The PIC16F1847 is the refreshed 18/20/28-pin member of the 182x line and the part many designs standardised on: 8192 words (14 KB) of flash, 1024 bytes of SRAM, 256 bytes of EEPROM, sixteen I/O lines, a twelve-channel 10-bit ADC, twelve mTouch capacitive channels, two comparators, two enhanced and two plain CCP modules, and – unusual at this pin count – two MSSP ports for independent SPI and I2C buses. XLP silicon keeps standby around thirty nanoamperes, which is why it sits in battery products as readily as in mains hardware. When protection is engaged, our extract locked PIC16F1847 flash service recovers the image from hardware you own.

Two serial buses, twice the wiring to verify

Two MSSP ports mean a product can talk to a display on one bus and a security IC on the other, and the split is configured from flash constants: which port runs which mode, what addresses the firmware expects, how the buses are clocked. A clone that boots but answers on the wrong port is a classic outcome of checksum-only copying. Recovery therefore verifies both buses separately on the fixture – replaying recorded donor transactions port by port – before anything ships. The instruction-set and addressing background that makes the extracted image readable is in the microcontroller firmware instruction reference.

The data signal modulator is the die’s quiet oddity: one modulator block, usually driving an infrared or carrier-based link, configured from a handful of constants that nothing else in the system explains. Our powered-state capture reads the modulator setup with the rest of the peripheral state, and the delivery notes pair each carrier setting with the output it feeds. Products that stopped modulating after a clone swap have almost always lost exactly this register set – the carrier words, the source selection, the gating – and the fix is a note rather than a re-recovery. Where the modulator output feeds a timing-critical consumer, the interaction is exercised as part of the load-step comparison rather than checked statically.

Energy products and their calibration layer

Microchip’s own solar MPPT reference designs landed on this family, and field hardware often carries the same shape: an energy budget, a charging state machine, and calibration constants that decide efficiency. Those constants live in flash and EEPROM together, so the capture takes both arrays in one protected-state pass – code, data, configuration words – and the report keeps the EEPROM dump beside the code rather than treating it as an afterthought. On battery hardware the sleep-wake constants matter just as much; wake latency and standby current are measured on clone and donor side by side. The commercial and legal frame for this work is described in the semiconductor chip hardware security overview.

The SR latch’s set and reset sources are verified under noise injection, on the theory that a latch which mis-triggers under real interference is worse than one that never triggers at all. Fifteen minutes on the fixture; the alternative has historically been a warranty return with a description nobody could reproduce, and a bench that says ‘cannot duplicate’.

Protection and the erase that stays out of the plan

Code protect in the configuration words refuses external reads once set; data protect seals the EEPROM; write-protect bits can seal regions against the chip’s own self-programming. All of them yield only to the bulk erase that destroys the array, so the erase never runs. The capture maps the configuration words first, reads everything that answers, checksums per sector, and re-reads until two passes agree. Where a customer needs only a bounded slice of the problem – one fleet, one region – the scope pattern is described on the partial microcontroller chip cloning page, and the entitlement basis in the reverse engineering integrated circuit legitimate foundation article.

Duplication and family

Verified images go into matching blanks with EEPROM restored and per-unit read-back, through the MCU flash EEPROM data cloning pipeline. The 20-pin predecessor is on the PIC16F1829 heximal page, and the LCD-driven generation that followed on the PIC16F1933 memory recovery.

Scope

Work is accepted only for units you own or are authorised to service. Send the locked PIC16F1847 and the return is a verified image with bus-verification transcripts, sleep measurements and the protection map attached.