an eleven-channel 10-bit ADC and the three-enhanced-CCP PWM set. Twenty-eight kilobytes on a 28-pin die usually means a product that grew: a protocol stack, a data logger, a tariff engine – code that was expensive to write and is painful to lose. Our decrypt secured PIC16F1938 heximal service recovers it from hardware you own when the configuration-word protection has been engaged.

Big firmware, sector-level proof

At this size the array is read with per-sector checksums and a mandatory second pass, and the two passes must agree before anything is called a recovery. That is not ceremony: twenty-eight kilobytes gives a flipped bit somewhere to hide, and a clone that boots but misbehaves in one corner of the protocol is the classic symptom of a capture blessed too early. The delivered package includes the sector map and the addressing notes – program memory on this core is word-addressed in 14-bit words, and tools that assume byte addressing produce plausible nonsense. The instruction architecture behind that is in the microcontroller firmware instruction reference, and the memory hierarchy in the how the MCU memory works guide.

Sealed regions are documented, not forced

Beyond code protect, this generation’s configuration words carry write-protect bits that can seal regions against the chip’s own self-programming – a bootloader area, for instance, made permanent by policy. The recovery maps that policy first, reads everything that answers in its protected state, and records sealed regions as facts in the report rather than treating them as obstacles to be broken. Clearing any of it requires the bulk erase that destroys the array, so the erase never runs; the discipline is the same one applied across the family and described for the analogue 177x generation on the PIC16F1776 MCU page.

Bootloader regions are where the write-protect policy shows its teeth. Products that field-update themselves keep the loader in a sealed region so a bad update cannot brick the unit, and that seal is part of the configuration words, not an ornament. A duplicate programmed without the seal accepts a malformed update and dies politely; the recovered words restore the manufacturer’s own protection, which is why they are delivered verbatim and applied first, before any duplication run begins, and re-applied after every reprogramming as a matter of procedure.

What the EEPROM still holds

Logged data and counters concentrate in the 256-byte EEPROM, and on logger products that array is the customer’s actual asset – the record of what happened. It is captured in the same session as the code and restored into every duplicate with its checksum printed; a replacement that boots with an empty log is a replacement that has deleted evidence. Where the scope is a single fleet or a bounded region rather than the whole device, the pattern is described on the partial microcontroller chip cloning page.

Log-ring pointers deserve their own note on logger products. The EEPROM’s ring of records has a pointer that says where the newest entry is, and a replacement whose pointer is zero will overwrite history with the first new reading. Our EEPROM capture preserves the pointer exactly as found, and the verification writes a known record to the clone and confirms it landed after – not over – the donor’s last entry. It is a small check that has preserved more than one audit trail, and ended more than one argument about whose record was authoritative.

Duplication and family

Verified heximals go into matching blanks with EEPROM restored and per-unit read-back, through the MCU flash EEPROM data cloning pipeline. The 14 KB 28-pin member is on the PIC16F1936 source code page, the 40/44-pin 28 KB sibling on the PIC16F1939 software recovery, and the 14 KB 40/44-pin member on the PIC16F1937 EEPROM page.

Scope

Work is accepted only for units you own or are authorised to service. Send the locked PIC16F1938 and the return is a verified heximal, the sector-level proof, and the protection map with sealed regions named.